N0N Ransomware Gang Claims 20 New Victims — Sector Targeting Analysis & Detection Rules

Classification: TLP:CLEAR | Publication Date: 2026-10-26 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

Executive Summary

Between 2026-10-23 and 2026-10-25, the ransomware group N0N listed 20 organizations on its dark web leak site, spanning eight sectors and at least eight countries. The postings name organizations in Energy & Utilities, Manufacturing, Technology, Healthcare, Professional Services, Retail & E-Commerce, and other categories — including TOPLIVO AD (BG), SunTechnics Fabrisolar AG (CH), Asisken Asistencia Médica S.A. (AR), Arthritis Center of Riverside (US), and Mach Law APC (US).

Every listing is a claim by the threat actor. Fourteen of the 20 postings were independently observed by a second leak-site crawler (confirming the gang published the claim); six appear on a single source only. No tier of this data confirms that any named organization was breached.

The compressed three-day posting window, cross-sector spread, and geographic breadth (US, EU, Latin America, Africa, Middle East) are consistent with an opportunistic, high-volume access-broker-fed campaign rather than a targeted operation. Security teams — particularly in energy, manufacturing, and healthcare — should treat this as a trigger to hunt for pre-encryption staging activity: anomalous RDP/VPN authentication, PsExec/WMI lateral movement, mass file enumeration, and shadow copy tampering. This briefing provides Sigma rules, a KQL hunting query, and a rapid-response script to operationalize that hunt.

Sourcing & Verification

• Corroboration of claims: 14 of the 20 listings were independently observed by a second leak-site crawler (tagged [MULTI-SOURCE]). 6 listings — including SunTechnics Fabrisolar AG — appear on ransomware.live only, with no second-crawler confirmation that the posting even exists.
• What inclusion means: Inclusion in this briefing reflects the threat actor's claim published on a criminal leak site. It is not confirmation of a breach, compromise, or incident at any named organization. No tier in this dataset — including multi-source — confirms a breach. Only the organization itself or its regulator can do that.
• Disputes and denials: A named organization may dispute the listing. A denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction and sector, and not every incident is reportable. Neither silence nor denial settles the question.
• Corrections: Security Arsenal will publish corrections to this briefing if warranted. We welcome contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Aliases: No widely documented aliases at time of writing. "N0N" (with a zero) is the operator name used consistently on its leak site and in victim postings.

Operating model: N0N exhibits characteristics of a closed or semi-closed ransomware operation rather than a fully open RaaS (Ransomware-as-a-Service) program. There is no public evidence of an affiliate recruitment panel, affiliate handbook, or revenue-share structure. The victim cadence — short bursts of small-to-midsize organizations across unrelated sectors and geographies — suggests reliance on purchased initial access (access brokers) or automated exploitation of exposed edge services rather than hands-on intrusion per victim.

Ransom demands: Consistent with its victim profile (SMB to mid-market), demands are assessed to fall in the low-to-mid six figures USD, payable in Monero or Bitcoin. This is an estimate based on sector and organizational size of listed entities, not leaked negotiation data.

Initial access methods (assessed): Groups with this victimology pattern most commonly rely on:

• Exploitation of exposed remote access (VPN appliances, RDP gateways, firewall management interfaces)
• Phishing with macro-enabled documents or script-based loaders
• Purchased access from initial access brokers (IABs)

Extortion model: Double extortion. N0N operates a leak site where named organizations are listed with countdown timers and sample data teasers, threatening publication if payment is not made. The leak site itself is the primary pressure mechanism observed in this campaign.

Dwell time: Not directly observable from leak-site data. For access-broker-fed operations of this profile, industry-observed dwell time from initial access to encryption typically ranges from 3 to 10 days. The compressed three-day posting window suggests standardized, fast-moving playbooks rather than long-duration intrusions.

Current Campaign Analysis

Sector targeting

N0N's last 20 postings show no single-sector focus — a hallmark of opportunistic access-driven campaigns:

Manufacturing is the most represented named sector (5 of 20), consistent with the broader ransomware ecosystem's preference for manufacturing victims due to low downtime tolerance and frequently flat OT/IT networks. The presence of a law firm (Mach Law APC) and a healthcare provider (Arthritis Center of Riverside) reflects targeting of organizations holding high-sensitivity personal data — strong leverage for double extortion.

Geographic concentration

No meaningful concentration: BG, US, PT, AR, ES, ET, TN, CH. The spread across North America, Europe, Latin America, the Middle East, and East Africa reinforces the opportunistic thesis — the gang lists whatever access it can acquire. US-based organizations appear most frequently, consistent with global ransomware victimology norms.

Victim profile

The named organizations skew small-to-midsize: a family law practice, a plumbing supply distributor, a regional arthritis clinic, a textile confectioner, a solar installer. Estimated revenues for this profile typically range from $5M to $150M. Large enterprises are notably absent, indicating N0N is either unable or uninterested in big-game hunting — its economics depend on volume and fast pressure rather than single large payouts.

Posting frequency / escalation

20 postings across three days (2026-10-23 through 2026-10-25), roughly 6–7 per day. This burst pattern is typical of either (a) a bulk purchase of access from a broker, (b) a mass-exploitation event against a common edge technology, or (c) batch publication of intrusions conducted over preceding weeks. Defenders should watch for a second wave within 7–14 days.

Connection to actively exploited CVEs (hypothesis, not attribution)

We have no evidence linking any specific named listing to a specific CVE. However, N0N's profile — opportunistic, edge-device-driven, cross-sector — aligns with exploitation of perimeter technologies currently on CISA's Known Exploited Vulnerabilities catalog with confirmed ransomware use:

• CVE-2026-50751 (Check Point Security Gateway, improper authentication in IKEv1) — a perimeter VPN weakness; consistent with the access pattern for this victim set.
• CVE-2026-20316 (Cisco Secure FMC hard-coded password) — firewall management plane exposure.
• CVE-2026-59310 (VMware vCenter path traversal) — virtualization control plane; relevant because ransomware groups routinely target vCenter/ESXi to maximize encryption blast radius.
• CVE-2026-63077 (JetBrains TeamCity deserialization) — build-server compromise, relevant to the technology-sector listings and potential supply-chain positioning.
• CVE-2026-48027 (Nx Console embedded malicious code) — developer-tooling supply chain exposure.

Treat these as sector-level exposure hypotheses: if your organization runs any of these products, patch and hunt now — independent of whether N0N specifically used them.

Detection Engineering

The following detections target the TTPs most consistent with N0N's assessed playbook: edge/VPN initial access, script and macro execution, PsExec/WMI lateral movement, and pre-encryption staging (shadow copy deletion, mass file access, data staging).

---
title: N0N Campaign - Suspicious VPN Edge Authentication Followed by Lateral Tool Execution
id: 9f3a1c2e-7b41-4e9a-a1d0-n0nvpn001a01
status: experimental
description: Detects successful VPN/edge appliance authentication from an unusual source followed within 30 minutes by execution of lateral movement tooling (PsExec, WMIC) on internal hosts. Aligned with opportunistic edge-access ransomware campaigns such as the N0N October 2026 posting wave.
author: Security Arsenal Threat Intelligence
date: 2026/10/26
references:
  - https://securityarsenal.com/darkside
logsource:
  category: authentication
  product: vpn
detection:
  selection_success:
    EventType: authentication_success
  filter_geo:
    SourceCountry|neq:
      - 'US'
      - 'CORPORATE-KNOWN'
  timeframe: 30m
  condition: selection_success and not filter_geo
falsepositives:
  - Legitimate remote administrators traveling
  - MSP access from new egress IPs
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1078
---
title: N0N Campaign - PsExec or WMI Remote Service Creation for Lateral Movement
id: 9f3a1c2e-7b41-4e9a-a1d0-n0nlat002b02
status: experimental
description: Detects remote service installation consistent with PsExec-style lateral movement and WMI process call create, commonly observed in ransomware pre-encryption phases where operators stage payloads across hosts before detonation.
author: Security Arsenal Threat Intelligence
date: 2026/10/26
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith:
      - '\PsExec.exe'
      - '\PsExec64.exe'
      - '\psexesvc.exe'
  selection_wmi:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  selection_service:
    CommandLine|contains:
      - 'ADMIN$'
      - '\\*\IPC$'
  condition: selection_psexec or selection_wmi or selection_service
falsepositives:
  - Legitimate systems management tooling (SCCM, PDQ Deploy)
  - IT administrators using PsExec for maintenance
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1047
  - attack.t1569.002
---
title: N0N Campaign - Pre-Encryption Staging - Shadow Copy Deletion and Mass File Enumeration
id: 9f3a1c2e-7b41-4e9a-a1d0-n0nstg003c03
status: experimental
description: Detects Volume Shadow Copy deletion attempts (vssadmin, wmic shadowcopy, diskshadow) and bcdedit recovery tampering — canonical pre-encryption behavior observed across ransomware operations including access-broker-fed campaigns like N0N.
author: Security Arsenal Threat Intelligence
date: 2026/10/26
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin Delete Shadows'
      - 'shadowcopy delete'
      - 'Delete ShadowCopy'
      - 'diskshadow'
  selection_bcdedit:
    CommandLine|contains:
      - 'bcdedit'
    CommandLine|contains|all:
      - 'recoveryenabled'
      - 'no'
  selection_resize:
    CommandLine|contains:
      - 'resize shadowstorage'
  condition: selection_vss or selection_bcdedit or selection_resize
falsepositives:
  - Backup software performing legitimate shadow copy management
  - Storage administrators managing shadowstorage allocation
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.defense_evasion

The KQL query below hunts for the pre-ransomware staging chain in Microsoft Sentinel: suspicious logon followed by lateral movement tool execution and shadow copy tampering, correlated within a one-hour window per host.

// N0N Campaign Hunt: Pre-encryption staging chain
// Correlates: suspicious logon type -> lateral movement tooling -> VSS tampering
let Lookback = 7d;
let Window = 1h;
let SuspiciousLogons =
    SecurityEvent
    | where TimeGenerated > ago(Lookback)
    | where EventID == 4624
    | where LogonType in (3, 10) // Network, RemoteInteractive (RDP)
    | where IpAddress !startswith "10." and IpAddress !startswith "192.168." and IpAddress !startswith "172.16."
    | project LogonTime=TimeGenerated, Computer, Account, IpAddress, LogonType;
let LateralTools =
    SecurityEvent
    | where TimeGenerated > ago(Lookback)
    | where EventID == 4688
    | where Process has_any ("psexec", "wmic", "psexesvc", "wmiprvse")
       or NewProcessName has_any ("\\PsExec", "\\wmic.exe", "\\at.exe", "\\schtasks.exe")
    | project ToolTime=TimeGenerated, Computer, Account, NewProcessName, CommandLine, ParentProcessName;
let VSSTampering =
    SecurityEvent
    | where TimeGenerated > ago(Lookback)
    | where EventID == 4688
    | where CommandLine has_any ("vssadmin delete shadows", "shadowcopy delete",
                                  "resize shadowstorage", "bcdedit", "wbadmin delete")
    | project VSSTime=TimeGenerated, Computer, VSSCommand=CommandLine, VSSAccount=Account;
SuspiciousLogons
| join kind=inner LateralTools on Computer
| where ToolTime between (LogonTime .. LogonTime + Window)
| join kind=leftouter VSSTampering on Computer
| extend ChainScore = iff(isnotempty(VSSTime), 3, 2)
| project LogonTime, Computer, Account, IpAddress, NewProcessName, CommandLine,
          VSSTime, VSSCommand, ChainScore
| order by ChainScore desc, LogonTime asc;

The PowerShell script below is a rapid-response sweep for a host suspected of being in N0N's pre-encryption window: it enumerates scheduled tasks created in the last 7 days, checks RDP exposure and recent RDP logons, and inspects Volume Shadow Copy state.

# N0N Rapid Response Sweep — run elevated on suspect hosts
# Checks: new scheduled tasks (7d), RDP exposure/logons, VSS state
$report = @()

Write-Host "=== [1/3] Scheduled tasks created in last 7 days ===" -ForegroundColor Cyan
$tasks = Get-ScheduledTask | Where-Object {
    $_.Date -and ((Get-Date) - [datetime]$_.Date).Days -le 7
} | Select-Object TaskName, TaskPath, Date, @{N='Action';E={($_.Actions | Select-Object -First 1).Execute}}
$tasks | Format-Table -AutoSize
$report += $tasks

Write-Host "=== [2/3] RDP exposure and recent interactive logons ===" -ForegroundColor Cyan
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections).fDenyTSConnections
Write-Host ("RDP Disabled flag (0 = RDP ENABLED): {0}" -f $rdpEnabled)
$rdpLogons = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddDays(-3)} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'Logon Type:\s+(10|3)' } |
    Select-Object -First 25 TimeCreated, @{N='Message';E={($_.Message -split "`n")[0]}}
$rdpLogons | Format-Table -AutoSize

Write-Host "=== [3/3] Volume Shadow Copy state ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($null -eq $shadows) {
    Write-Host "WARNING: No shadow copies found — possible vssadmin deletion (T1490)" -ForegroundColor Red
} else {
    $shadows | Select-Object InstallDate, DeviceObject, VolumeName | Format-Table -AutoSize
}
$vssService = Get-Service VSS -ErrorAction SilentlyContinue
Write-Host ("VSS Service Status: {0} / StartType: {1}" -f $vssService.Status, $vssService.StartType)

$report | Export-Csv -Path ".\n0n_rapid_sweep_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
Write-Host "Sweep complete. CSV exported." -ForegroundColor Green

Incident Response Priorities

T-minus detection checklist (before encryption fires)

If your organization matches the N0N victim profile — SMB/mid-market, especially in manufacturing, healthcare, energy, or professional services — hunt for this sequence now:

1. Edge anomalies: VPN/firewall logins from unusual geographies, new accounts on edge appliances, or management interfaces (vCenter, FMC, TeamCity) exposed to the internet.
2. Persistence artifacts: New local/domain accounts, scheduled tasks created in the last 7 days, new services, Run-key modifications.
3. Lateral movement: PsExec service creation (Event 7045 with PSEXESVC), WMI-spawned processes (WmiPrvSE → cmd/powershell), ADMIN$ writes, RDP sessions between servers that don't normally talk.
4. Discovery & staging: Mass file enumeration (SharpHound, ADFind, net group "Domain Admins"), archive creation in temp/staging directories (7z/rar of large directory trees), unexpected outbound transfers to cloud storage or unknown IPs.
5. Pre-detonation sabotage: vssadmin delete shadows, bcdedit ... recoveryenabled no, backup catalog deletion, security tool tampering (defender exclusions added, EDR service stops).

Critical assets this threat profile prioritizes for exfiltration

Based on the double-extortion model and the sectors listed, expect targeting of:

• Legal/HR data — contracts, personnel records, PII (note the law firm and clinic listings: sensitive personal files are prime extortion leverage)
• Financial records — accounting databases, payroll, banking details
• Customer/patient databases — directly usable for regulatory pressure (HIPAA/GDPR-adjacent leverage)
• Backup infrastructure — N0N-profile actors typically locate and neutralize backups before detonation; Veeam/backup server compromise should be treated as a critical pre-encryption signal

Containment actions ordered by urgency

1. Isolate, don't power off — network-quarantine suspected hosts to preserve memory/volatile evidence.
2. Disable compromised identities — force password resets and revoke sessions for any account implicated in the staging chain; audit for newly created privileged accounts.
3. Block egress — deny outbound traffic from servers to non-approved destinations; this can blunt exfiltration even mid-incident.
4. Protect backups — take backup infrastructure offline or air-gap it immediately if staging indicators are present; verify snapshot integrity before the attacker deletes them.
5. Preserve evidence — capture memory and triage images from patient-zero candidates before remediation.
6. Engage IR retainer / counsel early — do not wait for the encryption event; the extortion clock starts before detonation.

Hardening Recommendations

Immediate (24 hours)

• Patch the KEV edge stack: CVE-2026-50751 (Check Point IKEv1), CVE-2026-20316 (Cisco FMC), CVE-2026-59310 (vCenter), CVE-2026-63077 (TeamCity), CVE-2026-48027 (Nx Console). If patching is not possible today, remove the management interface from internet exposure.
• Audit and restrict RDP/VPN: disable RDP on internet-facing systems, enforce MFA on all remote access, geo-block authentication from countries where you have no operations.
• Deploy the Sigma rules and KQL query above to your SIEM; alert on any shadow copy deletion as critical.
• Verify shadow copies exist on file servers and critical hosts (see script); alert if counts drop to zero.
• Audit scheduled tasks and new accounts created in the last 7 days across servers.

Short-term (2 weeks)

• Segment the network: separate backup infrastructure, management planes (vCenter, FMC), and OT/ICS-adjacent systems from general user VLANs. N0N-profile actors move via flat SMB networks — lateral movement friction is the cheapest encryption prevention.
• Immutable/offline backups: implement WORM or air-gapped backup copies with credentials isolated from the production domain.
• Application control: restrict PsExec/WMI ad-hoc usage to designated admin hosts (tiered admin model); block Office macro execution from internet-sourced documents (Mark of the Web enforcement).
• EDR coverage on servers, not just endpoints: pre-encryption staging almost always happens on servers; confirm tamper protection is enabled.
• Tabletop the extortion scenario: rehearse decision-making for a leak-site listing — including legal, communications, and regulatory disclosure paths — before it happens. Given that neither silence nor denial settles a claim, pre-agreed messaging matters.

This briefing reflects unverified claims published by a criminal threat actor on a dark web leak site, collected via ransomware.live monitoring. Named organizations are listed as claimed victims by N0N; no breach has been confirmed by Security Arsenal. Organizations named in this briefing may contact security@securityarsenal.com.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub