Classification: TLP:CLEAR | Publication Date: 2026-10-14 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang Claims 42 New Leak-Site Listings — Maritime & Logistics Cluster Emerges

Executive Summary

Security Arsenal's dark web monitoring has observed a surge of activity on the leak site operated by the ransomware group tracked as N0N: 42 postings in the most recent 100-listing window, with 15 listings published on 2026-10-12 and 2026-10-13 alone. Every listing represents a claim by the threat actor — none of these postings confirm that any named organization suffered a breach.

The most significant pattern in this batch is a pronounced concentration in maritime transportation, port operations, container terminals, and shipbuilding. N0N has listed, among others, Santos Brasil (port operations, BR), Asyaport (container terminal operations, TR), Ocean Network Express (container shipping, SG), Portonave (container terminal operations, BR), Polaris Shipping (dry bulk shipping, KR), ZPMC (port machinery and terminal engineering, CN), Tsuneishi / Kambara Kisen (shipbuilding and ship management, JP), GlobalNet LCL (port agency operations, ID), and MGNP (port terminal operations, KR). Alongside this maritime cluster, N0N also claims to have compromised organizations in healthcare (Hunter Neurology), retail (MarieBelle New York, US), and financial services (PG Group (Pure Options)), plus several entities listed only as "Company #63/#64/#65" with sector marked Not Found.

Geographically, claimed victims span BR, US, ID, TR, SG, KR, CN, and JP — a trans-Pacific and Latin American footprint consistent with a campaign deliberately aimed at global shipping and supply-chain chokepoints rather than opportunistic scatter.

Bottom line for defenders: Whether or not any individual claim proves accurate, organizations in maritime logistics, port operations, shipbuilding, healthcare, retail, and financial services should treat this posting wave as an early-warning indicator. The detection rules, hunt queries, and hardening steps below are built to catch the pre-encryption phase of an intrusion consistent with N0N's observed playbook — before any detonation occurs.

Sourcing & Verification

• Corroboration status: Of the 42 listings in the current window, 23 were independently observed by a second leak-site crawler (tagged MULTI-SOURCE) and 19 appear on a single source only. Multi-source corroboration confirms only that the gang published the claim — it does not confirm any breach occurred.
• Inclusion in this briefing reflects the threat actor's claim and is NOT confirmation of a breach. No tier in our data — including multi-source observation — verifies that any named organization was compromised. Only the organization itself or its regulator can confirm an incident.
• Named organizations may dispute a listing, and a denial is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction and sector, and not every incident is reportable. Neither silence nor denial settles the question; we present these listings strictly as unverified criminal claims.
• Corrections: Security Arsenal will publish corrections as facts develop and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Publicly documented intelligence on N0N remains limited, and we flag clearly where the following is assessed versus confirmed:

• Aliases / tracking: The group is tracked publicly as N0N. No widely accepted alternate aliases have been established in open reporting as of this publication date.
• Operating model: Assessed as a closed or semi-private operation rather than a fully open RaaS program, based on the curated, sector-clustered nature of its leak-site postings. The tight maritime/logistics clustering in this batch suggests deliberate victim selection rather than affiliate-driven opportunism.
• Extortion model: Double extortion — the leak site is used to pressure listed organizations with the threat of data publication, indicating data theft is claimed alongside encryption. Ransom demand sizes are not publicly verifiable for this group; defenders should not rely on rumored figures for planning.
• Initial access (assessed): Consistent with the broader ransomware ecosystem, N0N's suspected entry vectors include exploitation of internet-facing remote access services (VPN gateways, firewalls, RDP), phishing with malicious attachments, and abuse of exposed virtualization/management infrastructure. The group is not currently attributed to a proprietary initial-access capability.
• Dwell time: Not publicly documented with confidence for N0N specifically. Across comparable double-extortion crews, observed dwell time from initial access to detonation commonly ranges from days to roughly two weeks — long enough for staging and exfiltration to be detectable if telemetry is in place. That detection window is the core assumption behind the rules in this briefing.
• Targeting behavior: The 2026-10-12/13 batch strongly suggests campaign-style sector waves — nine maritime/port/shipbuilding entities listed in a single day across six countries — rather than a steady trickle of unrelated victims.

Current Campaign Analysis

Sectors targeted (per leak-site postings)

Geographic concentration

BR, US, ID, TR, SG, KR, CN, JP. The concentration of Brazilian (Santos Brasil, Portonave) and Asia-Pacific (KR, SG, JP, CN, ID, TR) maritime entities is striking and covers multiple nodes of global container and bulk shipping routes.

Victim profile

Claimed victims skew toward mid-to-large enterprises and critical-infrastructure-adjacent operators — major container terminals, national port operators, international shipping lines, and heavy industrial manufacturers — alongside smaller professional-services and retail entities (e.g., a neurology practice, a specialty retailer). This mix is typical of double-extortion crews that combine high-value pressure targets with lower-maturity organizations more likely to pay quickly.

Posting frequency / escalation

The two-day burst (15 listings across 2026-10-12 and 2026-10-13, including the entire maritime cluster on a single day) indicates either a batch-dump of previously compromised environments or a coordinated campaign wave. Batch-dumps typically mean intrusions occurred weeks earlier — meaning organizations in the targeted sectors may already have undetected staging activity in their environments right now.

CVE exposure — hypothesis only

We have no evidence linking any specific CVE to any specific listing above. However, the following CISA KEV entries with confirmed ransomware use represent the class of internet-facing exposure that crews like N0N are known to exploit, and map directly onto the infrastructure typical of the targeted sectors:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1). Perimeter VPN gateways are the canonical ransomware entry point; port operators and logistics firms with 24/7 remote vendor access are heavily exposed.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password. Firewall management plane compromise enables full network pivot.
• CVE-2026-59310 — VMware vCenter path traversal. Virtualization layer access enables mass encryption of VM estates — the highest-impact detonation scenario.
• CVE-2026-63077 — JetBrains TeamCity deserialization. CI/CD compromise provides both initial access and a supply-chain pivot into build infrastructure.
• CVE-2026-48027 — Nx Console embedded malicious code. Developer-workstation supply chain exposure.

Treat these as sector-level exposure to validate and patch — not as confirmed intrusion vectors for any named organization.

Detection Engineering

The following rules target the observable pre-detonation phase: remote-access brute forcing, lateral movement via PsExec/WMI/service creation, and data staging plus shadow-copy destruction that precedes encryption.

---
title: RDP Brute Force Burst - Potential Ransomware Initial Access
id: 8f3a1c2e-n0n1-4a1b-9c2d-rdpbf00001
status: experimental
description: Detects bursts of failed RDP logons from a single source indicative of brute force against exposed remote access, a common ransomware initial access vector
author: Security Arsenal Threat Intelligence
date: 2026/10/14
logsource:
    product: windows
    service: security
    category: null
detection:
    selection:
        EventID: 4625
        LogonType: 10
    timeframe: 10m
    condition: selection | count(IpAddress) by TargetUserName > 15
falsepositives:
    - Misconfigured RDP clients retrying expired credentials
    - Vulnerability scanners
level: high
tags:
    - attack.initial_access
    - attack.t1110
    - attack.t1021.001
---
title: Suspicious Service Creation - PsExec and Lateral Movement Indicators
id: 8f3a1c2e-n0n1-4a1b-9c2d-psexec0002
status: experimental
description: Detects remote service installation patterns associated with PsExec-style lateral movement and ransomware deployment across hosts
author: Security Arsenal Threat Intelligence
date: 2026/10/14
logsource:
    product: windows
    service: system
    category: null
detection:
    selection_event:
        EventID: 7045
    selection_suspicious:
        ServiceName|contains:
            - 'PSEXESVC'
            - 'PAExec'
            - 'csexec'
            - 'remcom'
        ServiceFileName|contains:
            - '\\ADMIN$\\'
            - '\\C$\\Windows\\Temp\\'
            - 'Users\\Public\\'
    condition: selection_event and 1 of selection_suspicious*
falsepositives:
    - Legitimate administrative use of PsExec by IT — baseline and whitelist approved admin hosts
level: high
tags:
    - attack.lateral_movement
    - attack.t1569.002
    - attack.t1021.002
---
title: Pre-Ransomware Staging - Shadow Copy Deletion and Archive Compression
id: 8f3a1c2e-n0n1-4a1b-9c2d-staging003
status: experimental
description: Detects Volume Shadow Copy deletion and mass archive creation typical of ransomware data staging immediately before exfiltration and encryption
author: Security Arsenal Threat Intelligence
date: 2026/10/14
logsource:
    category: process_creation
    product: windows
detection:
    selection_vss:
        Image|endswith:
            - '\\vssadmin.exe'
            - '\\wmic.exe'
            - '\\bcdedit.exe'
            - '\\wbadmin.exe'
        CommandLine|contains:
            - 'delete shadows'
            - 'shadowcopy delete'
            - 'recoveryenabled no'
            - 'delete catalog'
    selection_archive:
        Image|endswith:
            - '\\7z.exe'
            - '\\rar.exe'
            - '\\winrar.exe'
            - '\\rclone.exe'
        CommandLine|contains:
            - ' a '
            - 'copy'
            - 'sync'
    condition: 1 of selection_*
falsepositives:
    - Legitimate backup maintenance scripts — correlate with backup windows
    - Administrators using 7-Zip for routine packaging
level: critical
tags:
    - attack.impact
    - attack.t1490
    - attack.exfiltration
    - attack.t1560

The following Microsoft Sentinel hunt query surfaces the combination of new remote service installs, suspicious compression/exfil tooling, and shadow-copy tampering on the same host within a 24-hour window — the signature of an intrusion transitioning from lateral movement to detonation.

// Hunt: Pre-ransomware staging chain - lateral movement + staging on same host
let lookback = 14d;
let svcInstalls = SecurityEvent
    | where TimeGenerated > ago(lookback)
    | where EventID == 7045
    | where ServiceName has_any ("PSEXESVC","PAExec","remcom")
       or ServiceFileName has_any ("ADMIN$","Temp","Public")
    | project svcTime=TimeGenerated, Computer, Account, ServiceName, ServiceFileName;
let staging = DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where (ProcessCommandLine has_any ("delete shadows","shadowcopy delete","recoveryenabled no","delete catalog"))
       or (FileName in~ ("7z.exe","rar.exe","rclone.exe") and ProcessCommandLine has_any (" a ","copy","sync","--password"))
    | project stageTime=TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessAccountName;
svcInstalls
| join kind=inner (staging) on $left.Computer == $right.DeviceName
| where abs(datetime_diff('minute', stageTime, svcTime)) <= 1440
| summarize FirstSeen=min(svcTime), LastActivity=max(stageTime), Actions=make_set(strcat(FileName, ': ', ProcessCommandLine), 20)
    by Computer, Account, ServiceName
| extend Severity = iff(array_length(Actions) > 3, "Critical", "High")
| order by LastActivity desc;

The script below is a rapid triage tool for hosts in at-risk segments: it enumerates scheduled tasks created in the last 7 days (a common persistence mechanism), checks RDP exposure and NLA posture, and verifies Volume Shadow Copy integrity — three checks that together reveal the most common pre-detonation artifacts.

# Security Arsenal - Rapid Ransomware Pre-Detonation Triage
# Run elevated on suspected hosts. Outputs findings to console + CSV.
$out = @()

# 1. Scheduled tasks created in the last 7 days (persistence check)
Write-Host "[+] Scheduled tasks created in last 7 days:" -ForegroundColor Cyan
$tasks = Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        TaskName   = $_.TaskName
        TaskPath   = $_.TaskPath
        Author     = $_.Author
        Action     = ($_.Actions | ForEach-Object { "$($_.Execute) $($_.Arguments)" }) -join '; '
        State      = $_.State
    }
} | Where-Object { $_.TaskPath -notlike '\Microsoft*' }
$tasks | Format-Table -AutoSize
$out += $tasks

# 2. RDP exposure check
Write-Host "`n[+] RDP configuration:" -ForegroundColor Cyan
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections
$nla = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').UserAuthentication
$rdpListening = Test-NetConnection -ComputerName localhost -Port 3389 -WarningAction SilentlyContinue
[PSCustomObject]@{
    RdpEnabled   = ($rdpEnabled -eq 0)
    NlaEnforced  = ($nla -eq 1)
    Port3389Open = $rdpListening.TcpTestSucceeded
    Risk         = if (($rdpEnabled -eq 0) -and ($nla -ne 1)) { 'HIGH - RDP open without NLA' } else { 'Review' }
} | Format-List

# 3. Volume Shadow Copy integrity
Write-Host "`n[+] Volume Shadow Copies:" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) {
    Write-Host '    WARNING: No shadow copies found - possible vssadmin deletion (anti-recovery behavior)' -ForegroundColor Red
} else {
    $shadows | Select-Object DeviceObject, InstallDate, VolumeName | Format-Table -AutoSize
}

# 4. Recent suspicious binaries in writable dirs
Write-Host "`n[+] Executables modified in last 7 days in Temp/Public/ProgramData:" -ForegroundColor Cyan
$susPaths = @($env:TEMP, 'C:\Users\Public', 'C:\ProgramData')
foreach ($p in $susPaths) {
    Get-ChildItem $p -Recurse -Include *.exe,*.dll,*.ps1,*.bat -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } |
        Select-Object FullName, LastWriteTime, Length
}

$out | Export-Csv -Path ".\triage_$(hostname)_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
Write-Host "`n[+] Triage complete. Results exported to CSV." -ForegroundColor Green

Incident Response Priorities

T-minus detection checklist (before encryption fires)

• Burst of Event ID 4625 (LogonType 10) failures followed by a single success — RDP brute force payoff
• New services installed remotely (7045) with binaries in ADMIN$, Temp, or Public paths
• WMI/PsExec process spawning on multiple hosts from a single source within minutes
• 7z/rar/rclone execution on servers holding file shares or databases, especially with password-protect or cloud-sync flags
• vssadmin / bcdedit / wbadmin commands deleting backups — this is the 10-minutes-to-detonation signal; treat as a drop-everything alert
• Unusual SMB admin-share enumeration of multiple hosts in sequence
• New scheduled tasks or run keys outside change windows

Assets this playbook historically prioritizes for exfiltration

• File servers and departmental shares (contracts, HR, finance)
• Backup infrastructure credentials and catalogs (destruction before encryption)
• Email archives of executive and legal accounts (leverage material)
• For maritime/logistics specifically: cargo manifests, customs documentation, vessel scheduling and operational technology-adjacent file stores — data whose publication creates outsized commercial and regulatory pressure
• Virtualization management planes (vCenter) — control of these turns one intrusion into estate-wide encryption

Containment actions, ordered by urgency

1. Isolate, don't power off — network-isolate hosts showing staging indicators; preserve volatile memory for forensics
2. Disable suspected compromised accounts and force credential resets for any account seen in lateral-movement telemetry; revoke active sessions/tokens
3. Block outbound exfil paths at the perimeter (rclone/cloud-storage endpoints, uncommon ports) — even mid-intrusion this can starve the double-extortion leverage
4. Protect backup infrastructure immediately — verify offline/immutable copies, rotate backup service credentials, and physically isolate backup networks
5. Disable RDP externally at the edge and audit all VPN/firewall appliance logs against the KEV-listed exposure above
6. Engage incident response before any negotiation consideration; document timeline from first staging indicator

Hardening Recommendations

Immediate (24 hours)

• Patch the perimeter: Verify patch status for CVE-2026-50751 (Check Point IKEv1 auth bypass) and CVE-2026-20316 (Cisco FMC hard-coded password) on all internet-facing gateways and management planes
• Patch vCenter against CVE-2026-59310 (path traversal) — virtualization-layer compromise is the mass-encryption scenario
• Enforce MFA on all remote access (VPN, RDP gateway, OWA). N0N's suspected access methods collapse if MFA is universal
• Close internet-facing RDP entirely; if operationally impossible, restrict by IP allowlist and enforce NLA
• Deploy the Sigma rules above and enable the staging-chain KQL hunt across server estates — especially file servers, backup servers, and domain controllers
• Alert on any shadow-copy deletion command as Critical severity, paging the on-call responder
• Maritime/port operators: audit vendor and terminal-access remote connections (pilot services, stevedoring partners, OT maintenance vendors) — third-party remote access is a recurring entry point in this sector

Short-term (2 weeks)

• Segment backup infrastructure onto isolated networks with immutable/offline copies and separate credential stores; test restoration now, not during an incident
• Tiered administration: eliminate standing Domain Admin usage on member servers; deploy just-in-time privileged access
• Egress filtering and DLP: block unsanctioned cloud-sync tools (rclone, MEGA, etc.) and alert on bulk outbound transfers from servers
• Restrict PsExec/WMI/smbexec-style tooling via AppLocker/WDAC to approved admin workstations only, and alert on any execution elsewhere
• Patch CI/CD and developer tooling (TeamCity — CVE-2026-63077; Nx Console — CVE-2026-48027) and isolate build infrastructure from production trusts
• Deception layer: deploy canary file shares and honey credentials on high-value servers — ransomware staging almost always trips them during enumeration
• For organizations named on leak sites or in targeted sectors: proactively review logging retention (90+ days minimum) on VPN, firewall, and EDR telemetry so a retro-hunt is possible

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub