Classification: TLP:CLEAR | Publication Date: 2026-10-13 | Source: ransomware.live leak-site monitoring | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang Claims 50 Victims in Coordinated Maritime & Logistics Leak-Site Campaign — Sector Analysis & Detection Rules

Executive Summary

On 2026-10-12, the ransomware group tracked as N0N published a wave of victim listings to its dark web leak site, with 50 postings observed across the group's last 100 entries. The sample of 15 listings pulled for this briefing shows an extraordinary concentration in maritime, port operations, container shipping, and logistics — including port agencies, terminal operators, dry bulk carriers, container lines, 3PL providers, and a port machinery manufacturer.

Every claim in this dataset was independently observed by a second leak-site crawler, meaning we can state with confidence that N0N published these claims. None of this data confirms that any breach occurred. Only the named organizations or their regulators can confirm that.

The geographic spread — Indonesia, Brazil, Türkiye, Singapore, South Korea, China, Japan, Hong Kong, Taiwan, Netherlands, Germany — maps almost exactly onto the global container shipping network. Whether this represents a genuine mass-compromise campaign, purchased access from an initial access broker (IAB), or a claim-inflation strategy is unknown. What is certain: security teams at maritime, port, logistics, and shipbuilding organizations should treat this as a priority hunt trigger, because if even a fraction of the claims are accurate, the sector is facing a coordinated intrusion wave.

Sourcing & Verification

• 50 of 50 listings in this dataset were independently observed by a second leak-site crawler (MULTI-SOURCE tier). 0 appear on a single source only. This corroborates that the gang published the claims.
• Inclusion on a criminal leak site reflects the threat actor's accusation, not a confirmed breach. No corroboration tier in our monitoring confirms compromise.
• A named organization may dispute its listing, and a denial is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction and not every incident is reportable — neither silence nor denial settles the question.
• Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Note: N0N is a relatively low-documentation actor in open reporting. The profile below reflects our current assessment and is subject to revision as telemetry matures.

• Aliases: None confirmed at time of writing. The group's branding is minimalist, which is consistent with either a rebranded legacy crew or a newer operation deliberately avoiding attribution overlap.
• Operating model: Assessed as a closed or semi-closed group rather than an open RaaS affiliate program, based on the tightly coordinated, sector-focused posting pattern. The maritime concentration across a single publication day suggests centralized campaign management rather than opportunistic affiliate submissions.
• Ransom demands: Not publicly documented for this actor. Based on the victim profile (large port operators, global carriers, logistics multinationals), demands consistent with comparable crews would be expected in the high six to eight figures USD, with negotiation handled over the leak site's contact channel.
• Initial access (assessed): Consistent with sector norms — exploitation of internet-facing edge devices (VPN concentrators, firewalls), phishing with macro-enabled documents against administrative staff, and purchased access from IABs. The simultaneity of the postings raises the possibility of a single upstream access source (e.g., a shared managed service provider, a widely deployed product in the port/logistics stack, or a bulk IAB sale).
• Extortion model: Double extortion — data theft followed by leak-site publication pressure. The publication-first pattern observed here (names listed en masse) is itself a pressure tactic designed to maximize reputational leverage before encryption is even discussed.
• Dwell time: Unknown for N0N specifically. Comparable maritime-sector intrusions have shown dwell times of days to several weeks between access and detonation or publication, which means hunting now can still catch pre-encryption activity.

Current Campaign Analysis

Sector Targeting

From the 15 listings in this pull, the breakdown is overwhelmingly maritime:

• Transportation (13): port agencies (GlobalNet LCL), port operators (Santos Brasil, HPC Hamburg Port Consulting, BNCT Busan New Container Terminal, MGNP), container terminals (Asyaport, Portonave), container lines (Ocean Network Express, CULines, T.S. Lines), dry bulk (Polaris Shipping), shipping networks (Premier Alliance), and 3PL logistics (Yusen Logistics Hong Kong).
• Manufacturing (2): ZPMC (port machinery/terminal engineering) and Tsuneishi / Kambara Kisen (shipbuilding/ship management).

The full 50-listing dataset also touches Technology, Professional Services, and Healthcare, but the maritime gravity of this campaign is unmistakable. ZPMC is a particularly notable claim: as the dominant global supplier of ship-to-shore cranes, a supplier-side compromise claim carries supply-chain implications for every terminal that runs its equipment — though again, this is an unverified accusation.

Geographic Concentration

Asia-Pacific dominates (ID, SG, KR, CN, JP, HK, TW), with Brazil, Türkiye, Netherlands, and Germany completing a map that mirrors major container trade lanes. This is not random — it looks like deliberate targeting of the shipping ecosystem rather than spray-and-pray opportunism.

Victim Profile

The named organizations skew toward mid-to-large enterprises: global carriers, national port operators, and multinational logistics providers, with estimated revenues typically in the $100M to multi-billion USD range. These are organizations with deep OT/ICS adjacency, complex global IT estates, and significant regulatory exposure — high-pressure extortion targets.

Posting Frequency & Escalation

50 listings in a single publication window (2026-10-12) is an unusually dense burst. Two interpretations:

1. Genuine mass compromise — one access vector exploited at scale across the sector (shared vendor, shared MSP, or bulk edge-device exploitation).
2. Claim inflation — stockpiled or embellished listings dumped for maximum media impact, a known tactic when groups seek rapid notoriety.

Defenders cannot afford to assume #2.

CVE Nexus (Sector-Level Exposure Hypothesis)

We have no evidence linking any specific CVE to any specific named organization. However, the following CISA KEV entries with confirmed ransomware use represent exactly the exposure classes a sector-wide campaign like this would exploit, and maritime/logistics organizations running these products should treat patching as urgent:

• CVE-2026-59310 — VMware vCenter path traversal (KEV 2026-08-18). vCenter compromise is a classic ransomware fast-path to hypervisor-wide encryption.
• CVE-2026-63077 — JetBrains TeamCity deserialization (KEV 2026-08-05). Build-server compromise enables supply-chain pivoting — relevant given the ZPMC listing.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password (KEV 2026-07-29). Firewall management plane takeover as an entry point.
• CVE-2026-50751 — Check Point Security Gateway improper authentication in IKEv1 (KEV 2026-06-08). Perimeter VPN exploitation — a top initial access vector for this threat class.
• CVE-2026-48027 — Nx Console embedded malicious code (KEV 2026-05-27). Developer toolchain supply-chain vector.

If N0N's campaign is built on a single upstream vector, an edge device CVE from this list is the most probable hypothesis — but it remains a hypothesis.

Detection Engineering

The following detections target the TTPs this class of actor uses in the pre-encryption window: edge-device exploitation follow-on activity, credential theft, lateral movement via PsExec/WMI, and data staging before exfiltration. Deploy in detect mode first, tune to your environment, then alert.

---
title: Suspicious Process Spawned from VPN/Firewall Management Hosts (Post-Edge-Exploit)
id: 9f1a2c4e-7b3d-4e5f-a6c7-n0n000000001
status: experimental
description: Detects shell or script interpreter execution originating from network edge management interfaces (VPN concentrators, firewall management planes) consistent with post-exploitation of CVE-2026-50751 / CVE-2026-20316 class vulnerabilities. Relevant to N0N-style edge-device initial access.
author: Security Arsenal Threat Intelligence
date: 2026/10/13
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\vpn'
      - '\fwsm'
      - '\cpmsi'
      - '\tomcat'
    ParentCommandLine|contains:
      - 'vpn'
      - 'firewall'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate management-plane automation; baseline and whitelist known admin tooling
level: high
tags:
  - attack.initial_access
  - attack.t1190
---
title: PsExec or WMI Remote Service Creation Followed by Mass File Renaming (Pre-Ransomware Staging)
id: 9f1a2c4e-7b3d-4e5f-a6c7-n0n000000002
status: experimental
description: Correlates remote execution tooling (PsExec-style service creation, WMI process spawn) with subsequent mass file modification on the target — the lateral-movement-to-encryption chain used by double-extortion crews including N0N-class actors.
author: Security Arsenal Threat Intelligence
date: 2026/10/13
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_lateral:
    Image|endswith:
      - '\psexec.exe'
      - '\psexesvc.exe'
      - '\wmic.exe'
    CommandLine|contains:
      - '\\ADMIN$'
      - '/node:'
      - 'process call create'
  selection_ransom_prep:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin Delete Shadows'
      - 'bcdedit'
      - 'wbadmin delete catalog'
      - 'recoveryenabled no'
  condition: 1 of selection_*
timeframe: 30m
falsepositives:
  - Admin PsExec usage for software deployment; backup maintenance windows
level: critical
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1047
  - attack.impact
  - attack.t1490
---
title: Bulk Archive Creation Followed by Outbound Transfer Tool Execution (Double-Extortion Staging)
id: 9f1a2c4e-7b3d-4e5f-a6c7-n0n000000003
status: experimental
description: Detects compression tools (rar, 7z) staging data into archives followed by execution of known exfiltration utilities (rclone, FileZilla CLI, curl to mega/s3 endpoints) — the data-theft phase of double-extortion operations like N0N's.
author: Security Arsenal Threat Intelligence
date: 2026/10/13
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_archive:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - ' -hp'
      - ' -p'
  selection_exfil:
    Image|endswith:
      - '\rclone.exe'
      - '\filezilla.exe'
      - '\curl.exe'
      - '\megacmd.exe'
      - '\pscp.exe'
      - '\winscp.com'
  condition: 1 of selection_*
falsepositives:
  - IT backup/compression workflows; legitimate cloud sync tooling — whitelist known backup accounts and service principals
level: high
tags:
  - attack.collection
  - attack.t1560
  - attack.exfiltration
  - attack.t1567

// N0N-class pre-ransomware hunt: lateral movement + staging chain
// Microsoft Sentinel / Defender XDR — run over last 14 days, prioritize hits on servers and hypervisor management hosts
let Lookback = 14d;
let LateralTools = dynamic(["psexec.exe","psexesvc.exe","wmic.exe","rclone.exe","7z.exe","rar.exe","winscp.com"]);
let SuspiciousProcs = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where FileName in~ (LateralTools)
   or ProcessCommandLine has_any ("vssadmin delete shadows","wbadmin delete catalog","bcdedit","recoveryenabled no","\\ADMIN$")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessAccountName, RemoteIP, ReportId;
// Correlate with recent remote logons to surface the full intrusion chain
let RemoteLogons = DeviceLogonEvents
| where TimeGenerated > ago(Lookback)
| where LogonType in ("RemoteInteractive","Network")
| where isnotempty(RemoteIP)
| where not(RemoteIP startswith "10." or RemoteIP startswith "192.168.")  // tune: flag unusual sources instead if fully RFC1918 environment
| project LogonTime=TimeGenerated, DeviceName, AccountName, LogonType, RemoteIP;
SuspiciousProcs
| join kind=leftouter RemoteLogons on DeviceName, AccountName
| where LogonTime < TimeGenerated and datetime_diff('minute', TimeGenerated, LogonTime) < 240
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Commands=make_set(ProcessCommandLine, 20), Tools=make_set(FileName, 10), SourceIPs=make_set(RemoteIP, 10) by DeviceName, AccountName
| order by FirstSeen asc;

<#
.SYNOPSIS
  N0N rapid-response triage: pre-ransomware indicator sweep (run elevated on suspect hosts or via remote session).
  Checks: exposed RDP, scheduled tasks created in last 7 days, shadow copy tampering, suspicious services, recent archive/exfil tooling.
#>
$Report = @()

# 1) Is RDP exposed and who is allowed?
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue).fDenyTSConnections
$Report += [pscustomobject]@{Check='RDP_Enabled'; Finding = $(if($rdpEnabled -eq 0){'RDP ENABLED - verify not internet-facing (netstat / firewall review)'}else{'RDP disabled'})}

# 2) Scheduled tasks created or modified in last 7 days (persistence)
Get-ScheduledTask | ForEach-Object {
  $t = $_
  try { $info = $_ | Get-ScheduledTaskInfo } catch { return }
  $xml = Export-ScheduledTask -TaskName $t.TaskName -TaskPath $t.TaskPath -ErrorAction SilentlyContinue
  if ($xml -match '<Date>(.*?)</Date>') {
    $created = [datetime]$Matches[1]
    if ($created -gt (Get-Date).AddDays(-7)) {
      $Report += [pscustomobject]@{Check='NewScheduledTask_7d'; Finding="$($t.TaskPath)$($t.TaskName) created $created by $($t.Principal.UserId)"}
    }
  }
}

# 3) Volume Shadow Copies — ransomware deletes these before encryption
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
$Report += [pscustomobject]@{Check='ShadowCopies'; Finding = $(if($shadows){"OK: $($shadows.Count) shadow copies present (newest: $(($shadows|Sort-Object InstallDate -Descending|Select-Object -First 1).InstallDate))"}else{'ALERT: NO shadow copies found - possible vssadmin deletion (T1490)'})}

# 4) Recently created services (PsExec-style lateral movement leaves 7045 events / random-name services)
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
  ForEach-Object { $Report += [pscustomobject]@{Check='NewService_7045_7d'; Finding=($_.Message -split "`n")[0..1] -join ' | '} }

# 5) Exfil tooling presence on the host
$tools = 'rclone.exe','megacmd.exe','7z.exe','rar.exe','winscp.com','filezilla.exe'
foreach ($tool in $tools) {
  $hits = Get-ChildItem -Path 'C:\' -Filter $tool -Recurse -ErrorAction SilentlyContinue -Depth 4 | Select-Object -First 3
  foreach ($h in $hits) { $Report += [pscustomobject]@{Check='ExfilToolPresent'; Finding="$($h.FullName) (LastWrite: $($h.LastWriteTime))"} }
}

$Report | Format-Table -AutoSize -Wrap
$Report | Export-Csv -Path ".\n0n_triage_$($env:COMPUTERNAME)_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation

Incident Response Priorities

T-Minus Detection Checklist — Before Encryption Fires

If you operate in maritime, ports, shipping, or logistics and want to know whether N0N's claim could apply to your environment, hunt for this sequence in order:

1. Edge device anomalies — new local admin accounts on VPN/firewall appliances, management-plane logins at odd hours, config exports (consistent with CVE-2026-50751 / CVE-2026-20316 exploitation).
2. Credential access — LSASS access by non-system processes, NTDS.dit staging, sekurlsa-style module loads.
3. Discovery burst — net group "domain admins", nltest, AD enumeration (SharpHound/ADFind output files).
4. Lateral movement — PsExec service events (7045), WMI process creation, RDP logons between servers that never talk to each other.
5. Staging — large .rar/.7z archives in temp or user profile paths, rclone config files, outbound transfers to Mega/S3/anon-file hosts.
6. Defense evasion — security tool tampering, vssadmin delete shadows, bcdedit ... recoveryenabled no.

Step 5 is your last reliable interdiction point before detonation.

Critical Assets This Playbook Prioritizes for Exfiltration

Based on the extortion model and the sector targeted, expect priority theft of:

• Contracts, bills of lading, and cargo manifests — commercially sensitive and damaging if leaked.
• HR/personnel data and customer PII — regulatory pressure multiplier.
• Email archives of executive and legal teams — negotiation leverage.
• vCenter/hypervisor credentials and snapshots — enabling fleet-wide encryption.
• OT-adjacent documentation — terminal operating system (TOS) configs, network diagrams (also elevates safety risk).

Containment Actions — Ordered by Urgency

1. Isolate affected segments at the network layer first (do not power off hosts — preserve volatile evidence).
2. Disable inbound edge access: take VPN concentrators and firewall management interfaces offline or behind allowlists.
3. Force enterprise-wide credential rotation — domain admins, service accounts, and all local admin passwords (LAPS).
4. Block known exfil destinations at the proxy/egress firewall; sinkhole rclone/mega/s3 endpoints not in business use.
5. Snapshot and preserve edge device logs before appliances roll them over — these are your ground truth for initial access.
6. Engage IR retainers and legal counsel early; do not contact the actor without coordinated guidance.

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate the KEV exposure set on internet-facing assets: CVE-2026-50751 (Check Point IKEv1), CVE-2026-20316 (Cisco Secure FMC), CVE-2026-59310 (vCenter), CVE-2026-63077 (TeamCity), CVE-2026-48027 (Nx Console). If patching is not possible in 24h, take the interface off the public internet or apply vendor mitigations.
• Audit VPN/firewall admin accounts for anything created in the last 60 days; disable unused accounts.
• Deploy the Sigma rules above in detect mode and run the KQL hunt across the last 14 days.
• Verify backup integrity and offline copies — test one restore today, not during an incident.
• Block macro-enabled Office documents from the internet (Mark-of-the-Web enforcement) — phishing remains a top entry vector for this threat class.

Short-Term (2 weeks)

• Segment OT/terminal operating systems from corporate IT with enforced one-way data flows where possible; a port operator's TOS should never be reachable from a user workstation.
• Implement phishing-resistant MFA (FIDO2) on all remote access, privileged accounts, and third-party/vendor access paths.
• Deploy LAPS and eliminate shared local admin passwords — this breaks PsExec-style lateral movement at scale.
• Stand up egress filtering with explicit allowlists for outbound cloud storage destinations.
• Vendor/MSP access review — given the mass-simultaneous posting pattern, a shared third party is a live hypothesis for the upstream vector. Audit every remote access path a vendor holds into your environment.
• Tabletop a maritime-specific ransomware scenario involving simultaneous IT encryption and operational disruption claims.

Organizations Named in N0N's Listings

N0N claims to have compromised the following organizations, as published on its leak site on 2026-10-12. These are unverified threat-actor claims, not confirmed breaches: GlobalNet LCL (ID), Santos Brasil (BR), Asyaport (TR), Ocean Network Express (SG), MGNP (KR), Portonave (BR), Polaris Shipping (KR), ZPMC (CN), Tsuneishi / Kambara Kisen (JP), Yusen Logistics Hong Kong (HK), Premier Alliance (NL), CULines (CN), BNCT Busan New Container Terminal (KR), T.S. Lines (TW), and HPC Hamburg Port Consulting (DE).

Any named organization that wishes to dispute, correct, or discuss a listing is invited to contact security@securityarsenal.com.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub