Classification: TLP:CLEAR | Publication Date: 2026-11-10 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang Claims 66 Victims in Leak-Site Campaign — Sector Targeting Analysis & Detection Rules

Executive Summary

Between 2026-11-09 and the time of collection on 2026-11-10, the ransomware group tracked as N0N listed 66 organizations on its dark web leak site. The listings are heavily concentrated in the United States, with additional claimed victims in the Netherlands, Italy, Canada, the United Kingdom, South Africa, Denmark, and Hong Kong. One sector tag — Hospitality — appears in the metadata, while the majority of listings carry no sector classification.

All 66 listings were published within a single 24-hour window, suggesting either a bulk posting event following a sustained intrusion campaign or a deliberate effort to maximize pressure through simultaneous disclosure. Security Arsenal's collection infrastructure corroborated 52 of the 66 listings via a second independent leak-site crawler; the remaining 14 appear on a single source only.

Every listing is an accusation by a criminal group, not a confirmed breach. Organizations named in this briefing have not confirmed any compromise, and no tier in this dataset confirms victimization. This briefing translates the observed claims into actionable defensive intelligence for enterprise security teams — whether or not any specific claim proves accurate, the detection content below addresses the TTPs this actor is known to employ.

Sourcing & Verification

This briefing relies on automated monitoring of N0N's .onion leak site via ransomware.live. Of the 66 listings observed:

• 52 listings were independently observed by a second leak-site crawler (tagged MULTI-SOURCE), meaning two separate collection systems saw the gang publish the claim. This corroborates that the posting exists on the actor's infrastructure.
• 14 listings appear on a single source only.

Inclusion in this briefing reflects the threat actor's claim and is NOT confirmation of a breach. No corroboration tier in this data — including MULTI-SOURCE — confirms that any organization was actually compromised. Only the named organization or its regulator can confirm a breach.

A named organization may dispute the listing, and a denial is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction, and not every incident is reportable. Neither silence nor denial settles the question.

Security Arsenal will publish corrections and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

N0N's operational tempo — 66 claimed victims posted in a single day — is consistent with a group that has been quietly accumulating access over a period of weeks and is now executing a coordinated disclosure event. This pattern mirrors campaigns by mid-tier actors who prioritize volume over headline-grabbing single targets.

Current Campaign Analysis

Sector Targeting

The sector metadata available for this campaign is sparse. Of the 66 listings, one organization is tagged under Hospitality, and the remainder carry no sector classification ("Not Found"). The hospitality tag is notable — this sector historically presents attractive targets for ransomware operators due to:

• High availability requirements (24/7 operations, booking systems, point-of-sale infrastructure)
• Large volumes of PII and payment card data
• Historically under-resourced security teams relative to enterprise organizations
• Franchise and management-company structures that create complex attack surfaces

The absence of sector tags on the majority of listings does not mean those organizations lack sector identity — it means the gang's own metadata does not classify them. Defenders across all sectors should treat this campaign as relevant.

Geographic Concentration

The heavy US concentration is consistent with the broader ransomware ecosystem's focus on US-based organizations, where perceived willingness to pay and cyber-insurance coverage create favorable extortion economics.

Victim Profile

Based on the naming conventions and the single named organization (159 Solutions, Inc.) visible in the data, N0N appears to target small-to-mid-market organizations rather than Fortune 500 enterprises. The remaining listings use anonymized designations ("Company #211," etc.), which may indicate:

• The gang has not yet published identifying details (potentially still in negotiation)
• Deliberate obfuscation to avoid early detection by victim organizations
• Lower-profile targets that do not carry recognizable brand names

Revenue estimates for organizations fitting this profile typically range from $10M to $250M annually — large enough to pay meaningful ransoms, small enough to lack mature security operations.

Posting Frequency & Escalation

All 66 listings appeared on 2026-11-09, representing an unusually dense single-day posting event. This pattern suggests one of two scenarios:

1. Bulk disclosure: The group has been sitting on access for days or weeks and is now publishing all claims simultaneously to create a shock effect.
2. Accelerated operations: The group has recently ramped up intrusion activity and is processing victims through its pipeline at high speed.

Either scenario warrants immediate defensive attention. Bulk posting events often precede either a period of dormancy (as the group negotiates) or a follow-on wave of additional claims.

CVE Exposure Hypotheses

The following CVEs from CISA's Known Exploited Vulnerabilities catalog represent sector-level exposure consistent with N0N's known initial access methods. There is no evidence linking any specific CVE to any specific named victim in this dataset. These are presented as hypotheses for defensive prioritization:

• CVE-2026-50751 (Check Point Security Gateway Improper Authentication): VPN edge-device exploitation is a common initial access vector for groups like N0N. Organizations running unpatched Check Point gateways face elevated risk.
• CVE-2026-20316 (Cisco Secure FMC Hard-coded Password): Firewall management interfaces are high-value targets for initial access and persistence.
• CVE-2026-59310 (VMware vCenter Path Traversal): Hypervisor-level access enables mass encryption of virtualized infrastructure — a hallmark of efficient ransomware operations.
• CVE-2026-63077 (JetBrains TeamCity Deserialization): CI/CD pipeline compromise enables supply-chain-adjacent lateral movement and code signing abuse.
• CVE-2026-48027 (Nx Console Embedded Malicious Code): Supply-chain vector that could provide initial access to development environments.

Organizations running any of these products should treat patching as an immediate priority regardless of whether they appear on N0N's leak site.

Detection Engineering

The following detection content targets TTPs associated with N0N's known operational playbook and broader ransomware tradecraft.

---
title: N0N Ransomware - VPN Edge Device Anomalous Authentication
id: a1b2c3d4-0001-4a5b-8c9d-000000000001
status: experimental
description: Detects anomalous authentication patterns against VPN edge devices consistent with initial access via exploited VPN appliances (e.g., Check Point CVE-2026-50751). Flags successful logins from unusual geographies or IPs with no prior history.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/11/10
modified: 2026/11/10
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1190
logsource:
  category: authentication
  product: vpn
detection:
  selection_success:
    action: success
  filter_known_ips:
    src_ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection_success and not filter_known_ips
falsepositives:
  - Legitimate remote workers traveling
  - New VPN endpoints during rollout
level: high
---
title: N0N Ransomware - PsExec and WMI Lateral Movement Execution
id: a1b2c3d4-0002-4a5b-8c9d-000000000002
status: experimental
description: Detects PsExec service installation or WMI remote process execution consistent with ransomware operator lateral movement. N0N and similar groups use these techniques to move from initial foothold to domain-wide access before encryption.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/11/10
modified: 2026/11/10
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1047
  - attack.t1569.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith: '\PSEXESVC.exe'
  selection_psexec_cmdline:
    CommandLine|contains:
      - 'psexec'
      - '-s -d'
  selection_wmi_remote:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: 1 of selection_*
falsepositives:
  - Legitimate IT administration tools
  - SCCM or other management platforms
level: critical
---
title: N0N Ransomware - Data Staging and Pre-Encryption Exfiltration
id: a1b2c3d4-0003-4a5b-8c9d-000000000003
status: experimental
description: Detects data staging behaviors commonly observed before ransomware encryption — bulk file compression to staging directories, Rclone/MEGA sync tool execution, or anomalous large-volume writes to temporary directories. N0N employs double extortion and stages data before detonation.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/11/10
modified: 2026/11/10
tags:
  - attack.collection
  - attack.t1560.001
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_archive:
    CommandLine|contains:
      - 'rar.exe a '
      - '7z.exe a '
      - '-mx9'
      - '-v500m'
      - '-hp'
  selection_exfil_tools:
    Image|endswith:
      - '\rclone.exe'
      - '\megasync.exe'
      - '\FileZilla.exe'
      - '\winscp.exe'
  selection_staging_dirs:
    CommandLine|contains:
      - 'C:\ProgramData\'
      - 'C:\Windows\Temp\'
      - 'C:\Users\Public\'
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\rclone.exe'
  condition: selection_archive or selection_exfil_tools or selection_staging_dirs
falsepositives:
  - Legitimate backup operations
  - Software deployment packaging
  - Developer build processes
level: high

// N0N Ransomware Hunt — Pre-Encryption Staging & Lateral Movement Indicators
// Microsoft Sentinel | Security Arsenal Threat Intelligence | 2026-11-10
// Hunts for the convergence of lateral movement and data staging behaviors
// within a 14-day window — typical dwell time before N0N detonation.

let Lookback = 14d;

// --- Lateral Movement Signals ---
let LateralMovement =
    SecurityEvent
    | where TimeGenerated > ago(Lookback)
    | where EventID == 4624 and LogonType in (3, 10)
    | where IpAddress !startswith "10." and IpAddress !startswith "192.168." and IpAddress !startswith "172."
    | summarize ExternalLogons = count(), SourceIPs = make_set(IpAddress), TargetAccounts = make_set(Account)
        by Computer, bin(TimeGenerated, 1h)
    | where ExternalLogons > 3;

// --- Suspicious Process Execution (PsExec / WMI / Archive Tools) ---
let SuspiciousExecution =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName in~ ("psexec.exe", "psexesvc.exe", "rclone.exe", "7z.exe", "rar.exe", "megasync.exe")
       or (InitiatingProcessFileName =~ "WmiPrvSE.exe" and FileName in~ ("cmd.exe", "powershell.exe"))
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName;

// --- Volume Shadow Copy Deletion (Pre-Encryption Indicator) ---
let ShadowCopyDeletion =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where ProcessCommandLine has_any ("vssadmin delete shadows", "vssadmin Delete Shadows",
        "wmic shadowcopy delete", "bcdedit", "recoveryenabled no")
    | project TimeGenerated, DeviceName, ProcessCommandLine, AccountName;

// --- New Scheduled Tasks (Persistence) ---
let NewPersistence =
    SecurityEvent
    | where TimeGenerated > ago(Lookback)
    | where EventID == 4698  // Scheduled task created
    | extend TaskName = tostring(parse_json(EventData).TaskName)
    | where TaskName !has_any ("Microsoft", "Windows", "OneDrive", "GoogleUpdate")
    | project TimeGenerated, Computer, TaskName, Account;

// --- Correlate: Devices with 2+ signal types ---
let DevicesWithLateral = LateralMovement | summarize by Computer;
let DevicesWithExecution = SuspiciousExecution | summarize by DeviceName;
let DevicesWithShadowDeletion = ShadowCopyDeletion | summarize by DeviceName;
let DevicesWithPersistence = NewPersistence | summarize by Computer;

union
    (DevicesWithLateral | project Device = Computer, SignalType = "External Lateral Movement"),
    (DevicesWithExecution | project Device = DeviceName, SignalType = "Suspicious Process Execution"),
    (DevicesWithShadowDeletion | project Device = DeviceName, SignalType = "Shadow Copy Deletion"),
    (DevicesWithPersistence | project Device = Computer, SignalType = "New Scheduled Task Persistence")
| summarize SignalCount = dcount(SignalType), Signals = make_set(SignalType) by Device
| where SignalCount >= 2
| sort by SignalCount desc

# N0N Ransomware Rapid-Response Audit Script
# Security Arsenal Threat Intelligence | 2026-11-10
# Run on critical servers and domain controllers to check for pre-ransomware indicators.
# Requires: Elevated privileges. Safe to run read-only; makes no changes.

Write-Output "=== N0N Rapid-Response Audit === $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') ==="`n

# 1. Check RDP exposure
Write-Output "`n--- [1] RDP Configuration ---"
$rdpEnabled = (Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue).fDenyTSConnections
if ($rdpEnabled -eq 0) { Write-Output "[!] RDP is ENABLED — verify NLA is required and restrict source IPs" }
else { Write-Output "[OK] RDP is disabled" }

$nlaSetting = (Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication
if ($nlaSetting -ne 1) { Write-Output "[!] Network Level Authentication (NLA) is NOT enforced" }
else { Write-Output "[OK] NLA is enforced" }

# 2. Scheduled tasks created in the last 7 days (exclude known-good)
Write-Output "`n--- [2] Scheduled Tasks Created in Last 7 Days ---"
$cutoff = (Get-Date).AddDays(-7)
$tasks = Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt $cutoff -and $_.TaskPath -notlike "*Microsoft*" }
if ($tasks) {
    $tasks | ForEach-Object { Write-Output "[!] Task: $($_.TaskName) | Path: $($_.TaskPath) | Created: $($_.Date)" }
} else { Write-Output "[OK] No suspicious scheduled tasks found in the last 7 days" }

# 3. Volume Shadow Copy status
Write-Output "`n--- [3] Volume Shadow Copies ---"
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($shadows) {
    Write-Output "[OK] $($shadows.Count) shadow copies exist"
    $recent = $shadows | Where-Object { $_.InstallDate -and ([Management.ManagementDateTimeConverter]::ToDateTime($_.InstallDate)) -gt (Get-Date).AddDays(-2) }
    if ($recent) { Write-Output "[i] $($recent.Count) shadow copies created in last 48 hours" }
} else {
    Write-Output "[CRITICAL] No Volume Shadow Copies found — may indicate pre-encryption deletion (vssadmin/wmic)"
}

# 4. Recently modified files in common staging directories
Write-Output "`n--- [4] Staging Directory Check (last 72 hours) ---"
$stagingDirs = @("C:\ProgramData", "C:\Windows\Temp", "C:\Users\Public")
$stagingCutoff = (Get-Date).AddHours(-72)
foreach ($dir in $stagingDirs) {
    if (Test-Path $dir) {
        $recentFiles = Get-ChildItem -Path $dir -Recurse -File -ErrorAction SilentlyContinue |
            Where-Object { $_.LastWriteTime -gt $stagingCutoff -and $_.Length -gt 50MB }
        if ($recentFiles) {
            Write-Output "[!] Large recent files in ${dir}:"
            $recentFiles | Select-Object -First 10 | ForEach-Object { Write-Output "    $($_.FullName) — $([math]::Round($_.Length/1MB,2)) MB — $($_.LastWriteTime)" }
        }
    }
}

# 5. Suspicious services (PsExec-style)
Write-Output "`n--- [5] Suspicious Services ---"
$suspiciousServices = Get-Service | Where-Object { $_.Name -match "PSEXESVC|PAExec|RemCom|csexec" }
if ($suspiciousServices) {
    $suspiciousServices | ForEach-Object { Write-Output "[!] Suspicious service: $($_.Name) — Status: $($_.Status)" }
} else { Write-Output "[OK] No known lateral-movement services detected" }

# 6. Recent logon failures (brute force indicator)
Write-Output "`n--- [6] Failed Logon Summary (last 24 hours) ---"
$failedLogons = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} -MaxEvents 100 -ErrorAction SilentlyContinue
if ($failedLogons) {
    $grouped = $failedLogons | Group-Object { $_.Properties[19].Value } | Sort-Object Count -Descending | Select-Object -First 5
    Write-Output "[i] Top source IPs with failed logons:"
    $grouped | ForEach-Object { Write-Output "    $($_.Name): $($_.Count) failures" }
    if (($failedLogons | Measure-Object).Count -gt 50) { Write-Output "[!] High volume of failed logons — possible brute-force attempt" }
} else { Write-Output "[OK] No significant failed logon activity" }

Write-Output "`n=== Audit Complete ==="
Write-Output "If any [!] or [CRITICAL] findings appear, escalate to your IR team immediately."

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

N0N's operational pattern — bulk posting after a period of quiet access — means organizations may already be in the dwell-time window. Prioritize hunting for these pre-encryption indicators:

1. Volume Shadow Copy deletion — vssadmin delete shadows /all /quiet or wmic shadowcopy delete execution
2. Boot configuration tampering — bcdedit /set {default} recoveryenabled no or bootstatuspolicy ignoreallfailures
3. Bulk archive creation — Large .rar/.7z files appearing in C:\ProgramData, C:\Windows\Temp, or C:\Users\Public
4. Rclone or cloud sync tool execution — Presence of rclone.exe, megasync.exe, or winscp.exe on servers that have no business need for them
5. PsExec service installation — PSEXESVC service appearing on multiple hosts within a short window
6. Anomalous VPN authentication — Successful VPN logins from geographies inconsistent with the user's profile, especially outside business hours
7. New local admin accounts — Account creation events (EID 4720) on servers, particularly accounts with generic names like admin1, support, svc_backup
8. Cobalt Strike beacon indicators — Outbound HTTPS connections to recently registered domains on non-standard ports, or named pipe activity consistent with default CS profiles

Critical Assets N0N Likely Prioritizes for Exfiltration

Based on the double-extortion model and the sectors observed in this campaign:

• Customer PII databases — Guest records, reservation data, loyalty program information (hospitality); employee records, client contact lists (general)
• Financial records — Accounting databases, payment processing data, banking credentials
• Email archives — Executive communications, legal correspondence, contractual documents
• Intellectual property — Proprietary systems configurations, business plans, M&A documents
• Backup infrastructure — Veeam/Commvault repositories targeted for deletion or encryption before primary systems

Containment Actions (Ordered by Urgency)

1. Immediately — Disable any suspicious accounts identified during hunting; force password resets for all privileged accounts
2. Within 1 hour — Isolate affected network segments; block outbound traffic to identified exfiltration endpoints at the firewall
3. Within 4 hours — Snapshot critical systems for forensic preservation; verify backup integrity and isolate backup infrastructure from the production network
4. Within 8 hours — Deploy EDR telemetry review across all endpoints; hunt for the persistence mechanisms listed above
5. Within 24 hours — Engage external IR support if internal capacity is insufficient; begin scoping for regulatory notification obligations

Hardening Recommendations

Immediate (24 Hours)

• Patch VPN edge devices: Apply vendor patches for CVE-2026-50751 (Check Point), CVE-2026-20316 (Cisco FMC), and any other edge-device CVEs in the KEV catalog. If patching is not immediately possible, restrict management interface access to known-good IP ranges.
• Enforce MFA on all remote access: VPN, RDP, and any web-based management portals. This is the single highest-impact control against credential-based initial access.
• Disable Office macros by default: Use Group Policy to block macro execution from internet-sourced documents. N0N's phishing tradecraft relies on macro-enabled attachments.
• Audit RDP exposure: Run the PowerShell script above. Close port 3389 to the internet entirely; require VPN access before RDP is reachable.
• Verify Volume Shadow Copies exist: Confirm VSS is enabled on all critical servers and that shadow copies have not been deleted. Enable Windows System Restore on servers where feasible.
• Block known exfiltration tools: Add rclone.exe, megasync.exe, FileZilla.exe, and winscp.exe to application control policies on servers that do not legitimately require them.

Short-Term (2 Weeks)

• Segment backup infrastructure: Move backup repositories to an isolated network segment with no trust relationship to the production domain. Implement immutable backup storage (WORM or object-lock).
• Deploy network micro-segmentation: Restrict lateral movement between server VLANs. N0N's ability to move from a single foothold to domain-wide encryption depends on flat network topology.
• Implement just-in-time (JIT) admin access: Eliminate standing Domain Admin credentials. Use privileged access workstations (PAWs) for administrative tasks.
• Enable advanced audit logging: Ensure Windows Event IDs 4624 (logon), 4625 (failed logon), 4698 (scheduled task creation), 7045 (service installation), and 4688 (process creation with command line) are collected and forwarded to a centralized SIEM.
• Patch virtualization infrastructure: Apply CVE-2026-59310 (VMware vCenter) patches. Hypervisor-level compromise enables mass encryption in minutes.
• Conduct tabletop exercise: Simulate a N0N-style double-extortion scenario with executive leadership, legal counsel, and communications teams. Pre-approved decision trees reduce response time during a real event.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub