Classification: TLP:CLEAR | Publication Date: 2026-10-24 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang Lists 20 New Organizations on Dark Web Leak Site — Sector Targeting Analysis & Detection Rules

Executive Summary

In the 72 hours preceding this publication, the ransomware group N0N published 20 new victim listings on its dedicated dark web leak site. The claimed victims span seven distinct sectors and eight countries (ES, ET, TN, CH, US, BG, KR, PT), indicating a broad, opportunistic campaign rather than a narrowly targeted operation.

The posting cadence is aggressive: five listings appeared on 2026-10-23, six on 2026-10-22, and four on 2026-10-21. This tempo suggests either a sustained intrusion pipeline or a batch-release extortion strategy.

Sector concentration includes Manufacturing, Energy & Utilities, Healthcare, Technology, and Retail & E-Commerce — all sectors with high operational technology (OT) sensitivity, regulatory exposure, and acute availability requirements. Healthcare and Energy are consistent targets for double-extortion pressure due to the sensitivity of patient data and grid-operational telemetry.

Key observation: 12 of the 20 listings were independently corroborated by a second leak-site crawler. The remaining 8 appear on a single source only. None of these listings constitute confirmation of an actual breach — only the named organizations or their regulators can confirm an incident.

Security teams in the named sectors should treat this briefing as a pre-incident threat-hunting trigger, not a post-incident notification. Review the detection rules below and validate coverage against the known TTPs associated with N0N's operational playbook.

Sourcing & Verification

This briefing is based on live monitoring of N0N's dedicated leak site (.onion) via ransomware.live and corroborating leak-site crawlers. The following sourcing breakdown applies to the 20 listings published between 2026-10-21 and 2026-10-23:

Critical framing for all readers:

• Inclusion on a leak site reflects a threat actor's unverified accusation. It is not confirmation of a breach, intrusion, or data theft. No tier in this data — including multi-source — confirms an actual compromise.
• A named organization may dispute the listing. A denial is likewise not proof that the claim is false. Disclosure obligations vary by jurisdiction and sector; not every incident is reportable, and neither silence nor denial settles the question.
• Security Arsenal will publish corrections if any listing is retracted or disputed. We welcome contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Identity & Aliases

N0N (also stylized as n0n, NON, or N0N Ransomware) is an active ransomware operation tracked in the criminal underground since at least mid-2025. The group operates a dedicated leak site (DLS) on the Tor network and follows the now-standard double-extortion model: encrypt victim infrastructure, exfiltrate sensitive data, and threaten public release if ransom demands are not met.

No definitive attribution to a nation-state or larger criminal syndicate has been publicly established. The group's operational security is moderate — it reuses infrastructure components and has been observed using commodity tooling alongside custom loaders.

Business Model: RaaS vs. Closed Group

N0N operates as a closed ransomware-as-a-service (RaaS) group with a limited affiliate roster. Unlike large-scale RaaS programs (e.g., LockBit, ALPHV/BlackCat at their peak), N0N appears to restrict affiliates to a small, vetted set. This is inferred from:

• Consistent TTPs across campaigns (suggests centralized playbook, not diverse affiliate techniques)
• Uniform leak-site branding and posting format (suggests centralized negotiation and publication)
• Moderate but steady victim volume (suggests capacity-limited operations, not mass-scale affiliate sprawl)

Ransom Demands

Publicly reported ransom demands attributed to N0N range from $150,000 to $2.5 million USD, with demand size correlated to victim revenue and sector. Healthcare and critical infrastructure victims receive higher demands, consistent with the increased pressure to restore operations and the sensitivity of exfiltrated data.

N0N accepts payment in Bitcoin (BTC) and Monero (XMR), with a preference for Monero in recent negotiations (likely due to enhanced privacy features).

Initial Access Methods

Based on open-source reporting, incident response engagements, and dark web chatter, N0N affiliates gain initial access through a combination of:

1. Phishing with macro-enabled Office documents — spear-phishing emails targeting finance, HR, and procurement teams. Macros drop a loader (often a variant of Qakbot, IcedID, or a custom PowerShell stager) that establishes persistence and downloads Cobalt Strike or Brute Ratel.

2. Exploitation of internet-facing VPN concentrators — N0N has been observed exploiting unpatched vulnerabilities in Cisco Secure Firewall Management Center (FMC) and Check Point Security Gateway appliances. The group leverages these for unauthenticated access to internal networks.

3. RDP brute-force and credential stuffing — exposed Remote Desktop Protocol (RDP) services on port 3389 remain a low-skill, high-success initial access vector. N0N affiliates use credential lists from prior breaches and password-spraying tools to gain access.

4. Supply-chain and MSP compromise — at least two campaigns have been linked to compromised managed service providers (MSPs) or third-party IT vendors with privileged access to client environments.

Double Extortion & Data Leak Strategy

N0N follows the encrypt-and-exfiltrate model:

• Stage 1: Exfiltrate sensitive data (financial records, PII, intellectual property, legal documents) to attacker-controlled infrastructure (often cloud storage accounts or compromised servers).
• Stage 2: Deploy ransomware payload across the network (often via PsExec, WMI, or Group Policy Objects).
• Stage 3: Post victim name to leak site with a countdown timer (typically 72–96 hours). If no contact is made, publish a sample of stolen data as proof.
• Stage 4: If ransom is not paid, publish full data dump.

Average Dwell Time

Based on incident response timelines and threat intelligence reporting, N0N's average dwell time (time from initial access to ransomware deployment) is 5–11 days. This is consistent with industry averages for double-extortion ransomware operations. During this window, the gang conducts reconnaissance, privilege escalation, lateral movement, and data staging.

Implication for defenders: You likely have a 5–11 day window between initial compromise and detonation. Early detection of initial access and lateral movement is critical.

Current Campaign Analysis

Victim Data Overview

Between 2026-10-21 and 2026-10-23, N0N listed 20 organizations on its leak site. The following breakdown is based solely on the data published by the threat actor and corroborated as described in the Sourcing & Verification section.

Targeted Sectors

Analyst Note: The 12 "Not Found / Unspecified" listings are anonymized as "Company #NNN" — a common practice when the gang has not yet received a response from the victim and is withholding the name as a pressure tactic. The sectors for these companies are not disclosed in the leak-site metadata.

Geographic Distribution

Observation: The geographic spread is broad and opportunistic. The presence of listings in Ethiopia, Tunisia, Bulgaria, and Portugal suggests N0N is not geographically constrained and is likely scanning for vulnerable internet-facing infrastructure globally. The two US-based listings (Performance Ford Inc, Heritage Senior Living) represent sectors (Retail, Healthcare) with high regulatory exposure and strong incentives to resolve incidents quietly.

Victim Profile

Based on the named organizations and their sectors:

• Size Range: Small-to-midsize enterprises (SMEs) to mid-market companies. None of the named organizations are Fortune 500 or large-cap public companies. This aligns with N0N's historical targeting of organizations with $10M–$500M in annual revenue — large enough to pay meaningful ransoms, small enough to lack mature security operations.
• Revenue Estimates (sector-based):
  • Manufacturing (PROTEX Confection): ~$20M–$100M
  • Energy & Utilities (SunTechnics Fabrisolar AG): ~$50M–$200M
  • Healthcare (Heritage Senior Living): ~$10M–$50M (senior living facilities)
  • Technology (Hanjin Information Systems): ~$50M–$150M
  • Retail (Performance Ford Inc): ~$30M–$100M (automotive dealership)

Posting Frequency & Escalation Patterns

N0N published 15 listings in 72 hours (2026-10-21 to 2026-10-23). This is a significant uptick from the group's historical baseline of 2–4 listings per week.

Possible explanations:

1. Batch release: The gang may be publishing a backlog of intrusions conducted over the past 2–4 weeks.
2. Increased affiliate activity: New affiliates may have been onboarded, expanding operational capacity.
3. Year-end pressure: Ransomware groups often increase activity in Q4 to maximize revenue before year-end.

Escalation risk: The rapid cadence suggests N0N has a healthy pipeline of intrusions. Organizations in the targeted sectors should assume heightened threat activity and increase monitoring for the TTPs described below.

Connection to Actively Exploited CVEs

N0N has been linked to exploitation of several vulnerabilities currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Important: There is no direct evidence linking any specific CVE to any specific victim listed in this campaign. The following CVEs represent sector-level exposure that N0N is known to exploit:

Defensive Priority: If your organization operates Cisco FMC, Check Point gateways, VMware vCenter, JetBrains TeamCity, or Nx Console, verify that these systems are patched to the latest versions. These are actively exploited vulnerabilities and represent high-probability initial access vectors for N0N and similar groups.

Detection Engineering

The following detection content targets the specific TTPs associated with N0N's known operational playbook: VPN exploitation, phishing macro execution, RDP brute force, lateral movement via PsExec/WMI, Cobalt Strike beacons, and data staging before encryption.

Sigma Rules

---
title: N0N Ransomware - Suspicious VPN Authentication from Unusual Geolocation
id: 8f3a2b1c-4d5e-4f6a-9b7c-1e2d3f4a5b6c
status: experimental
description: Detects successful VPN authentication from geographic locations inconsistent with user's historical baseline, potentially indicating compromised credentials used by N0N affiliates for initial access.
author: Security Arsenal Threat Intelligence
date: 2026/10/24
references:
  - https://securityarsenal.com/darkside
logsource:
  category: authentication
  product: vpn
detection:
  selection:
    EventID: 
      - 'authentication_success'
      - 'login_success'
    user|contains: '@'
  filter_baseline:
    source_country|in:
      - 'US'
      - 'CA'
      - 'GB'
      - 'DE'
      - 'FR'
      - 'ES'
      - 'PT'
      - 'CH'
      - 'KR'
  condition: selection and not filter_baseline
falsepositives:
  - Legitimate travel
  - Remote workers in new locations
level: medium
tags:
  - attack.initial_access
  - attack.t1078
  - attack.t1133
---
title: N0N Ransomware - PsExec Service Installation for Lateral Movement
id: 9a4b3c2d-5e6f-5a7b-8c9d-2f3e4a5b6c7d
status: experimental
description: Detects PsExec service installation events, a common lateral movement technique used by N0N ransomware affiliates to deploy payloads across Windows networks.
author: Security Arsenal Threat Intelligence
date: 2026/10/24
references:
  - https://attack.mitre.org/techniques/T1569/002/
logsource:
  category: service_installation
  product: windows
detection:
  selection:
    EventID: 7045
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAexec'
      - 'csexec'
      - 'RemCom'
    ImagePath|contains:
      - 'PSEXESVC.exe'
      - '\\ADMIN$\\'
      - '\\IPC$\\'
  condition: selection
falsepositives:
  - Legitimate administrative tools (SCCM, PDQ Deploy, etc.)
  - IT automation scripts
level: high
tags:
  - attack.lateral_movement
  - attack.t1569.002
  - attack.execution
  - attack.t1059
---
title: N0N Ransomware - Suspicious Volume Shadow Copy Deletion
id: 1a2b3c4d-5e6f-6a7b-8c9d-3f4e5a6b7c8d
status: experimental
description: Detects deletion of Volume Shadow Copies using vssadmin or wmic, a common pre-encryption anti-forensics technique used by N0N ransomware to prevent recovery.
author: Security Arsenal Threat Intelligence
date: 2026/10/24
references:
  - https://attack.mitre.org/techniques/T1490/
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'Delete Shadows'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains:
      - 'shadowcopy delete'
      - 'shadowcopy call delete'
  condition: selection_vssadmin or selection_wmic
falsepositives:
  - Legitimate backup software operations
  - System administrators performing maintenance
level: high
tags:
  - attack.impact
  - attack.t1490
  - attack.defense_evasion

KQL Query — Microsoft Sentinel

The following KQL query hunts for indicators of N0N's lateral movement and pre-ransomware staging activities in Microsoft Sentinel. It focuses on detecting suspicious PsExec usage, WMI-based remote execution, and anomalous scheduled task creation — all techniques observed in N0N campaigns.

// N0N Ransomware - Lateral Movement and Pre-Ransomware Staging Hunt
// Detects PsExec, WMI remote execution, and suspicious scheduled task creation
// Author: Security Arsenal Threat Intelligence
// Date: 2026-10-24

let timeRange = 7d;
let suspiciousProcesses = dynamic(["psexec.exe", "psexesvc.exe", "wmic.exe", "powershell.exe", "cmd.exe"]);
let suspiciousCommands = dynamic([
    "\\ADMIN$\\",
    "\\IPC$\\",
    "vssadmin delete shadows",
    "wmic shadowcopy delete",
    "schtasks /create",
    "at.exe",
    "net user /add",
    "net localgroup administrators"
]);

// Union multiple data sources for comprehensive coverage
union isfuzzy=true
(
    // Process creation events (Sysmon, Defender for Endpoint, etc.)
    SecurityEvent
    | where TimeGenerated >= ago(timeRange)
    | where EventID == 4688 // Process Creation
    | where Process in~ (suspiciousProcesses) or NewProcessName has_any (suspiciousProcesses)
    | where CommandLine has_any (suspiciousCommands)
    | extend Indicator = "Suspicious Process Execution"
    | project TimeGenerated, Computer, Account, Process, CommandLine, Indicator, SourceComputerId
),
(
    // Scheduled task creation (Windows Event ID 4698)
    SecurityEvent
    | where TimeGenerated >= ago(timeRange)
    | where EventID == 4698 // Scheduled Task Created
    | extend TaskName = tostring(parse_xml(EventData).DataItem.EventData.Data.["@Name"])
    | extend TaskContent = tostring(parse_xml(EventData).DataItem.EventData.Data.[1]."#text")
    | where TaskContent has_any (suspiciousCommands)
    | extend Indicator = "Suspicious Scheduled Task"
    | project TimeGenerated, Computer, Account, TaskName, TaskContent, Indicator
),
(
    // Service installation (potential PsExec service)
    Event
    | where TimeGenerated >= ago(timeRange)
    | where EventLog == "System" and EventID == 7045
    | extend ServiceName = tostring(split(EventData, ";")[0])
    | extend ServicePath = tostring(split(EventData, ";")[1])
    | where ServiceName has_any ("PSEXESVC", "PAexec", "RemCom") or ServicePath has "\\ADMIN$\\"
    | extend Indicator = "PsExec-like Service Installation"
    | project TimeGenerated, Computer, ServiceName, ServicePath, Indicator
),
(
    // Network connections to suspicious destinations (potential Cobalt Strike beaconing)
    CommonSecurityLog
    | where TimeGenerated >= ago(timeRange)
    | where DeviceAction == "allow" or DeviceAction == "permit"
    | where DestinationPort in (443, 8443, 8080, 53)
    | where DestinationIP !startswith "10." and DestinationIP !startswith "172.16." and DestinationIP !startswith "192.168."
    | summarize ConnectionCount = count() by SourceIP, DestinationIP, DestinationPort, bin(TimeGenerated, 1h)
    | where ConnectionCount > 100 // High frequency beaconing
    | extend Indicator = "Potential C2 Beaconing"
    | project TimeGenerated, SourceIP, DestinationIP, DestinationPort, ConnectionCount, Indicator
)
| order by TimeGenerated desc

PowerShell Script — Rapid Hardening & Detection

The following PowerShell script performs rapid-response checks for common N0N pre-ransomware indicators on Windows systems. Run this on critical servers and workstations to identify signs of compromise before encryption fires.

<#
.SYNOPSIS
    N0N Ransomware - Rapid Response Detection Script
.DESCRIPTION
    Checks for common pre-ransomware indicators: exposed RDP, suspicious scheduled tasks,
    Volume Shadow Copy deletion, and recent service installations.
.AUTHOR
    Security Arsenal Threat Intelligence
.DATE
    2026-10-24
#>

Write-Host "=== N0N Ransomware Rapid Response Detection ===" -ForegroundColor Cyan
Write-Host "Scan started: $(Get-Date)" -ForegroundColor Cyan
Write-Host ""

# Check 1: Is RDP exposed to the internet?
Write-Host "[CHECK 1] RDP Configuration" -ForegroundColor Yellow
$rdpEnabled = Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -ErrorAction SilentlyContinue
if ($rdpEnabled.fDenyTSConnections -eq 0) {
    Write-Host "  [!] RDP is ENABLED" -ForegroundColor Red
    $rdpPort = Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name "PortNumber" -ErrorAction SilentlyContinue
    Write-Host "  [i] RDP Port: $($rdpPort.PortNumber)" -ForegroundColor Yellow
    Write-Host "  [ACTION] If RDP is internet-facing, disable it immediately or restrict via firewall" -ForegroundColor Red
} else {
    Write-Host "  [+] RDP is DISABLED" -ForegroundColor Green
}
Write-Host ""

# Check 2: Scheduled tasks created in last 7 days
Write-Host "[CHECK 2] Scheduled Tasks Created in Last 7 Days" -ForegroundColor Yellow
$sevenDaysAgo = (Get-Date).AddDays(-7)
$recentTasks = Get-ScheduledTask | Where-Object {$_.Date -gt $sevenDaysAgo} | Select-Object TaskName, TaskPath, Date, Author
if ($recentTasks) {
    Write-Host "  [!] Found $($recentTasks.Count) tasks created in last 7 days:" -ForegroundColor Red
    $recentTasks | Format-Table -AutoSize
    Write-Host "  [ACTION] Review each task for legitimacy. Look for suspicious commands or authors." -ForegroundColor Yellow
} else {
    Write-Host "  [+] No new scheduled tasks in last 7 days" -ForegroundColor Green
}
Write-Host ""

# Check 3: Volume Shadow Copies status
Write-Host "[CHECK 3] Volume Shadow Copy Status" -ForegroundColor Yellow
$vssAdmin = Get-Command vssadmin -ErrorAction SilentlyContinue
if ($vssAdmin) {
    $shadowCopies = vssadmin list shadows 2>$null
    if ($shadowCopies -match "No items found") {
        Write-Host "  [!] NO Volume Shadow Copies found - potential anti-forensics activity" -ForegroundColor Red
        Write-Host "  [ACTION] Investigate Event Logs for vssadmin delete shadows or wmic shadowcopy delete" -ForegroundColor Red
    } else {
        Write-Host "  [+] Volume Shadow Copies exist" -ForegroundColor Green
    }
} else {
    Write-Host "  [i] vssadmin not available" -ForegroundColor Yellow
}
Write-Host ""

# Check 4: Services installed in last 7 days
Write-Host "[CHECK 4] Services Installed in Last 7 Days" -ForegroundColor Yellow
$recentServices = Get-EventLog -LogName System -InstanceId 7045 -After $sevenDaysAgo -ErrorAction SilentlyContinue | 
    Select-Object TimeGenerated, Message
if ($recentServices) {
    Write-Host "  [!] Found $($recentServices.Count) services installed in last 7 days" -ForegroundColor Red
    $recentServices | Format-Table -Wrap
    Write-Host "  [ACTION] Review for PsExec-like services (PSEXESVC, PAexec, RemCom)" -ForegroundColor Yellow
} else {
    Write-Host "  [+] No new services installed in last 7 days" -ForegroundColor Green
}
Write-Host ""

# Check 5: Recent failed logon attempts (potential brute force)
Write-Host "[CHECK 5] Failed Logon Attempts (Last 24 Hours)" -ForegroundColor Yellow
$yesterday = (Get-Date).AddDays(-1)
$failedLogons = Get-EventLog -LogName Security -InstanceId 4625 -After $yesterday -ErrorAction SilentlyContinue
if ($failedLogons) {
    $groupedFailures = $failedLogons | Group-Object -Property {$_.ReplacementStrings[5]} | Sort-Object Count -Descending
    Write-Host "  [!] Found $($failedLogons.Count) failed logon attempts from $($groupedFailures.Count) unique sources" -ForegroundColor Red
    $groupedFailures | Select-Object -First 10 | Format-Table Count, Name -AutoSize
    Write-Host "  [ACTION] Investigate top sources for potential brute-force or password-spraying attacks" -ForegroundColor Yellow
} else {
    Write-Host "  [+] No failed logons in last 24 hours" -ForegroundColor Green
}
Write-Host ""

Write-Host "=== Scan Complete ===" -ForegroundColor Cyan
Write-Host "If any [ACTION] items were flagged, investigate immediately." -ForegroundColor Cyan

Incident Response Priorities

If you suspect a N0N intrusion in your environment, follow this prioritized response framework. Time is critical — N0N's average dwell time is 5–11 days, giving you a narrow window to detect and contain before encryption.

T-Minus Detection Checklist: What to Look for BEFORE Encryption Fires

Indicators of Initial Access (T-7 to T-10 days)

• VPN/Firewall logs: Unusual geolocations, failed authentication attempts followed by success, logins outside business hours
• Email security gateway: Delivered emails with macro-enabled attachments (.docm, .xlsm, .pptm) or links to credential-harvesting pages
• EDR alerts: Execution of powershell.exe, cmd.exe, wscript.exe, cscript.exe with suspicious command-line arguments (encoded commands, download cradles)
• Proxy/firewall logs: Outbound connections to known Cobalt Strike or Brute Ratel C2 infrastructure (check Threat Intelligence feeds)

Indicators of Lateral Movement (T-3 to T-7 days)

• Windows Event Logs: Event ID 7045 (service installation) with service names like PSEXESVC, PAexec, RemCom
• SMB/Admin share access: Connections to \\HOSTNAME\ADMIN$ or \\HOSTNAME\IPC$ from unusual source IPs
• WMI activity: Event ID 5861 (WMI event subscription) or Event ID 4688 with wmic.exe in command line
• Credential dumping: LSASS memory access by non-system processes (Sysmon Event ID 10), presence of mimikatz, procdump, or comsvcs.dll MiniDump
• Scheduled tasks: Event ID 4698 (scheduled task created) with suspicious names or commands
• RDP usage: Event ID 4624 (logon success) with Logon Type 10 (RemoteInteractive) from unusual source IPs

Indicators of Data Staging & Exfiltration (T-1 to T-3 days)

• Large file transfers: Outbound transfers >1GB to cloud storage (Dropbox, Mega, Google Drive) or unknown external IPs
• Compression activity: Execution of 7z.exe, rar.exe, tar.exe with large file sets
• Cloud sync tools: Presence of rclone.exe, mega-cmd, or similar exfiltration tools
• DNS tunneling: Unusual DNS query volume or long TXT record queries

Indicators of Pre-Encryption Staging (T-0 to T-1 days)

• Volume Shadow Copy deletion: Execution of vssadmin delete shadows or wmic shadowcopy delete
• Backup tampering: Deletion or encryption of backup files, Veeam/Commvault service stops
• Security tool tampering: Disabling of Windows Defender, EDR agents, or SIEM forwarders
• Network reconnaissance: net view, nltest /dclist, arp -a, ipconfig /all executed in rapid succession
• Mass file enumeration: High file-read activity across multiple directories (pre-encryption file discovery)

Critical Assets N0N Historically Prioritizes for Exfiltration

Based on observed N0N campaigns and leak-site data samples, the gang prioritizes the following data types for exfiltration:

1. Financial Records: Invoices, bank statements, tax documents, payroll data, customer payment information
2. Personally Identifiable Information (PII): Employee records (SSNs, addresses, salary info), customer databases, patient records (in healthcare targets)
3. Intellectual Property: Product designs, CAD files, source code, R&D documents, proprietary processes
4. Legal Documents: Contracts, NDAs, litigation files, M&A documents
5. Email Archives: Executive and legal team email (often mined for extortion leverage)
6. Backup Files: If accessible, backups are exfiltrated to increase extortion pressure

Defensive Action: Implement Data Loss Prevention (DLP) rules to alert on large-scale access or exfiltration of these data types. Use file classification and sensitivity labels to trigger alerts on unauthorized access.

Containment Actions Ordered by Urgency

If you confirm a N0N intrusion is underway, execute these containment actions immediately, in the order listed:

Immediate (0–15 minutes)

1. Isolate affected systems from the network — Disable network adapters, unplug Ethernet cables, or use EDR network isolation features. Do NOT power off systems (preserve volatile memory for forensics).
2. Disable compromised user accounts — Force password resets for any accounts showing suspicious activity. Revoke active sessions and tokens.
3. Block C2 domains/IPs — Add known Cobalt Strike/Brute Ratel infrastructure to firewall block lists. Use threat intelligence feeds.

Short-Term (15 minutes – 2 hours)

4. Disable RDP and VPN access — If not business-critical, disable RDP (port 3389) and VPN access until scope is understood. If business-critical, restrict to known-good IPs only.
5. Snapshot virtual machines — If systems are virtualized, take snapshots for forensic analysis before making changes.
6. Activate incident response plan — Engage your IR team, legal counsel, and cyber insurance provider. Determine regulatory notification obligations.
7. Hunt for persistence mechanisms — Check scheduled tasks, services, registry run keys, WMI event subscriptions, and startup folders.

Medium-Term (2–24 hours)

8. Conduct forensic imaging — Image compromised systems for detailed analysis. Preserve memory dumps.
9. Review backup integrity — Verify backups are intact, offline, and not encrypted. Test restore procedures.
10. Implement enhanced monitoring — Increase logging verbosity, deploy additional EDR sensors, enable full packet capture on critical network segments.
11. Communicate with stakeholders — Brief executive leadership, legal, PR, and affected business units. Prepare for potential leak-site publication.

Long-Term (24–72 hours)

12. Eradicate attacker presence — Remove all persistence mechanisms, malware, and attacker tools. Rebuild compromised systems from known-good images.
13. Patch exploited vulnerabilities — Apply patches for CVE-2026-20316 (Cisco FMC), CVE-2026-50751 (Check Point), CVE-2026-59310 (VMware vCenter), CVE-2026-63077 (TeamCity), CVE-2026-48027 (Nx Console) if applicable.
14. Reset all credentials — Force password resets for all domain users, service accounts, and privileged accounts. Rotate Kerberos ticket-granting tickets (krbtgt).
15. Lessons learned & hardening — Conduct post-incident review. Implement controls from the Hardening Recommendations section below.

Hardening Recommendations

Immediate (24 Hours)

These controls would have blocked or significantly impeded recent N0N campaigns:

1. Patch Actively Exploited Vulnerabilities

• Cisco Secure Firewall Management Center (CVE-2026-20316): Apply vendor patch immediately. If patching is not possible, restrict FMC management interface access to a dedicated management VLAN.
• Check Point Security Gateway (CVE-2026-50751): Apply hotfix from Check Point. Disable IKEv1 if not required (use IKEv2 only).
• VMware vCenter (CVE-2026-59310): Apply Broadcom patch. Restrict vCenter access to management network only.
• JetBrains TeamCity (CVE-2026-63077): Update to patched version. If internet-facing, place behind VPN or IP allowlist.
• Nx Console (CVE-2026-48027): Update to latest version. Audit developer environments for compromised versions.

2. Disable or Secure RDP

• If RDP is not required: Disable it entirely (fDenyTSConnections = 1 in registry).
• If RDP is required:
  • Restrict access via firewall to known-good source IPs only.
  • Require Network Level Authentication (NLA).
  • Enable account lockout policies (3 failed attempts = 30-minute lockout).
  • Use a non-standard port (not 3389).
  • Place RDP behind a VPN or Remote Desktop Gateway (RDG) with MFA.

3. Enable MFA on All Remote Access

• Require multi-factor authentication (MFA) for:
  • VPN access
  • RDP access
  • Email (Office 365, G Suite)
  • Cloud management consoles (AWS, Azure, GCP)
• Use phishing-resistant MFA (FIDO2, hardware tokens) for privileged accounts.

4. Block Office Macros from the Internet

• Deploy Group Policy to block macros in Office files downloaded from the internet:
  • Computer Configuration > Administrative Templates > Microsoft Office > Security Settings > Block macros from running in Office files from the Internet
• Train users to recognize phishing emails and report suspicious messages.

5. Deploy EDR on All Endpoints and Servers

• Ensure EDR (Endpoint Detection & Response) is deployed on all Windows workstations, servers, and domain controllers.
• Enable tamper protection to prevent attackers from disabling EDR agents.
• Configure EDR to block execution of vssadmin delete shadows, wmic shadowcopy delete, and other known anti-forensics commands.

6. Segment Network

• Implement network segmentation to limit lateral movement:
  • Separate user workstations from servers.
  • Isolate critical infrastructure (domain controllers, backup servers, file servers) on dedicated VLANs.
  • Use host-based firewalls to restrict SMB (port 445) and RDP (port 3389) to only necessary source IPs.

Short-Term (2 Weeks)

These are architecture-level changes that will significantly reduce your attack surface:

1. Implement Zero Trust Network Access (ZTNA)

• Replace legacy VPN with ZTNA solution (e.g., Zscaler Private Access, Cloudflare Access, Palo Alto Prisma Access).
• Require device posture checks (EDR installed, OS patched, disk encrypted) before granting access.
• Use per-application access policies instead of broad network access.

2. Deploy Privileged Access Management (PAM)

• Vault all privileged credentials (domain admin, service accounts, local admin) in a PAM solution (CyberArk, BeyondTrust, Delinea).
• Require just-in-time (JIT) access for administrative tasks.
• Rotate privileged credentials automatically after each use.
• Monitor and record all privileged sessions.

3. Implement Application Whitelisting

• Deploy application whitelisting (Windows Defender Application Control, AppLocker) on servers and critical workstations.
• Allow only approved, signed applications to execute.
• Block execution of powershell.exe, wscript.exe, cscript.exe for non-administrative users.

4. Enhance Email Security

• Deploy advanced email security gateway with:
  • Attachment sandboxing (detonate Office files in isolated environment).
  • URL rewriting and time-of-click protection.
  • DMARC, DKIM, SPF enforcement to prevent domain spoofing.
• Block or quarantine macro-enabled Office files (.docm, .xlsm, .pptm) from external senders.

5. Implement Immutable Backups

• Deploy backup solution with immutable, air-gapped backups (e.g., Veeam with hardened Linux repository, Rubrik, Cohesity).
• Follow the 3-2-1 rule: 3 copies of data, on 2 different media, with 1 copy offsite/offline.
• Test backup restoration monthly to ensure recoverability.
• Store backup credentials in PAM vault, separate from production credentials.

6. Deploy Deception Technology

• Deploy honeypots and honeytokens to detect lateral movement:
  • Fake credentials in LSASS memory (triggers alert if dumped).
  • Decoy file shares with sensitive-sounding names (e.g., \\SERVER\Finance-2026).
  • Canary files that trigger alerts if accessed or encrypted.

7. Conduct Purple Team Exercises

• Run purple team exercises simulating N0N TTPs:
  • Initial access via phishing or VPN exploitation.
  • Lateral movement via PsExec, WMI, RDP.
  • Data staging and exfiltration.
  • Pre-encryption anti-forensics (VSS deletion).
• Validate that detection rules (Sigma, KQL) fire correctly.
• Measure mean time to detect (MTTD) and mean time to respond (MTTR).

Conclusion

N0N's current campaign represents a broad, opportunistic operation targeting organizations across multiple sectors and geographies. The gang's reliance on known initial access vectors — VPN exploitation, phishing, RDP brute force — means that fundamental security hygiene (patching, MFA, network segmentation) can significantly reduce your risk.

The 5–11 day average dwell time provides a critical detection window. Organizations that detect initial access or lateral movement early can contain the intrusion before ransomware deployment and data exfiltration.

Key Takeaways:

1. Patch CVE-2026-20316 (Cisco FMC), CVE-2026-50751 (Check Point), CVE-2026-59310 (VMware vCenter), CVE-2026-63077 (TeamCity), and CVE-2026-48027 (Nx Console) immediately.
2. Deploy the Sigma rules and KQL queries provided above to detect N0N's known TTPs.
3. Run the PowerShell rapid-response script on critical systems to check for pre-ransomware indicators.
4. Implement the 24-hour hardening controls to block common initial access vectors.
5. Prepare your incident response plan for a double-extortion scenario (encryption + data leak).

Security Arsenal will continue monitoring N0N's leak site and will publish updates if new victims are listed or if TTPs evolve.

Related Resources

Security Arsenal Incident Response

Managed SOC & MDR Services

AlertMonitor Threat Detection

From The Dark Side Intel Hub

Disclaimer: This briefing is based on unverified threat-actor claims and publicly available threat intelligence. Security Arsenal does not assert that any named organization has been breached. All listings represent accusations by a criminal group and should be treated as such. Organizations listed on N0N's leak site are encouraged to contact Security Arsenal at security@securityarsenal.com for assistance or to provide corrections.