n0n Ransomware Leak Shows AI Helps Extortion Gangs, but Stolen Passwords Still Open the Door

A newly exposed ransomware operation is offering businesses a lesson that cuts against the loudest fears about AI-powered hacking. Researchers at threat intelligence firm SOCRadar say an operator tied to the n0n extortion group spent more than $7,000 on AI services to build its attack tooling, yet never once needed a software vulnerability to get inside a victim. Every documented break-in came through weak or stolen credentials.

The findings, published by SOCRadar and reported on October 30 by The Register, come from an unusual source: the attacker’s own workspace, which was left open on the internet.

An Extortion Crew That Left Its Own Door Open

According to SOCRadar’s Threat Research Unit, the operator ran a publicly accessible Python file server hosted in Sweden. The researchers captured two snapshots of it on September 25 and 26, 2026, and catalogued 1,719 files, including 829 scripts and five C++ encryptor source files, along with leak-site backend code and an AI coding agent environment.

The material ties the operator to intrusion attempts against at least 23 organizations in 14 countries. SOCRadar’s list of affected sectors is broad: a US sports retailer, a cloud provider, a teachers’ union, a Venezuelan internet provider, an Argentine government ministry and a pharmaceutical subsidiary, among others.

n0n itself is a newcomer. The Register reports the group has claimed 108 victims since it emerged last month, and SOCRadar counted 93 leak-site listings carrying total ransom demands of $283.7 million as of October 19. In one batch on October 12, the gang posted 38 maritime, port and logistics organizations across 18 countries, with demands ranging from $400,000 to $28 million. None of those listings were marked as settled after the deadline passed, and SOCRadar says it has not validated any ransom payments on-chain.

AI Wrote the Scripts, Passwords Opened the Doors

The most talked-about detail is the AI spending. SOCRadar found the operator used OpenCode, an open-source AI coding agent, configured with 154 model entries across seven providers. Some were mainstream commercial models; others were “uncensored” or “abliterated” versions with safety training stripped out, plus at least one self-hosted model. Usage costs passed $7,216 by October 22.

“The operator used AI to write and debug hundreds of scripts,” SOCRadar CISO Ensar Seker told The Register, adding that it shows how AI can help an attacker turn basic access into a broader, tailored operation. Importantly, the researchers found no evidence of a fully autonomous attack system. This was a human-directed operation that used AI as a productivity tool.

The way in was decidedly old-fashioned. According to SOCRadar, n0n’s entry points included:

• Credential stuffing at scale against 305 FortiGate SSL-VPN devices, routed through a residential proxy pool to blend in with normal traffic.
• Mass Remote Desktop Protocol scanning and weak RDP and WinRM passwords.
• Exposed cloud keys, including an AWS access key that let the operator pull data from 40 storage buckets at one retailer and delete data across 12 sensitive buckets.
• Compromised hosting management portals and reused sessions.

“In every documented compromise in this investigation, access relied on weak or stolen credentials,” Seker said. “We found no evidence of vulnerability exploitation in the cases examined.”

Destruction, Not Just Encryption

What should worry business leaders most is what happened after entry. SOCRadar describes a consistent playbook: hidden administrator accounts disguised with service-like names, covert proxies, theft of session tokens and mailbox access to intercept emailed multi-factor codes, then bulk data theft to the operator’s central storage.

From there, the impact varied by target. Some victims had files encrypted. Others had data and backups deleted outright. In one case, the operator hijacked a Cisco Firepower Management Center and switched every access policy to block traffic, which the attacker claimed caused widespread service disruption. As Seker put it, that “creates a recovery problem that a decryption key alone cannot solve.”

The group also applies pressure beyond the victim itself. The Register reports n0n sends automated countdown warnings to victims’ service providers, clients and media outlets, and in one case sent a ransom alert to a payment company’s security team even though the stolen data sat on a different firm’s network.

Why It Matters for Business

The n0n case reframes the AI-and-ransomware conversation in a useful way. AI is lowering the cost of building custom tooling, which means smaller crews can run broader, more tailored campaigns. But the attack surface they are exploiting is the same one security teams have been warned about for years: reused passwords, internet-facing VPNs and remote desktop without strong multi-factor authentication, and cloud keys left lying around in code or configuration files.

That is good news in one sense. The defenses that would have stopped most of these intrusions are well understood and relatively inexpensive compared with the cost of an incident:

• Enforce phishing-resistant multi-factor authentication on every VPN, remote desktop and cloud console, and stop relying on codes sent by email.
• Monitor for bursts of failed logins followed by a success from residential IP addresses, a classic credential-stuffing signature.
• Rotate and scope down long-lived cloud access keys, and alert on mass delete activity in storage.
• Keep offline or immutable backups, because n0n shows that attackers increasingly destroy backups rather than simply encrypting files.
• Watch for new local administrator accounts with innocuous service-style names and for firewall policy changes outside approved change windows.

There is also a reminder about how attackers operate. SOCRadar noted the locker contained hardcoded encryption keys with signs of reuse across victims, and the whole operation was exposed because the operator failed at basic security hygiene. “There is a striking gap between operational ambition and security discipline,” Seker said. Criminal groups that move fast with AI tooling can be dangerous and still sloppy, and that sloppiness is what gave defenders this rare look inside.

The Bottom Line

AI is making ransomware crews more productive, but it has not changed where most of them get in. For the 23 organizations tied to this n0n operator, the front door was a password. Companies that lock down credentials, remote access and cloud keys, and that protect their backups from deletion, remove most of what this kind of AI-assisted crew needs to succeed.

Sources: SOCRadar, “n0n Ransomware: Inside an AI-Assisted Extortion Operation”; The Register, October 30, 2026.

Edited by Coron @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous