n0n ransomware operator hit 23 orgs with stolen credentials and AI tooling, then left its staging server exposed

Linha do tempo

1. theregister.com ↗ · pub. 30/10/2026 16:37 · coletado 30/10 17:00 primeiro registro

   n0n ransomware operator hit 23 orgs with stolen credentials and AI tooling, then left its staging server exposed

   ler a análise desta fonte ocultar

   SOCRadar documented the operations of n0n, a data-theft and extortion group that emerged in September 2026 and has claimed 108 victims. The operator attempted to breach 23 organizations across 14 countries and used AI coding assistance, with more than $7,216 in AI usage costs by October 22. Every documented compromise relied on weak or stolen credentials, and no vulnerability exploitation was observed. The operator left a Python HTTP file server open at 185.157.161[.]148:8877 (Sweden), exposing 1,719 files including attack scripts, ransomware source code and extortion infrastructure. On October 12, n0n listed 38 maritime, port and logistics organizations across 18 countries in a single batch, at least 21 linked to customers of CyberLogitec, which has not confirmed an intrusion.

   Technical Details

   • Initial access: widespread RDP scanning and automated FortiGate SSL-VPN credential stuffing (GET /remote/login) through a 15-thread residential SOCKS5 proxy pool, used against US MSP ChiBiTek. Also exposed cloud credentials and reused hosting portal sessions.
   • Cloud abuse: in a case linked to Fanatics, an exposed AWS access key with list/read/delete rights was used to pull data from 40 S3 buckets (up to 110 GB each). Data, including bank-transaction archives, was then deleted and keys were purged across 12 sensitive buckets.
   • AI use: the open-source agent OpenCode was configured with 154 model entries across seven providers (including Gemini, Claude, GPT-5.x, Llama, DeepSeek, Qwen), some uncensored or with safety training removed. It was used to write and debug hundreds of scripts. SOCRadar found no evidence of a fully autonomous attack system.
   • Lifecycle: persistence via hidden admin accounts disguised as services, covert proxies, credential and session-token theft, mailbox access and emailed MFA codes. Data is sent to central storage. Impact varies between theft, encryption, destruction and network disruption, and in one case firewall policies were changed to block traffic.
   • Extortion: ransom notes, leak-site countdown clocks, negotiation rooms, and automated warnings to victims' service providers, clients and media. After breaching Transcom, the group sent a secondary ransom alert to PayPal's security team.
   • Maritime batch: demands ranged from $400,000 to $28 million in Bitcoin with an October 19 deadline. None of the 38 listings were marked settled, no payment addresses showed transactions, and all stolen data was published. A few other victims are marked "honored - data destroyed", but SOCRadar has not validated any on-chain payment.
   • Operator mistakes: the locker contains hardcoded encryption keys, with evidence of reuse across victims.
   • Attribution: believed to be Russia-based, but the server gave no definitive geographic attribution. SOCRadar rates the group 10/10 for aggressiveness and 0/10 for lethality.

   Remediation

   • Enforce MFA and unique credentials on RDP and FortiGate SSL-VPN portals, and monitor for credential-stuffing patterns from residential proxies.
   • Remove exposed or long-lived AWS access keys, restrict S3 delete permissions and keep offline or immutable backups, since n0n deletes data and backups.
   • Protect mailboxes used to receive MFA codes and review for hidden admin accounts masquerading as services.