Threat
Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see
First reported theregister.com
Page published · Page updated
Earliest dated coverage: 30 Oct 2026 · First observed: 30 Oct 2026 · Latest dated coverage: 30 Oct 2026
Coverage timeline
Single-source incident — one report is available.
Why it matters
The n0n campaign illustrates how AI-assisted attack development can support conventional credential-based intrusions, reinforcing the importance of securing remote access and protecting backups against deletion.
A n0n ransomware operator left its attack server exposed, revealing an AI-assisted extortion operation that attempted intrusions at 23 organizations across 14 countries. SOCRadar reported that documented compromises relied on weak or stolen credentials, with no evidence of vulnerability exploitation. Some victims suffered data theft, encryption, and deletion of data and backups.
Summary
A n0n-linked ransomware and extortion operation combined conventional credential-based access with AI-assisted development. The investigated operator attempted to enter 23 organizations across 14 countries. SOCRadar said every documented compromise relied on weak or stolen credentials and found no evidence of vulnerability exploitation in the examined cases.[0]
The investigation benefited from an exposed attacker workspace: a publicly accessible Python HTTP file server hosted in Sweden at 185.157.161.148 on port 8877. Snapshots taken on September 25 and 26 exposed 1,719 files spanning attack scripts, ransomware source code, extortion infrastructure, and an AI coding environment. The operator used OpenCode to write and debug hundreds of scripts, with more than $7,216 in AI usage costs by October 22; researchers did not find evidence of a fully autonomous attack system.[0]
The operation's recovery implications extended beyond encryption. After establishing persistence and collecting credentials, sessions, and mailbox access, the operator gathered sensitive data into central storage. Depending on the victim, subsequent actions included encryption, deletion of data and backups, and firewall changes that blocked traffic. In a case linked to Fanatics, an exposed AWS key enabled collection from 40 S3 buckets followed by destructive activity affecting sensitive buckets.[0]
The broader n0n leak site claimed 108 victims, a different measure from the 23 organizations covered by the workspace investigation. A batch of 38 maritime, port, and logistics listings carried demands of $400,000 to $28 million, but the associated payment addresses showed no transactions after the deadline. Supplier-compromise and geographic-attribution claims remain qualified: CyberLogitec had not confirmed an intrusion, and the exposed server did not establish the operator's nationality or location.[0]
Attack chain
- Initial access: The operator used RDP scanning and automated FortiGate SSL-VPN credential stuffing, alongside exposed cloud credentials and reused hosting-portal sessions. Against ChiBiTek, a 15-thread residential SOCKS5 proxy pool tested credentials against FortiGate portals through GET /remote/login. Researchers reported credential-based access rather than vulnerability exploitation.[0]
- Persistence and credential collection: Following entry, the documented lifecycle included hidden administrator accounts disguised as services and covert proxies. The operator collected credentials and session tokens and accessed mailboxes and emailed multifactor-authentication codes.[0]
- Sensitive-data collection and transfer: The operator collected sensitive information and transferred it to central storage. In the Fanatics-linked case, an exposed AWS access key with S3 listing, reading, and deletion permissions enabled retrieval from 40 buckets, with up to 110 GB per bucket.[0]
- Victim-specific impact: Impact varied between data theft, encryption, destruction, and network disruption rather than following an identical pattern at every victim. Reported actions included deleting data and backups, purging keys across 12 sensitive S3 buckets in the Fanatics-linked case, and changing firewall policies to block traffic in another case.[0]
- Extortion and pressure escalation: The operator issued ransom notes, created leak-site countdowns, and established negotiation rooms and email channels. Some cases included automated countdown warnings to service providers, clients, and media. Following the Transcom compromise, a secondary ransom alert went to PayPal's security team even though the compromised data resided on Transcom's network.[0]
- Nonpayment consequences: The reported lifecycle culminated in publication of stolen files or destruction of backups when organizations did not pay. For the 38 maritime listings, the article reported that all affected organizations' stolen data was published after the deadline.[0]
Disclosure timeline
| Date | Event |
|---|---|
| 2026-09-25 | SOCRadar documented a snapshot of the operator's publicly exposed workspace.[0] |
| 2026-09-26 | A second workspace snapshot was documented. Across the two snapshots, researchers identified 1,719 files.[0] |
| 2026-10-12 | n0n added 38 maritime, port, and logistics organizations across 18 countries to its leak site in one batch.[0] |
| 2026-10-19 | The ransom deadline set for the maritime organizations expired. Demands ranged from $400,000 to $28 million, payable in Bitcoin.[0] |
| 2026-10-22 | By this date, the operator had incurred more than $7,216 in AI usage costs.[0] |
| 2026-10-30 | The Register published its account of SOCRadar's investigation, including the exposed workspace, credential-based intrusions, AI-assisted development, and destructive activity.[0] |
Actor profile
n0n
A data-theft, ransomware, and extortion group reported to have emerged in September 2026 and to have claimed 108 victims by the article's publication. The investigated workspace was attributed to a single operator or small team, not necessarily the entirety of the group. Its activity combined scalable credential attacks, AI-assisted scripting, victim-specific destructive actions, and pressure on third parties. A Russian base was reported as a belief, but the exposed server provided no definitive geographic or national attribution; its Swedish hosting location should not be treated as the operator's location.[0]
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| ip | 185.157.161.148 | Reported attacker workspace hosted in Sweden, exposing a Python HTTP file server on TCP port 8877. SOCRadar documented directory snapshots on September 25 and 26, 2026. This is a historical infrastructure pivot; the supplied reporting does not establish its current operational status.[0] |
Key takeaways
- AI expanded the operator's scripting capacity, but the documented entry points remained conventional: weak or stolen credentials, exposed cloud keys, and reused sessions. The evidence does not support describing these intrusions as autonomous or vulnerability-driven.[0]
- Recovery planning must account for destructive activity separately from encryption. Deleted objects, destroyed backups, and firewall-policy changes can remain operational problems even if encrypted files become recoverable.[0]
- Keep observed investigative scope separate from actor claims: 23 attempted targets, 108 claimed victims, and the 38-organization maritime batch describe different populations. Leak-site payment labels were not validated by SOCRadar through on-chain transactions.[0]
- The shared-customer link involving CyberLogitec is not confirmation of a supplier intrusion, and the Swedish server location does not resolve actor attribution. Both distinctions matter when assessing campaign scope and origin.[0]
- Poor attacker operational security did not eliminate serious victim impact. The exposed workspace and possible encryption-key reuse coexisted with data theft, destructive actions, and aggressive extortion.[0]
Defensive actions
- Review historical network telemetry for connections to 185.157.161.148, particularly TCP port 8877, and investigate associated hosts and accounts.: The address and port hosted the exposed operator workspace. A match provides an investigation pivot, although the reporting does not establish that every victim communicated with this server or that it remains active.[0]
- Investigate repeated credential testing against exposed RDP and FortiGate SSL-VPN services, including FortiGate GET /remote/login activity; replace identified weak, reused, or compromised credentials.: The examined compromises depended on credentials rather than vulnerability exploitation. The ChiBiTek attack used a multithreaded residential proxy pool, making the authentication pattern and targeted accounts important alongside source addresses.[0]
- Revoke exposed AWS access keys and review S3 listing, reading, deletion, and permission scope associated with those keys.: An exposed key in the Fanatics-linked case permitted collection from 40 buckets and subsequent destructive activity. Investigation should establish both data-access scope and whether the same credential could delete sensitive objects.[0]
- Invalidate compromised hosting-portal sessions and session tokens, and investigate mailbox access and exposure of emailed multifactor-authentication codes.: The operator reused hosting-portal sessions and collected session tokens, mailbox access, and emailed authentication codes. Remediation must therefore address compromised sessions and mailbox access as well as passwords.[0]
- Hunt for unauthorized administrator accounts disguised as services and for covert proxies; remove confirmed persistence after determining its scope.: Both mechanisms appeared in the documented post-entry lifecycle and could preserve attacker access after an initial credential is replaced.[0]
- Validate backup integrity and recoverability, inventory deleted data, and review firewall-policy changes before treating decryption as sufficient recovery.: The operator sometimes deleted data and backups or blocked traffic through firewall changes. A decryption key would not by itself reverse those effects.[0]
- During ransomware recovery analysis, examine the recovered locker for the reported hardcoded-key behavior and possible key reuse, without assuming a working decryptor exists.: SOCRadar found hardcoded encryption keys and evidence suggesting reuse across victims. The supplied reporting provides neither key values nor a validated universal recovery method.[0]