Summary
- The n0n group has claimed 108 victims since emerging last month, targeting organisations across 14 countries using stolen and weak credentials — no vulnerability exploitation was observed in any documented compromise.
- The operator spent more than $7,216 on AI services, using an open-source coding agent configured with over 150 model entries across providers including OpenAI, Google, Anthropic, Meta, and others to write and debug attack scripts.
- SOCRadar discovered the group’s entire workspace on a publicly accessible Python HTTP file server, exposing 1,719 files including attack scripts, ransomware source code, and extortion infrastructure.
- Beyond encryption and data theft, the group deleted data and backups and in at least one case altered firewall policies — creating recovery problems that a decryption key cannot fix.
- In one case linked to e-commerce platform Fanatics, the group used an exposed AWS access key to exfiltrate and then delete data across 40 S3 buckets, including bank-transaction archives.
Entry by credential, not by exploit
The n0n ransomware group has attracted attention since appearing last month, posting 108 claimed victims to its leak site and adding 38 maritime and logistics organisations across 18 countries in a single batch on 12 October. Yet for all its operational aggression, the group’s intrusion methods are thoroughly conventional. According to threat intelligence firm SOCRadar, every documented compromise in its investigation relied on weak or stolen credentials. “We found no evidence of vulnerability exploitation in the cases examined,” said Ensar Seker, SOCRadar’s CISO.
The group’s primary techniques include large-scale Remote Desktop Protocol scanning and automated credential stuffing against FortiGate SSL-VPN portals. To access US-based managed services provider ChiBiTek, the operators used a 15-thread residential SOCKS5 proxy pool to test credential combinations against FortiGate login endpoints. In a separate case linked to Fanatics, the group discovered an exposed AWS access key with list, read, and delete permissions, which it used to pull data from 40 S3 buckets — up to 110 GB per bucket — before deleting the contents of 12 sensitive buckets, including bank-transaction archives.
AI as a force multiplier, not a magic weapon
Despite the absence of any sophisticated exploitation, the group did invest meaningfully in AI-assisted development. SOCRadar found the operator had incurred more than $7,216 in AI usage costs by 22 October. The tooling centred on OpenCode, an open-source AI coding agent, configured with 154 model entries across seven providers. Models used spanned Gemini, Mistral, Llama, Claude, GPT-5.x, Grok, DeepSeek, and others — some with safety training removed or marketed as uncensored variants.
“The operator used AI to write and debug hundreds of scripts,” Seker said. “That shows how AI can help an attacker turn basic access into a broader, tailored operation.” The picture that emerges is not of autonomous AI-driven attacks but of a human operator using AI coding assistance to accelerate and customise what are, at their core, credential-based intrusions.
Destruction beyond encryption
What distinguishes n0n’s behaviour from many ransomware groups is its willingness to cause damage that a ransom payment cannot reverse. In several cases the group deleted files and backup stores; in at least one case it changed firewall policies to block network traffic. “The destructive behavior is equally significant,” Seker noted. “That creates a recovery problem that a decryption key alone cannot solve.” This positions the group’s extortion leverage around data loss and operational disruption, not just the promise of decryption.
After compromising Transcom, a Netherlands-based financial services provider, the group sent a secondary ransom alert directly to PayPal’s security team — despite the compromised data residing only on Transcom’s network. The group also broadcasts automated countdown warnings to victims’ service providers, clients, and media contacts to intensify pressure. On its leak site, n0n rates its own victims with countdown timers and negotiation rooms; those who do not pay see their data published.
The exposed workspace
SOCRadar’s researchers located the group’s operational server — a publicly accessible Python HTTP file server hosted in Sweden at 185.157.161[.]148 on port 8877 — and captured directory snapshots on 25 and 26 September. Across those snapshots, analysts documented 1,719 files covering attack scripts, ransomware source code, extortion infrastructure, and the AI coding environment. The server also contained hardcoded encryption keys with signs of reuse across victims. “The operator invested thousands of dollars in AI services while leaving its own workspace exposed,” Seker said. “An operation can have serious destructive capability while still making fundamental mistakes.”
Attribution remains uncertain. The group is believed to be based in Russia, but the exposed server did not provide definitive geographic confirmation. SOCRadar assesses n0n as a single operator or small team, and rates the group a 10 out of 10 for aggressiveness and zero out of 10 for lethality — reflecting operational ambition that outpaces tradecraft.
Why it matters
The n0n investigation reinforces a principle that security executives should be communicating to their boards: AI is lowering the barrier to sophisticated-looking attacks, but the entry points remain basic. Weak passwords, reused credentials, exposed cloud keys, and unprotected RDP are still the front door most attackers walk through. The group’s willingness to delete data and alter firewall configurations also demands that CISOs stress-test their incident response plans against scenarios where decryption is not the path to recovery — because paying the ransom may not restore operations when backups have been purged and network configurations altered.
What to do now
- Audit and rotate all credentials with access to FortiGate SSL-VPN portals and enforce multi-factor authentication; the group specifically targeted credential stuffing against these endpoints.
- Review AWS IAM permissions and access key exposure — particularly any keys with list, read, or delete permissions on S3 buckets — and implement least-privilege access controls.
- Ensure backup stores are isolated from the primary network environment and not accessible using the same credentials as production systems, as the group actively targeted and deleted backups.
- Restrict and monitor RDP exposure; the group conducted wide-scale RDP scanning as part of its standard access methodology.
- Include firewall configuration integrity checks in your incident response runbooks, as the group was observed altering firewall policies to disrupt recovery efforts.
- Verify that no internal file servers or development workspaces are inadvertently publicly accessible — the group’s own operational security failure serves as a reminder that misconfigured servers are an exposure risk on both sides of an intrusion.
