n0n's AI habit cost $7K, leaked its playbook

A ransomware outfit calling itself n0n tried to break into 23 organizations across 14 countries — and left the working files of that campaign sitting on a publicly reachable server. SOCRadar's threat hunters found the exposed directory and, according to the firm's own account, were able to read the operator's attack scripts, locker source code, extortion infrastructure and AI coding environment.

The detail that stands out is what the intrusion methods were not. In a period when AI-assisted vulnerability discovery is often described as the next frontier for attackers, this crew got in without exploiting a single bug. Every documented compromise in the investigation traced back to weak or stolen credentials.

No exploits, just stolen keys

SOCRadar's write-up describes an operation built on credential access at scale rather than on novel exploitation. The gang scanned broadly for Remote Desktop Protocol exposure and ran automated credential stuffing against FortiGate SSL-VPN portals. Against US-based IT managed services provider ChiBiTek, the operator used a 15-thread residential SOCKS5 proxy pool to test username-and-password combinations, formatted as ip:port:user:password, against the FortiGate login endpoint.

Other entries came through exposed cloud credentials and reused hosting portal sessions. In a case linked to e-commerce site Fanatics, SOCRadar found that n0n held an exposed AWS access key with permissions to list, read and delete objects in S3 buckets. The crew used that key to pull data from 40 buckets, with up to 110 GB per bucket, and then deleted data — including bank-transaction archives — and purged keys across 12 sensitive buckets.

The pattern matters because it is unglamorous. No zero-day, no chained memory corruption, no exploit development. The entry points were the ones defenders have been told to close for years.

“In every documented compromise in this investigation, access relied on weak or stolen credentials,” said Ensar Seker, chief information security officer of threat intelligence firm SOCRadar.

— Ensar Seker, chief information security officer of threat intelligence firm SOCRadar

Seker elaborated on the mix in comments to The Register: “What stands out is the combination of AI-assisted development and very conventional entry points. We found no evidence of vulnerability exploitation in the cases examined.”

The AI bill and the model zoo

Where the operation did lean on newer tooling was in preparation. SOCRadar says the operator used AI to assist with the intrusions and had run up more than $7,216 in AI usage costs by October 22.

The setup centered on OpenCode, an open-source AI coding agent, configured with 154 model entries across seven providers. The model roster included Gemini, Mistral, Nemotron, Llama, Claude, GPT-5.x, Grok, Kimi, GLM, DeepSeek, MiniMax and Qwen, among others. Some of those entries were models with safety training removed; others were marketed as “uncensored.”

What the operator got for that spend was volume. According to Seker, the AI was used to write and debug hundreds of scripts, turning basic access into something broader and more tailored to each target.

“The operator used AI to write and debug hundreds of scripts. That shows how AI can help an attacker turn basic access into a broader, tailored operation,” Seker said.

— Ensar Seker, chief information security officer of threat intelligence firm SOCRadar

SOCRadar says it found no evidence of a fully autonomous attack system. The AI sat in the development loop, not in the driver's seat.

Deleting what a decryptor can't fix

The impact on victims was not limited to file encryption. In some cases the operator deleted data and backups outright; in one case it changed firewall policies to block traffic. That combination creates a recovery problem that no decryption key solves.

“The destructive behavior is equally significant,” Seker said. “The operator did more than steal and encrypt files: in some cases, it deleted data and backups, and in one case changed firewall policies to block traffic. That creates a recovery problem that a decryption key alone cannot solve.”

— Ensar Seker, chief information security officer of threat intelligence firm SOCRadar

Across the cases the exposed server documented, the sequence followed a consistent lifecycle: initial access, then persistence and credential collection through hidden admin accounts disguised as services, covert proxies, theft of credentials and session tokens, and access to mailboxes and emailed multi-factor authentication codes. Sensitive data was collected and shipped to the operator's central storage. The final impact varied by victim — theft, encryption, destruction or network disruption.

After breaking into Transcom, a Netherlands-based financial services provider, the criminals sent a secondary ransom alert directly to PayPal's security team, even though the compromised data sat only on Transcom's network.

The maritime batch and its price tags

n0n is a newcomer. SOCRadar says the group has claimed 108 victims since it emerged last month. On October 12, it added 38 maritime, port and logistics organizations across 18 countries to its leak site in a single batch. Researchers linked at least 21 of those to customers of South Korean maritime software provider CyberLogitec, though the software provider has not confirmed an intrusion.

The crew set an October 19 deadline for the maritime firms, with ransom demands for that batch ranging from $400,000 to $28 million, payable in Bitcoin. After the deadline passed, none of the 38 listings was marked “settled” and none of their payment addresses showed any transaction. All of the affected organizations' stolen data was published.

A handful of the gang's claimed victims have been marked “honored — data destroyed” on n0n's leak site, a label indicating the victim paid. SOCRadar says it has not validated any transactions on-chain. In its profile, the security shop rates the gang 10 out of 10 for “aggressiveness” and zero out of 10 for “lethality.”

The group is believed to be based in Russia, although the server SOCRadar uncovered — attributed to a single operator or small team — provided no definitive geographic or national attribution.

The workspace left on port 8877

The window into all of this was a publicly accessible Python HTTP file server hosted in Sweden at 185.157.161[.]148 on port 8877. SOCRadar says its hunters found the workspace last month and documented the exposed directory in snapshots taken on September 25 and 26.

Across those snapshots, the firm identified 1,719 files. They included attack scripts, ransomware source code, extortion infrastructure and the AI coding agent environment. That gave researchers a view of how the operator prepared attacks and handled stolen data — the machinery behind the victim listings on the leak site.

“Across those snapshots, we identified 1,719 files, including attack scripts, ransomware source code, extortion infrastructure, and an AI coding agent environment,” Seker said. “This gave us visibility into the operation behind the victim listings, including how the operator prepared attacks and handled stolen data.”

— Ensar Seker, chief information security officer of threat intelligence firm SOCRadar

The exposure also laid out the operator's own security posture. The locker contained hardcoded encryption keys, with evidence suggesting reuse across victims. An operation capable of deleting a victim's backups had left its own front door open.

“There is a striking gap between operational ambition and security discipline,” Seker said. “The operator invested thousands of dollars in AI services while leaving its own workspace exposed. The locker also contained hardcoded encryption keys, with evidence suggesting reuse across victims. An operation can have serious destructive capability while still making fundamental mistakes.”

— Ensar Seker, chief information security officer of threat intelligence firm SOCRadar

Pressure by proxy and countdown clocks

The extortion playbook, as documented from the server, runs on timers and third parties. The crew posts a countdown clock on its leak site, opens negotiation rooms and email channels for victims, and publishes stolen files or destroys backups when organizations do not pay. To increase pressure, n0n also broadcasts automated countdown warnings to victims' service providers, clients and media outlets.

That outreach is a lever pulled from outside the target's perimeter, aimed at people who have no direct control over whether the ransom is paid. The PayPal notification in the Transcom case fits the same pattern: a secondary ransom alert sent to an organization adjacent to the breach.

What the numbers say together

• $7,216 in AI usage costs incurred by the operator by October 22
• 154 model entries across seven providers in the OpenCode configuration
• 23 organizations across 14 countries targeted in the investigated campaign
• 1,719 files found in the exposed server snapshots of September 25 and 26
• 108 victims claimed by n0n since it emerged last month
• 38 maritime, port and logistics organizations across 18 countries listed on October 12
• Ransom demands for that batch running from $400,000 to $28 million, in Bitcoin, with an October 19 deadline
• 40 S3 buckets accessed via an exposed AWS key, up to 110 GB per bucket, with keys purged across 12 sensitive buckets
• 15-thread residential SOCKS5 proxy pool used against FortiGate portals

What this means for defenders

The documented record here suggests a threat model that is less exotic than the AI framing might imply. If SOCRadar's account holds — and it is currently the sole source for these findings — the operation gained access through credential reuse and exposed keys, then used AI to accelerate the scripting around that access. The defensive measures that map to those entry points are the familiar ones: control over RDP and SSL-VPN exposure, scrutiny of cloud keys and their permissions, and attention to session tokens and mailbox access once an intruder is inside.

The destructive twist is the harder part. Backups that can be deleted by an intruder who reaches them are not a recovery plan, and a decryptor does not restore data that was purged. That combination — theft, encryption and deletion — is what the operator's own files describe, according to SOCRadar.

For organizations in the maritime and logistics batch, the published data is already out. For everyone else, the exposed workspace is a reminder that an adversary's own mistakes can surface a playbook, but the playbook itself describes methods that do not require a new exploit to work.