Ransomware Group n0n Exposes Own Infrastructure After Spending $7K on AI
Criminals utilized advanced AI coding agents while failing to secure their own server.
1The n0n Ransomware Operation
The n0n ransomware group targeted 23 organizations across 14 countries using a mix of automated credential stuffing and AI-assisted scripting. Despite their aggressive extortion tactics, the operators failed to secure their own infrastructure. Threat intelligence firm SOCRadar discovered a publicly accessible Python HTTP server containing the group's entire operational toolkit.
2AI Investment vs. Security Failure
The threat actor spent over $7,216 on AI services by October 22 to develop and debug malicious scripts. They utilized an open-source AI coding agent configured with 154 model entries, including Gemini and GPT-5.x. Ironically, this high-tech investment was undermined by the group leaving their own workspace exposed on port 8877.
3Credential-Based Attack Vectors
Contrary to fears regarding AI-driven vulnerability exploitation, the group relied exclusively on weak or stolen credentials for initial access. They utilized widespread RDP scanning and automated FortiGate SSL-VPN credential stuffing. In one instance, they accessed an e-commerce site using an exposed AWS access key, allowing them to delete sensitive S3 bucket data.
4Destructive Extortion Tactics
The group’s impact shifted between data theft, encryption, and total destruction depending on the target. In several cases, they deleted backups and modified firewall policies to prevent recovery. This destructive behavior creates a significant challenge for victims, as restoring systems becomes impossible even if a decryption key is obtained through ransom payments.
5Maritime Sector Targeting
On October 12, the group listed 38 maritime and logistics organizations on their leak site. Researchers linked 21 of these victims to the software provider CyberLogitec. The group demanded ransoms ranging from $400,000 to $28 million in Bitcoin, yet no payments were validated on-chain, leading to the publication of all stolen data.
6Operational Lifecycle and Visibility
SOCRadar identified 1,719 files on the exposed Swedish server, including ransomware source code and attack scripts. This exposure provided researchers with a complete view of the group's lifecycle, from initial access and persistence to credential collection. The server documented how the operator prepared attacks and handled stolen data across multiple victim environments.
7Aggressive but Unprofessional Tactics
Security analysts rate the n0n group as highly aggressive but lacking in fundamental security discipline. The operators frequently sent secondary ransom alerts to third-party clients and media outlets to increase pressure. Despite these sophisticated psychological tactics, the group hardcoded encryption keys and reused them across different victims, demonstrating significant operational gaps.
8Lessons in Operational Security
This case highlights a striking gap between the operational ambition of modern ransomware gangs and their internal security hygiene. While attackers leverage AI to scale their destructive capabilities, their reliance on basic mistakes remains a critical vulnerability. Organizations must prioritize robust credential management to defend against these conventional yet highly damaging intrusion methods.