Ransomware Operator Exposes $7K AI Infrastructure After Targeting 23 Organizations
The n0n group utilized advanced AI coding agents while failing to secure their own server.
1Exposed Operational Infrastructure
Security researchers at SOCRadar discovered a publicly accessible Python HTTP server in Sweden, hosted at 185.157.161.148. This server contained 1,719 files, including ransomware source code and attack scripts. The exposure provided unprecedented visibility into the n0n group's internal operations, revealing how they prepared attacks and managed stolen data from their victims.
2AI-Assisted Extortion Costs
The threat actor spent over $7,216 on AI services by October 22 to facilitate their criminal operations. They configured an open-source AI coding agent with 154 model entries across seven providers, including Llama, Claude, and GPT-5.x. These models were used to write and debug hundreds of scripts for their malicious activities.
3Low-Tech Entry Methods
Despite the hype surrounding AI-driven vulnerability exploitation, the n0n group did not exploit a single software bug to gain access. Instead, they relied on weak or stolen credentials, RDP scanning, and automated FortiGate SSL-VPN credential stuffing. This highlights a significant gap between the group's sophisticated AI tooling and their conventional entry points.
4Destructive Data Tactics
The operator moved beyond simple encryption by deleting data and backups to prevent recovery. In one instance involving e-commerce site Fanatics, the group used an exposed AWS access key to pull data from 40 S3 buckets. They purged keys across 12 sensitive buckets, effectively eliminating the victim's ability to restore their information.
5Maritime Sector Targeting
On October 12, the group listed 38 maritime, port, and logistics organizations on their leak site. Researchers linked 21 of these to customers of CyberLogitec, a South Korean software provider. The group demanded ransoms between $400,000 and $28 million in Bitcoin, yet no payments were verified on-chain before the deadline passed.
6Aggressive Extortion Lifecycle
The n0n group follows a consistent lifecycle: initial access, persistence via hidden admin accounts, and credential collection. They escalate pressure by broadcasting countdown warnings to a victim's clients and service providers. In a notable case, they contacted PayPal's security team after compromising the network of a Netherlands-based financial services provider, Transcom.
7Operational Security Failures
The operator demonstrated poor security hygiene by leaving their own workspace exposed and using hardcoded encryption keys. Evidence suggests these keys were reused across multiple victims, indicating a lack of professional discipline. This creates a striking contrast between their high-level operational ambition and their fundamental failure to protect their own infrastructure.
8Implications of Modern Extortion
The n0n case proves that attackers can achieve significant destructive capability while remaining technically amateurish. By combining AI-assisted development with basic credential theft, they create complex recovery problems for organizations. Security teams must prioritize credential management and robust backup strategies to defend against these evolving, yet fundamentally flawed, threat actors.