Exposed server reveals n0n ransomware operator's AI-assisted extortion methods

A n0n ransomware operator tried to break into 23 organizations across 14 countries, but left its own server exposed, revealing its attack methods, AI use and destructive data theft. The group relies on weak or stolen credentials rather than software vulnerabilities, and in some cases deleted data and backups after stealing and encrypting files.

Credentials, not exploits

According to Ensar Seker, CISO of SOCRadar, every documented compromise relied on weak or stolen credentials. "We found no evidence of vulnerability exploitation in the cases examined," he said. The gang uses widespread Remote Desktop Protocol scanning and automated FortiGate SSL VPN credential stuffing. Operators also gained entry using exposed cloud credentials and reused hosting portal sessions. To access US based IT managed services provider ChiBiTek, it used a 15 thread residential SOCKS5 proxy pool. In one case linked to e commerce site Fanatics, an exposed AWS access key let the criminals pull data from 40 S3 buckets, with up to 110 GB per bucket, then delete data including bank transaction archives and purge keys across 12 sensitive buckets.

AI and destructive tactics

While threat hunters found no fully autonomous attack system, the operator used AI to assist intrusions, incurring more than $7,216 in AI usage costs by October 22. It used OpenCode, an open source AI coding agent, configured with 154 model entries across seven providers, including Gemini, Claude, GPT 5.x and others. "The operator used AI to write and debug hundreds of scripts," Seker said. The destructive behavior included deleting data and backups, and in one case changing firewall policies to block traffic. Seker said that creates a recovery problem a decryption key alone cannot solve.

Exposed server and n0n claims

SOCRadar found the operator's workspace, a publicly accessible Python HTTP file server hosted in Sweden at 185.157.161.148 on port 8877, last month. Snapshots on September 25 and 26 documented 1,719 files, including attack scripts, ransomware source code, extortion infrastructure and an AI coding agent environment. The group, n0n, has claimed 108 victims since it emerged last month. On October 12 it added 38 maritime, port and logistics organizations across 18 countries to its leak site. Researchers linked at least 21 of them to customers of South Korean maritime software provider CyberLogitec, although the provider has not confirmed an intrusion. The crooks set an October 19 deadline and ransom demands from $400,000 to $28 million in Bitcoin. After the deadline, none of the 38 listings were marked settled and none of their payment addresses showed any transaction. The group is believed to be based in Russia, but the server did not provide definitive geographic or national attribution.

Lifecycle and pressure tactics

Every documented case followed the same lifecycle, from initial access to persistence and credential collection, then data theft with impact varying by target. After breaking into Transcom, a Netherlands based financial services provider, the criminals sent a secondary ransom alert directly to PayPal's security team, even though the compromised data was only on Transcom's network. Finally, they send ransom notes, post countdown clocks, establish negotiation rooms and emails, and leak stolen files or destroy backups when organizations do not pay. The exposed server also contained hardcoded encryption keys, with evidence suggesting reuse across victims. Seker said the operator invested thousands of dollars in AI services while leaving its own workspace exposed, showing a striking gap between operational ambition and security discipline.

Sources: The Register