n0n extortion campaign: AI-assisted ransomware gang hits 108 orgs via stolen credentials, exposed server reveals methods
Severity: high · Patch status: no-fix-needed · Since 2026-10-30
SOCRadar uncovered a publicly exposed Python HTTP file server in Sweden used by the n0n data-theft and extortion group, revealing 1,719 files including ransomware source code, attack scripts, and an AI coding agent environment. The gang, which claimed 108 victims since emerging in September 2026, spent over $7,216 on AI services (OpenCode with 154 models across seven providers, some uncensored) to write and debug attack scripts. Despite AI use, no vulnerability exploitation was found — all access relied on weak or stolen credentials via RDP scanning, FortiGate SSL-VPN credential stuffing, exposed cloud credentials, and reused sessions. Attacks involved data theft, encryption, deletion of data and backups, and firewall policy changes. Ransom demands ranged from $400K to $28M; many victims did not pay and had data leaked.
What to do
- Enforce MFA and strong, unique credentials on all remote access, especially FortiGate SSL-VPN and RDP; disable RDP exposure to the internet
- Rotate and audit cloud credentials (AWS access keys); restrict S3 bucket permissions and enable deletion protection/versioning
- Maintain offline, tested backups — the group deletes data and backups, so decryption alone cannot recover
- Monitor for hidden admin accounts disguised as services, covert proxies, and stolen session tokens/MFA code interception
- Review firewall policies for unauthorized changes and monitor egress to unknown file servers
Sources
All live incidents on Threat Watch
