n0n ransomware operation used AI to support extortion

SOCRadar Threat Research Unit (STRU) has documented an AI-assisted extortion operation linked to the n0n ransomware group, visible from an exposed staging server in September 2026. The live workspace revealed breach and exfiltration tooling, original locker source code, extortion infrastructure and an AI coding agent environment backed by more than $7,000 in paid LLM usage.

STRU states at least 23 organizations across 14 countries were implicated, with no vulnerability exploit identified; each documented breach relied on weak or stolen credentials. Where n0n does not encrypt, it destroys data and backups after exfiltration. By 19 October 2026, the operation claimed 93 victims and total ransom demands of about $283.7 million.

The exposed workspace, hosted at 185.157.161[.]148, comprised 1,719 files from two September 2026 snapshots, including 829 scripts and five C++ encryptor sources. The operation leveraged credential stuffing against 305 FortiGate SSL‑VPN devices, exposed AWS keys, weak RDP/WinRM credentials and compromised hosting panels.

An AI coding agent, branded as opencode and configured with around 150 models across seven providers, generated hundreds of attack scripts, with gateway spending exceeding $7,216 by 22 October 2026; STRU notes this points to a human-directed operation supported by AI, not a fully autonomous system. Notable case highlights include Dediserve, Inter, Fanatics and ChiBiTek, with extortion playbooks featuring unique Bitcoin addresses and negotiation rooms.

The report also details MITRE ATT&CK techniques observed, and provides indicators of compromise and recommended defensive actions as described in the whitepaper, Automating Extortion: Inside an AI-Assisted n0n Ransomware Operation.