n0n Ransomware Spent $7,216 on AI Coding Agents and Still Broke In With Stolen Passwords. Here Are the Indicators and the Four Controls That Close Every Door It Used.
An extortion operator calling itself n0n spent more than $7,216 on AI model usage to write attack tooling, and then left its working directory open on the internet. SOCRadar found it. The headline is the AI bill. The finding that matters to a defender is smaller: SOCRadar reports no exploited vulnerability in any documented compromise. Every one used a weak or stolen credential.
What SOCRadar found
SOCRadar's Threat Research Unit found an exposed Python file server at 185.157.161.148 on port 8877, in AS42675 in Sweden. It served the operator's working directory, captured in two snapshots on September 25 and 26. The directory held 1,719 files, including 829 scripts and the source for the group's lockers, plus the leak-site backend and the operator's AI coding agent environment.
The agent is OpenCode, an open-source coding agent, configured with 154 model entries across seven providers. Some are "uncensored" models with safety training removed, and one is self-hosted. It wrote and debugged hundreds of attack scripts, and the usage bill passed $7,216 on October 22. SOCRadar says the evidence shows a human-directed operation supported by AI and observed no fully autonomous attack system.
SOCRadar assesses with medium confidence that the server was a private workspace for one operator or a small team, and that the wider operation looks multi-operator. It found no definitive attribution to any country. Some press coverage says the group is believed to be Russia-based. SOCRadar's own post does not say so, and we are not repeating it.
How it got in
SOCRadar reports no vulnerability exploitation in the cases it examined. The documented entry points were:
FortiGate SSL-VPN. Credential stuffing against a ranked list of 305 appliances, through residential proxies. The request that gives it away is /remote/logincheck, and SOCRadar saw requests carrying the cookie APBSID=n0n. A managed IT provider was breached end to end through this pipeline.
Exposed AWS keys. In the sports retailer case, one long-lived key could list, read and delete S3 objects. The operator pulled data from 40 buckets and deleted a bank-transaction archive and twelve buckets.
Weak RDP and WinRM credentials. Weak or default administrator passwords.
Hosting management portals. Reused sessions and stolen administrator browser credentials. A cloud hosting provider was taken over this way, and its tenant backups were extracted.
It also turned a security tool on a victim. At a Venezuelan ISP the operator flipped every access policy in the Cisco Firepower Management Center to BLOCK and claimed to have cut national traffic. Where n0n does not encrypt, SOCRadar says it deletes data and backups after exfiltration.
The four controls
Phishing-resistant MFA on every SSL-VPN, RDP and administrator portal. Then watch /remote/logincheck for bursts of failures from many addresses, and invalidate any credential that appears in infostealer logs.
Short-lived cloud roles instead of long-lived keys. Separate the permission to list and read from the permission to delete, turn on Object Lock and versioning, and alert on high-volume DeleteObjects calls.
Lock the firewall manager. Put FortiManager and Cisco FMC behind an IP allow-list and MFA, require approval for policy changes, and alert on REST tokens created from addresses that are not your management network.
Keep an offline or immutable backup. SOCRadar says the operator deletes shadow copies, wipes free space and removes provider-hosted backups.
A recovery opening
SOCRadar reports each locker build uses a single hardcoded AES-256 key with no per-victim derivation, and that one key was likely reused across two victims. If you were hit, a decryptor for one victim could open the other. It is worth asking your incident responders before you consider paying.
What we hold
Before today we held nothing on n0n: no indicators, no actor profile and no coverage. We read SOCRadar's post directly and ingested 13 records from its indicator table, credited to SOCRadar and not presented as our own sighting. SOCRadar published on October 28, three days before us, so this is not a detection lead.
Six IP addresses, the operator's agent box, payload origin, loot server, leak-site backend, Tor pivot and self-hosted model, at confidence 75. They ship in the default IP feed, which includes everything at confidence 50 and above, and a consumer who filters at 80 will not see them. We scored them below the domains and hashes because the sources are one researcher's snapshot from September 25 and 26, and hosting addresses get reassigned.
Three domains, ntpsync.io, n0n-cases.net and n0n.to. SOCRadar marks n0n.to inactive.
Four hashes, the sources and compiled binary of the Windows and Linux lockers.
We left some indicators out on purpose. SOCRadar lists 45.132.114.241 only as an "operator scrub-list IP", and we cannot tell whether that is an operator address or a victim's. It also lists uberip.com as an "actor mail domain", which we could not confirm is not a legitimate mail service. We also did not ingest the 55 Bitcoin addresses or the onion address, which our feed does not carry. SOCRadar says all 55 addresses showed zero transactions as of October 16.
Limits
Everything here comes from SOCRadar's published post, which we read directly. SOCRadar's full indicator list and its whitepaper are behind its platform and we did not read them. Victim counts differ by outlet. SOCRadar says 93 listed victims with $283.7 million in demands as of October 19, and another report says 108 claimed victims. We use SOCRadar's own figure. The 38 maritime and port organizations listed on October 12 have been linked by other researchers to customers of one software vendor, which has not confirmed an incident, so we do not treat that link as established. We did not test any indicator or check whether the exposed server is still reachable.
Five percent of this is wrong somewhere. It always is.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments