The n0n Ransomware Attack That Used AI Tools and Stolen Passwords, Not Exploits

A ransomware operator called n0n spent more than 7,216 dollars on AI coding agents, built hundreds of attack scripts, and then left its working directory open on the internet. Security researchers at SOCRadar found it, and what they found is a useful reality check. The AI bill is the headline. The finding that matters for defenders is smaller and more uncomfortable: in every documented compromise, the way in was a weak or stolen credential, not a fancy exploit.

SOCRadar's Threat Research Unit found an exposed Python file server in Sweden serving the operator's working directory, captured in snapshots from September 25 and 26. The directory held 1,719 files, including 829 scripts, the source for the group's lockers, the leak-site backend, and the operator's AI coding agent environment. The agent was OpenCode, an open-source coding agent, configured with 154 model entries across seven providers. The usage bill passed 7,216 dollars on October 22.

The n0n ransomware attack path had no exploits

SOCRadar reports no exploited vulnerability in any documented compromise. That sentence deserves emphasis, because it cuts against the usual story about ransomware gangs chaining zero-days. The entry points were ordinary, and that is what made them effective.

First, FortiGate SSL-VPN credential stuffing. The operator ran credential stuffing against a ranked list of 305 appliances through residential proxies. The giveaway request was to /remote/logincheck, carrying a cookie with the value APBSID=n0n. A managed IT provider was breached end to end through this pipeline, which shows how one weak VPN login can become a full network compromise.

Second, exposed cloud keys. In a sports retailer case, one long-lived AWS key could list, read, and delete S3 objects. The operator pulled data from 40 buckets and deleted a bank-transaction archive and twelve buckets. A single key with too much power, left lying around long enough to be found, did more damage than any exploit could have.

SOCRadar assesses with medium confidence that the exposed server was a private workspace for one operator or a small team, and that the wider operation looks multi-operator. It found no definitive attribution to any country, and its own post does not repeat press claims about where the group is based. Treat attribution claims from elsewhere with caution.

The AI angle, kept honest

It is tempting to describe this as an AI-powered ransomware gang, but the evidence does not support the autonomous version of that story. SOCRadar says the evidence shows a human-directed operation supported by AI, and it observed no fully autonomous attack system. The agent wrote and debugged hundreds of attack scripts, which is real leverage for a small team, but a human was directing it.

That distinction matters for defense planning. AI tooling lets a small group produce more scripts, test more variants, and move faster, but it does not invent new entry points out of thin air. In this case it amplified the oldest entry points in the book: reused passwords and over-privileged keys. The AI spend of 7,216 dollars is small compared with a ransom demand, and it bought productivity, not magic.

Indicators and the four controls that close these doors

SOCRadar published indicators from its findings, including six IP addresses covering the operator's agent box, payload origin, loot server, leak-site backend, Tor pivot, and self-hosted model, plus three domains: ntpsync.io, n0n-cases.net, and n0n.to, with n0n.to marked inactive. If you run detection, hunt for the /remote/logincheck pattern with the n0n cookie value, and for the listed infrastructure. This is not a detection lead for SOCRadar itself, since the post came from its own published research, but the indicators are usable by defenders now.

Four controls close every door this operator used. First, multi-factor authentication on every VPN and remote access path, with no exceptions for service accounts or legacy users. Second, credential hygiene: unique passwords, no reuse across appliances, and regular rotation for VPN credentials. Third, cloud key discipline: short-lived credentials, least privilege per key, and alerts on listing or deletion of whole buckets. Fourth, monitoring for the specific tells: mass logincheck requests, logins through residential proxies, and unusual S3 enumeration.

The broader context makes this urgent rather than theoretical. CISA warned that SafePay ransomware hit 600 critical infrastructure organizations, and Synology NAS devices were hit by C3RB3R ransomware with the same lesson: update and lock down before attackers find you. The 3-2-1 backup rule still applies when prevention fails, because the n0n case included outright deletion of cloud data.

The lesson in one sentence

Attackers do not need to break your software if your passwords and keys will let them in. AI makes them faster at trying the doors. It does not change which doors matter. Lock the VPN, rotate the keys, require the second factor, and keep backups that no single stolen credential can delete. That is less exciting than an AI arms race story, and it is the part that actually stops this attack.