> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # n0n ransomware group exposes AI-assisted attack infrastructure - URL: https://f4n6.co.uk/security-feed/n0n-ransomware-group-exposes-ai-assisted-attack-infrastructure/ - Published: 2026-10-30T20:56:02.000Z - Updated: 2026-10-30T20:56:02.000Z - Author: Jeff Davies - Tags: #security-feed, n0n ## 1\. Executive summary SOCRadar found a publicly accessible Python HTTP file server belonging to an operator of the n0n ransomware group, hosted in Sweden at 185.157.161\[.\]148 on port 8877, and captured snapshots of 1,719 files on 25 and 26 September 2026\. The files include attack scripts, ransomware source code, extortion infrastructure and an AI coding agent environment. The operator spent more than $7,216 on AI services to write and debug scripts, and in every documented compromise access came from weak or stolen credentials, not vulnerability exploitation. No CVE is associated with this item and no CISA KEV entry applies. The direct risk to EMEA financial services is credential-based intrusion through RDP and FortiGate SSL-VPN, followed by data theft and, in some cases, deletion of data and backups that a decryption key cannot recover. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17 | The documented lifecycle includes deletion of data and backups and, in one case, a firewall policy change that blocked traffic, which removes recovery options a decryption key would otherwise provide | The incident management process must cover destructive scenarios where restoration from backup is not available, not only encryption and key recovery | | DORA Art. 19 | The operator sent a secondary ransom alert directly to PayPal's security team after breaching Transcom, a Netherlands-based financial services provider, so a third party outside the victim's perimeter received notice of the breach | Reporting to competent authorities must account for disclosure of the incident to parties outside the entity, and the timeline for assessing whether the incident is major starts from awareness of that disclosure | ## 3\. Technical analysis & attack chain The operation ran on stolen and weak credentials. SOCRadar's chief information security officer, Ensar Seker, states that in every documented compromise in the investigation access relied on weak or stolen credentials, and that no vulnerability exploitation was found in the cases examined. The operator's own exposed workspace corroborates the tooling: attack scripts, ransomware source code and extortion infrastructure sat on a Python HTTP file server reachable from the internet. Confirmed steps in the documented lifecycle: 1. Initial access through credential attack. The group scans for Remote Desktop Protocol at scale and runs automated credential stuffing against FortiGate SSL-VPN portals. Against US managed services provider ChiBiTek, the operator tested credentials in the format ip:port:user:password against FortiGate portals at GET /remote/login, using a 15-thread residential SOCKS5 proxy pool. 2. Access through exposed cloud credentials and reused hosting portal sessions. In a case linked to e-commerce site Fanatics, the operator used an exposed AWS access key with permissions to list, read and delete objects in S3 buckets. 3. Persistence and credential collection. The operator created hidden admin accounts disguised as services, deployed covert proxies, and stole credentials and session tokens. It also accessed mailboxes and emailed multi-factor authentication codes. 4. Collection and centralisation. Sensitive data was collected and sent to the operator's central storage. 5. Impact. Depending on the victim, the operator stole data, encrypted it, destroyed it, or disrupted the network. In the Fanatics-linked case it pulled data from 40 S3 buckets at up to 110 GB per bucket, deleted data including bank-transaction archives, and purged keys across 12 sensitive buckets. In one case it changed firewall policies to block traffic. 6. Extortion. Ransom notes were sent, a countdown clock posted on the leak site, and negotiation rooms and email addresses established. Where victims did not pay, stolen files were leaked or backups destroyed. Automated countdown warnings were also sent to victims' service providers, clients and media outlets. The AI component. The operator used OpenCode, an open-source AI coding agent, configured with 154 model entries across seven providers. Models named in the reporting include Gemini, Mistral, Nemotron, Llama, Claude, GPT-5.x, Grok, Kimi, GLM, DeepSeek, MiniMax and Qwen, some with safety training removed and others marketed as uncensored. AI usage costs exceeded $7,216 by 22 October. SOCRadar found no evidence of a fully autonomous attack system; the operator used AI to write and debug hundreds of scripts. Group profile and attribution. n0n is a newcomer to data-theft and extortion and has claimed 108 victims since it emerged in September 2026\. On 12 October it added 38 maritime, port and logistics organisations across 18 countries to its leak site in one batch, with an October 19 deadline and ransom demands from $400,000 to $28 million in Bitcoin. Researchers linked at least 21 of those to customers of South Korean maritime software provider CyberLogitec, which has not confirmed an intrusion. After the deadline none of the 38 listings was marked settled and none of the payment addresses showed a transaction; all stolen data was published. SOCRadar rates the group 10 out of 10 for aggressiveness and zero out of 10 for lethality. The group is believed to be based in Russia, but the exposed server provided no definitive geographic or national attribution. No MITRE ATT&CK profile exists for n0n, so the attribution is unconfirmed. Confidence caveats. The technical detail above rests on a single source, SOCRadar's investigation as reported by The Register. The victim counts, the CyberLogitec link, the AI cost figure and the Russia assessment are single-sourced and not independently corroborated. SOCRadar has not validated any on-chain ransom payment, and the handful of victims marked honored - data destroyed on the leak site are the group's own claim. The operator's workspace also contained hardcoded encryption keys with evidence suggesting reuse across victims, which is single-sourced and should be verified before it is relied on for decryption. ## 4\. Mitigation & containment P1 within 24 hours - Enforce phishing-resistant MFA on all FortiGate SSL-VPN portals and disable any portal account that authenticates with a password alone. The observed attack is credential stuffing against GET /remote/login, so rate-limit and lock out on repeated failures at that endpoint. - Audit for hidden local admin accounts disguised as services on domain controllers and servers, and remove any that are not in the approved build. This is the persistence mechanism the operator used across every documented case. - Inventory AWS access keys and rotate any with list, read or delete permissions on S3 buckets. Enable S3 versioning and object lock on buckets holding transaction archives, and confirm backups are immutable and stored where the production credentials cannot delete them. - Restrict outbound RDP exposure: block RDP at the perimeter and require VPN or a bastion for any remote desktop access. P2 within 72 hours - Hunt mailboxes and mail flow for rules or forwarding that capture multi-factor authentication codes, and for session-token theft indicators in identity provider logs. - Review firewall policy change logs for unauthorised modifications, given the observed case of policy changes that blocked traffic. - Block or alert on the operator's known infrastructure: 185.157.161\[.\]148 on port 8877\. Treat residential SOCKS5 proxy egress to FortiGate login pages as suspicious. - Add detection for covert proxy processes and for service-named accounts created outside change control. P3 within 7 days - Test restoration from backup under the assumption that the primary data and backup keys are gone, covering the destructive scenario rather than encryption alone. - Review third-party and supply chain exposure where a software provider serves multiple downstream organisations, given the CyberLogitec link, and confirm contractual notification duties with those providers. ## 5\. Indicators of compromise | type | value | confidence | source | | ---- | -------------------------------- | ----------------------- | ----------------------- | | ipv4 | 185.157.161\[.\]148 | medium (single-sourced) | The Register / SOCRadar | | port | 8877 | medium (single-sourced) | The Register / SOCRadar | | url | hxxp://185.157.161\[.\]148:8877/ | medium (single-sourced) | The Register / SOCRadar | ```iocs ipv4 185.157.161[.]148 port 8877 url hxxp://185.157.161[.]148:8877/ ``` Behavioural indicators | behaviour | where to observe | confidence | | -------------------------------------------------------------------------------------------------- | -------------------------------------------------------- | ----------------------- | | Credential stuffing against FortiGate SSL-VPN at GET /remote/login from residential SOCKS5 proxies | FortiGate SSL-VPN authentication logs, proxy egress logs | medium (single-sourced) | | Hidden admin accounts disguised as services | Local account inventory, Windows Security event logs | medium (single-sourced) | | Covert proxy deployment and session-token theft | Endpoint EDR, identity provider session logs | medium (single-sourced) | | Mailbox access and emailed MFA code capture | Mail flow logs, MFA provider logs | medium (single-sourced) | | S3 object listing, reading and deletion with an exposed access key | AWS CloudTrail S3 data events | medium (single-sourced) | | Firewall policy changes that block traffic | Firewall configuration change logs | medium (single-sourced) | ## 6\. Detection The source gives no file hashes, filenames, mutexes or registry keys. The only machine-pivotable atomic indicator is the operator's server address and port, which is covered in §5\. Detection should focus on the credential-attack and persistence behaviours. ```yaml title: FortiGate SSL-VPN Credential Stuffing from Proxy Pool id: 8f2c1a4e-n0n-forti-2026 status: experimental description: Detects repeated failed logins to FortiGate SSL-VPN login endpoint consistent with automated credential stuffing author: Adverse Trace date: 2026/10/30 references: - https://www.theregister.com/security/2026/10/30/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see/5306754 logsource: product: fortigate service: sslvpn detection: selection: request_url|contains: '/remote/login' action: 'ssl-login-fail' timeframe: 5m condition: selection | count() by src_ip > 10 fields: - src_ip - user falsepositives: - Legitimate users mistyping passwords level: high ``` ```yaml title: Hidden Admin Account Disguised as Service id: 3b7d9c2f-n0n-persist-2026 status: experimental description: Detects creation of local admin accounts with service-like names outside change control author: Adverse Trace date: 2026/10/30 references: - https://www.theregister.com/security/2026/10/30/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see/5306754 logsource: product: windows service: security detection: selection: EventID: 4720 filter_service_naming: TargetUserName|endswith: - 'svc' - 'service' - 'svchost' condition: selection and filter_service_naming fields: - TargetUserName - SubjectUserName falsepositives: - Approved service account provisioning level: medium ``` ## 7\. Sources - The Register, "Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see", https://www.theregister.com/security/2026/10/30/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see/5306754, 2026-10-30\. Reporting on SOCRadar's investigation; the technical detail, victim counts and attribution in this advisory rest on this single source. ## 8\. Adverse Trace position Adverse Trace assesses this as a credential-access and data-destruction threat rather than an exploitation threat: no CVE is associated with the item, no CISA KEV entry applies, and SOCRadar found no vulnerability exploitation in any documented compromise. The severity to EMEA financial services sits in the combination of stolen-credential entry through RDP and FortiGate SSL-VPN, cloud key exposure, and deletion of data and backups that defeats decryption-based recovery. The n0n attribution is unconfirmed: no MITRE ATT&CK profile exists for the group, the Russia assessment is single-sourced, and the exposed server gave no definitive geographic attribution. We will monitor for further SOCRadar reporting on the exposed workspace and for corroboration of the CyberLogitec supply chain link, and we will update this advisory if independent sources confirm the operator's tooling or infrastructure. Clients should treat the FortiGate credential-stuffing and hidden-service-account behaviours as the priority detection gap and confirm backup immutability before the next reporting cycle. --- [Read the original source →](https://www.theregister.com/security/2026/10/30/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see/5306754?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*