n0n extortion operator exposed AI-aided attack files on open server
SOCRadar says every examined break-in used weak or stolen credentials, not a software vulnerability.
74
Organization
SOCRadar
- Mentions · 7d9
- Mentions · 30d46
- All mentions79
- First seenAug 25, 2026
- Last mentioned11h ago
Timeline
79 articles · newest firstSOCRadar headline claims a $6.3B Binance hot-wallet theft
The supplied page is mostly site navigation, so how the wallets were taken and whether Binance confirmed the loss are not stated.
45
SOCRadar post titles n0n an AI-assisted extortion operation
The captured page is site navigation only, so tactics, victims, and confirmation of attacks are not in the text.
22
SOCRadar roundup page titled September 2026 attacks has no incident text
The captured page is site navigation and product marketing, not a report of the FBI, Clop, or IDScan events.
8
Australia cyber threat report 2025-26 says incidents rose 20%
The captured page is site navigation and does not include the report’s sectors, causes, or response details.
36
ICMacOS Mac malware sold for $699 a week with remote commands
Version 2 adds a WebSocket shell and LaunchAgent persistence while still stealing developer and wallet secrets.
64
SOCRadar headline says Brotli flaw Node2Shell hits Python packages
The captured page is site navigation, with no CVE, versions, fix, or exploitation details.
22
ICMacOS macOS stealer gains RAT capabilities with reboot persistence
ICMacOS now includes WebSocket remote commands and LaunchAgent persistence that survives reboots.
70
Finaxis WoWInstaller Moodle MyHairCare HT Médica data leaks
SOCRadar reports leaks involving Finaxis, WoWInstaller, Moodle, MyHairCare and HT Médica.
50
INC and Gentlemen affiliates used AI agents in ransomware intrusions
Exposed logs show 8,257 messages across 133 sessions and an estimated 62 targets, four of which appeared on leak sites.
78
Mirai operators attempt PHP2Shell attacks; no confirmed compromises
PHP fixed CVE-2026-109618 and CVE-2026-109619 on October 21; firms say attempts have not produced a confirmed breach.
84
PHP2Shell exploit attempts try to deploy Potassium Mirai
Sophos says the attempts failed, while SOCRadar found exploit tooling aimed at PHP 8.4.26.
74
PHP2Shell exploit tooling found on exposed attacker server
The available SOCRadar page gives the finding in the title but no IOCs, versions, or victim details.
38
Ransomware affiliates using Claude left chats and tools exposed
SOCRadar found 46 INC encryptor builds, notes on 62 organizations, and more than $23,920 in recorded AI spend.
78
SOCRadar post covers PHP2Shell CVE-2026-109618 and CVE-2026-109619
The captured page is site navigation, so versions, impact, and exploitation status are not in the text.
38
INC affiliates left servers open, exposing AI-assisted ransomware operations
SOCRadar says open directories led to six more servers, 8,257 AI messages, and 46 INC encryptor builds.
72
SOCRadar page titled on Japan's October 2026 data breaches
The captured page is site navigation and does not include the breach report's findings.
18
SOCRadar page on INC and Gentlemen ransomware lacks article text
The extract is site navigation plus a banner claiming stolen AI logins, not the ransomware report.
12
ConnectWise Cloud Backup breach page lacks incident details
The supplied SOCRadar page is site navigation and does not describe what was accessed or who was affected.
28
SOCRadar title cites ZoomInfo, TryCircle, HDB, and X leaks
The supplied page is site navigation and does not say what data was exposed or confirmed.
15
CVE-2026-102764: BeyondTrust Zero-Day Exploited
SOCRadar reports BeyondTrust zero-day CVE-2026-102764 is being exploited, but the page lacks technical detail.
74
SOCRadar Splunk Integration: New MSSP and Vulnerability Apps
SOCRadar released Splunk apps for MSSP incidents and vulnerability management, expanding its Splunkbase catalog to five apps.
20
Shipping firms and ports caught in mass cyber extortion claim
Extortion group n0n claims data from 38 shipping and port firms and demands ransoms by October 19.
64
Maximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack
Attackers are exploiting CVE-2026-102255, a CVSS 10 unauthenticated SSRF flaw in SonicWall SMA 1000 appliances.
86
CVE-2026-85097: Bricksforge WordPress Plugin Flaw Exploited for Unauthenticated RCE
CVE-2026-85097 in the Bricksforge WordPress plugin is being exploited for unauthenticated remote code execution.
76
Turn External Threat Intelligence into Machine-Speed Response with SOCRadar and Torq
SOCRadar and Torq announced an integration to automate response to external threat intelligence alerts.
18
Inside ICMacOS: From an Infostealer to a Persistent RAT
SOCRadar analyzes ICMacOS, macOS malware that evolved from an infostealer into a persistent RAT.
52
CyberXero Used 51 AI Agents to Steal 628,000 Ukrainian Records
Russian-speaking initial access broker CyberXero ran 51 Claude Code AI agents to steal 628,000 Ukrainian records, per SOCRadar.
70
Angi Data Sale, The Tour Guy Breach, Healthcare Leads, KPN Leak, and CafeMom Data Resurface
SOCRadar flags alleged dark-web sales of Angi, Tour Guy, healthcare, KPN, and CafeMom data.
46
CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records
Russian-speaking broker 'CyberXero' used Claude Code agents and Cobalt Strike to steal 628,000+ Ukrainian records via WordPress and critical infrastructure attacks.
80
FBI and Secret Service Warn of FortiBleed Lockout Threat
FBI and Secret Service warn FortiBleed has compromised 86,644 Fortinet devices and can lock out administrators.
84
FortiBleed Attackers Locking Victims Out of Fortinet Devices
FortiBleed attackers compromised about 86,644 Fortinet devices and are locking organizations out by changing passwords.
84
FBI: Ongoing FortiBleed attacks lock out FortiGate VPN admins
FBI says ongoing FortiBleed attacks still lock FortiGate VPN admins out using leaked and cracked credentials.
84
CyberXero Combines Claude Code, PentAGI and Cobalt Strike in AI-Augmented Cyberattacks
CyberXero used Claude Code, PentAGI and Cobalt Strike to breach sites and steal Ukrainian data.
82
FortiBleed hit 86,000 firewalls by exploiting something nobody can patch away
FBI and Secret Service say FortiBleed credential campaign compromised 86,644 Fortinet FortiGate firewalls across 194 countries, selling access to ransomware affiliates.
82
FortiBleed is still active, with attackers locking admins out of Fortinet firewalls
FBI and Secret Service warn FortiBleed attackers continue compromising Fortinet firewalls — 86,644 devices verified — locking admins out and selling access to ransomware affiliates.
87
FBI, Secret Service add to warnings of FortiBleed credential stealing campaign
FBI and Secret Service say FortiBleed compromised over 86,000 Fortinet firewalls in 194 countries.
90
Russian-Speaking CyberXero Uses AI Agent Swarm to Attack Ukrainian Energy Infrastructure
CyberXero used WordPress exploits and Claude agents against Ukrainian energy targets, stealing hundreds of thousands of records.
84
FBI Warns FortiBleed Campaign Targeting Fortinet Firewalls and VPNs to Steal Credentials
FBI warns FortiBleed operators compromised over 86,000 Fortinet firewalls and VPNs to steal credentials for ransomware brokers.
86
FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials
FBI and Secret Service warn FortiBleed is still harvesting Fortinet firewall credentials, with 86,644 logins tied to ransomware access brokers.
84
Related CVEs
by mentions- CVE-2026-3561694%9.8Unauthenticated Code Execution in Fortinet FortiClient EMS 7.4.5–7.4.6
- CVE-2026-4194099%9.3Missing-Authentication Bypass in WebPros cPanel & WHM (AuthBypass to RCE)
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-025795%7.8Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway
- CVE-2024-5772797%7.5Unauthenticated Path Traversal File Download in SimpleHelp 5.5.7 and Earlier
- CVE-2026-4815<1%8.7A SQL Injection vulnerability has been found in Support Board v3.7.7
- CVE-2025-3248100%9.8Unauthenticated RCE in Langflow /api/v1/validate/code
- CVE-2025-252494%9.8Heap-Based Buffer Overflow in Fortinet FortiOS, FortiSwitchManager, and FortiSASE
- CVE-2026-425306%9.2NGINX Open Source has a vulnerability in the ngx_http_v3_module module
Appears with
- Fortinetvendor · 11
- FBIorganization · 10
- SOCRadarvendor · 9
- FortiGateproduct · 9
- Microsoftvendor · 8
- CISAorganization · 8
- Lynxthreat actor · 7
- INCthreat actor · 7
- Claudeai model · 6
- U.S. Secret Serviceorganization · 5
- US Secret Serviceorganization · 4
- Anthropicvendor · 4
- Anthropicorganization · 4
- Fortinetorganization · 4
- Payloadthreat actor · 4
- The Gentlementhreat actor · 4
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.