n0n extortion operator exposed AI-aided attack files on open server
Original title: Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see
SOCRadar says every examined break-in used weak or stolen credentials, not a software vulnerability.
SOCRadar says a n0n ransomware operator tried to break into 23 organizations in 14 countries and left a public file server in Sweden holding scripts, ransomware source, and an AI coding setup. Entry was weak or stolen credentials, including RDP scanning, FortiGate SSL-VPN credential stuffing, and an exposed AWS key used against S3. In some cases the operator encrypted files and also deleted data and backups. The gang claims 108 victims; researchers have not validated ransom payments on-chain.
Unconfirmed: Russia-based attribution is unconfirmed, CyberLogitec has not confirmed an intrusion, and on-chain ransom payments were not validated.
- SOCRadar found 1,719 files on a Sweden host at port 8877.
- OpenCode use across many models cost more than $7,216 by October 22.
- n0n claims 108 victims; maritime demands ran from $400,000 to $28 million.
- An exposed AWS key was used on 40 S3 buckets, up to 110 GB each.
- None of 38 maritime listings were marked settled after the October 19 deadline.
Impact: Stolen, encrypted, or deleted data and backups via stolen credentials
- 1.Rotate exposed cloud access keys and review S3 delete permissions.
- 2.Replace weak or reused FortiGate SSL-VPN and RDP credentials.
- ATT&CK
- T1110.004 Credential StuffingT1021.001 Remote Desktop ProtocolT1078 Valid AccountsT1530 Data from Cloud Storage ObjectT1485 Data Destruction
- Threat actors
- n0n
- Organizations
- SOCRadarCyberLogitecPayPal
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 185.157.161.148 | icly accessible Python HTTP file server hosted in Sweden at 185.157.161[.]148 on port 8877 - last month, and documented the exposed dir |
From the original article
4 min read at theregister.comA n0n ransomware operator tried to break into 23 organizations across 14 countries, but couldn't secure its own front door, leaving its server exposed with all of its methods on view.
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.