Skip to content
NewA calmer, faster ZeroHour
StoryRansomwarehigh

n0n operator leaked AI extortion files after credential break-ins

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

SOCRadar says a n0n operator targeted 23 organizations with stolen credentials and left scripts and an AI setup on a public server.

The Register, citing SOCRadar, reports that a n0n ransomware operator tried to break into 23 organizations in 14 countries and left a public file server in Sweden holding scripts, ransomware source, and an AI coding setup. SOCRadar says every examined break-in used weak or stolen credentials, including RDP scanning, FortiGate SSL-VPN credential stuffing, and an exposed AWS key used against S3, not a software vulnerability. In some cases the operator encrypted files and also deleted data and backups. The gang claims 108 victims; researchers have not validated ransom payments on-chain. OpenCode use cost more than $7,216 by October 22, and none of 38 maritime listings were marked settled after an October 19 deadline.

Key facts
  • SOCRadar found 1,719 files on a Sweden host at port 8877.
  • Attempts targeted 23 organizations in 14 countries via weak or stolen credentials.
  • OpenCode use across many models cost more than $7,216 by October 22.
  • The gang claims 108 victims; maritime demands ran from $400,000 to $28 million.
  • An exposed AWS key was used on 40 S3 buckets, up to 110 GB each.
  • None of 38 maritime listings were marked settled after the October 19 deadline.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 19, 2026None of 38 maritime listings marked settled after deadline · The Register
  2. Oct 22, 2026OpenCode costs across models exceeded $7,216 · The Register

What each outlet adds

beyond the shared facts
  • The RegisterVictim count, AI spend, AWS key use, and unvalidated payments.
  • SOCRadarHeadline names n0n and AI-assisted extortion; captured text has no article body.
Products
OpenCodeFortiGate
Threat actors
n0n
Malware
n0n
Victims
ChiBiTekTranscomFanatics
Organizations
SOCRadarCyberLogitecPayPal
Countries
SwedenUnited StatesNetherlandsSouth KoreaRussia
AI models
GeminiMistralLlamaClaudeGPT-5.xGrokDeepSeekQwen

Coverage

oldest first · one row per article · UTC
  1. · 2d ago SOCRadarFirst report

    SOCRadar post titles n0n an AI-assisted extortion operation

    The captured page is site navigation only, so tactics, victims, and confirmation of attacks are not in the text.

  2. · 2h ago The Register · Security

    n0n extortion operator exposed AI-aided attack files on open server

    SOCRadar says every examined break-in used weak or stolen credentials, not a software vulnerability.