Exposed n0n Ransomware Workspace Reveals AI-Assisted, Credential-Based Extortion

SOCRadar researchers uncovered an exposed n0n ransomware operator workspace containing attack scripts, encryptor source code, extortion infrastructure and an AI coding environment. The September discovery implicated 23 organizations across 14 countries, although four showed only access attempts with no demonstrated outcome. Every documented compromise relied on weak or stolen credentials rather than vulnerability exploitation. The human-directed operation used the opencode AI coding agent to develop hundreds of scripts, with more than $7,216 in recorded usage, supporting data theft, encryption, backup destruction, destructive deletion and firewall-policy manipulation—not autonomous attacks.

As of October 19, n0n’s leak site listed 93 victims and aggregate ransom demands of $283.7 million; however, 55 examined Bitcoin addresses had no transactions as of October 16, leaving payment success unproven. SOCRadar assessed that the workspace belonged to a single operator or small team within a broader multi-operator operation. Geographic attribution and a suspected maritime supply-chain connection remain unconfirmed. The findings underscore the importance of enforcing multifactor authentication, eliminating weak credentials, monitoring remote access and protecting backups and firewall administration from compromised accounts.