Most ransomware reporting starts on the leak site, with a logo, a countdown timer and a list of victims. This story starts somewhere else: on a server the attackers left open by mistake.

Researchers at SOCRadar's Threat Research Unit found an exposed staging server, a working machine with 1,719 files, that belonged to an operator of a new data-theft and extortion group called n0n. The files show how the operation actually worked. The weapons were not novel zero-days. The operator used stolen and weak passwords, exposed cloud keys and an AI coding agent that ran up a bill of more than $7,216.

For defenders, that is the main lesson. The techniques behind this campaign are mostly ones that ordinary controls can block.

What the researchers found

According to SOCRadar's write-up, published October 28, researchers tracked the operator's activity from September 17 to October 22, 2026. The Register reports that the server, hosted in Sweden, was exposed on September 25 and 26. SOCRadar documented the exposed directory in snapshots on those two dates.

The workspace named 23 organizations. SOCRadar sorted them by how far the attacker got:

  • 15 were later published on n0n's leak site.
  • 4 were compromised but not published.
  • 4 were access attempts only.

The Register says those targets spanned 14 countries.

SOC Prime's independent summary of the research describes n0n as a group focused on data exfiltration, meaning it copies data out of a victim's network to use as leverage. In some incidents it also wipes data destructively, which differs from the classic ransomware model of encrypting files and selling a decryption key.

How they got in: credentials, not exploits

"Access relied on weak or stolen credentials," SOCRadar's Ensar Seker told the Register. The server's contents support that. The researchers describe three main routes in:

  • Credential stuffing against FortiGate SSL-VPNs. Credential stuffing means automatically trying large lists of usernames and passwords leaked from other breaches, betting that people reuse them. SOCRadar says the operator ran this against 305 FortiGate SSL-VPN devices. The Register reports that one of the organizations reached this way was ChiBiTek, a US managed service provider (MSP). An MSP manages IT for other businesses, so its access can open doors at many clients.
  • Weak RDP and WinRM logins. Remote Desktop Protocol and Windows Remote Management let administrators control Windows machines over a network. The Register says the gang breaks into organizations at scale using widespread RDP scanning, and SOCRadar lists weak RDP and WinRM credentials among the entry points.
  • Exposed AWS keys. According to the Register, an exposed Amazon Web Services access key tied to the e-commerce site Fanatics let the operator pull data from 40 S3 storage buckets, some holding up to 110 GB each, and delete data across 12 of them. These details come from the researchers' analysis of the attacker's files.

SOCRadar also reports that the operator hijacked Cisco Firepower Management Center policies at a Venezuelan internet service provider and set them to block traffic. The researchers present this as a claim drawn from the attacker's material.

The AI angle, minus the hype

The headline figure is the AI spending: more than $7,216 by October 22, according to the Register. The operator used OpenCode, an AI coding agent, configured with 154 model entries across seven providers. The tool wrote and revised scripts for the attacks.

That figure matters, but mostly for what it doesn't show. The AI did not discover new vulnerabilities or invent new techniques. SOCRadar's Ensar Seker told the Register the operator used AI to write and debug hundreds of scripts, and SOCRadar found no evidence of a fully autonomous attack system. SOC Prime's summary says the group uses AI-assisted tooling to automate script creation and attack workflows. AI helped the attacker turn basic access into a broader operation. That access still depended on a reused password or a leaked key.

The locker itself was not sophisticated either. SOCRadar says the encryption component uses AES-256-CBC with a key hardcoded into each build, and that one key was likely reused across two victims. SOCRadar notes that a decryptor for one of those victims could therefore unlock the other.

What the gang says versus what can be verified

The victim counts and dollar figures here come mostly from n0n's own leak site, and none of them have been independently verified.

  • The Register reports that n0n has claimed 108 victims. SOCRadar reports that n0n had listed 93 victims as of October 19, with total ransom demands of $283.7 million.
  • On October 12, according to the Register, the group posted 38 maritime, port and logistics organizations, with demands from $400,000 to $28 million. After the group's October 19 deadline, none of the 38 listings were marked settled. Researchers linked at least 21 of them to customers of CyberLogitec, a logistics software provider. CyberLogitec has not confirmed an intrusion.
  • SOCRadar could not confirm any ransom payments on-chain. As of October 16, 55 payment addresses linked to the group showed zero transactions.

The Register reports that the group is believed to be based in Russia, but the exposed server provided no definitive geographic or national attribution.

What It Means for Defenders

Who is affected: any organization with internet-facing VPN, RDP or WinRM access protected only by a password, and any organization with long-lived cloud access keys that could leak. SOCRadar says the victims span 15 sectors, and the group's October 12 batch targeted maritime, port and logistics organizations. MSPs and their customers should pay particular attention, because one compromised MSP account can reach many client networks.

This was not a single-bug campaign, so there is no specific version to patch. The fixes are configuration and identity controls. Based on SOCRadar's recommendations and CISA's general ransomware guidance:

  1. Put phishing-resistant MFA on every remote entry point. SOCRadar specifically names RDP, SSL-VPN and admin portals. Phishing-resistant MFA means methods such as FIDO2 security keys or passkeys, not SMS codes. Credential stuffing fails when a password alone isn't enough to log in.
  2. Check your FortiGate SSL-VPN logs for bursts of failed logins across many usernames, which is the signature of credential stuffing. Rotate any credentials that might be reused from other breaches.
  3. Don't expose RDP and WinRM directly to the internet. If they must be reachable, put them behind a VPN with MFA.
  4. Lock down firewall management. SOCRadar recommends IP allow-lists on firewall management interfaces, so that only known administrative addresses can reach them. The reported hijacking of Cisco FMC policies shows why.
  5. Use short-lived cloud credentials in place of static access keys. SOCRadar also recommends separating S3 list, read and delete permissions, so that one stolen key can't both empty a bucket and erase it.
  6. Turn on S3 Object Lock for critical buckets. It makes stored objects undeletable for a set retention period.
  7. Keep offline or immutable backups. n0n reportedly deleted data and backups in some cases. Backups that the attacker can reach with the same credentials offer no protection. CISA's #StopRansomware Guide also recommends offline or immutable backups, along with zero trust architecture and granular access control. The guide includes a Ransomware Response Checklist worth reviewing before an incident.

For federal contractors working through CMMC, these controls align with requirements you likely already document, such as MFA on remote access, least-privilege access and protected backups. This campaign shows what can go wrong when they exist only on paper.

The operator in this case spent thousands of dollars on AI tools and still relied on someone, somewhere, reusing a password. MFA on remote access is still the most effective way to block that.

Sources