Hunt: n0n ransomware's exposed workspace shows credential-only entry (FortiGate SSL-VPN stuffing across 305 devices, exposed AWS keys, weak RDP/WinRM) and an AI coding agent writing its scripts; IOCs inside

vendor threat intel (SOCRadar Threat Research Unit); victim claims and ransom totals are the group's own2026-10-30

Hunt: n0n ransomware's exposed workspace shows credential-only entry (FortiGate SSL-VPN stuffing across 305 devices, exposed AWS keys, weak RDP/WinRM) and an AI coding agent writing its scripts; IOCs inside

SOCRadar found an open Python HTTP file server at 185.157.161[.]148:8877 (AS42675, Sweden) exposing a n0n operator's working directory in snapshots on Sept 25 and 26: 1,719 files, including 829 scripts and five C++ encryptor sources. The material implicates at least 23 organizations in 14 countries. SOCRadar says every documented compromise used weak or stolen credentials, not vulnerability exploitation.

Entry: credential stuffing against 305 FortiGate SSL-VPN portals (GET /remote/login) through a residential SOCKS5 proxy pool, mass RDP scanning, weak RDP/WinRM passwords, exposed AWS access keys and reused hosting-portal sessions.
Impact beyond encryption: theft from 40 S3 buckets and deletion across 12 at one retailer; deleted backups; at one victim the operator switched every Cisco Firepower Management Center access policy to BLOCK.
AI use: the open-source opencode agent configured with 154 model entries across seven providers, including "uncensored"/abliterated and self-hosted models, wrote and debugged hundreds of scripts; gateway spend passed $7,216 by Oct 22. SOCRadar saw no autonomous attack system; the operation was human-directed.
IOCs (from SOCRadar): IPs 185.157.161[.]148, 185.157.161[.]93, 81.161.239[.]10 (:8455), 188.214.135[.]130 (:8898/:8899), 198.13.158[.]143, 45.132.114[.]241, 217.18.55[.]185:11434 (self-hosted LLM); domains ntpsync[.]io, n0n-cases[.]net (notice@n0n-cases[.]net), n0n[.]to, uberip[.]com; files *.n0n, *.n0n.tmp, n0n_READ_ME.txt, C:\Users\Public\n0n\; Run key value n0nNote; hidden admin accounts svc_upd ("Software Update"), svc_reg ("Registry Service"), svc; nenc.exe SHA-1 dc82e9c22c4a06c6bc03701fce2b55f4f490c651.

Hunt: high-volume failed then successful FortiGate SSL-VPN logins from residential IPs, new local admins with service-like names, S3 DeleteObject/DeleteBucket bursts from long-lived keys, and FMC policy changes outside change windows. n0n's leak site listed 93 victims and $283.7M in demands as of Oct 19; SOCRadar found no transactions on the 55 Bitcoin addresses it checked, so payment success is unproven.

Sources: SOCRadar: n0n Ransomware: Inside an AI-Assisted Extortion Operation · SOCRadar IOC report: n0n ransomware · The Register: Crim spent $7K+ on AI services in extortion attacks (Oct 30)