---
title: Hunt: n0n ransomware's exposed workspace shows credential-only entry (FortiGate SSL-VPN stuffing across 305 devices, exposed AWS keys, weak RDP/WinRM) and an AI coding agent writing its scripts; IOCs inside | ctxsec
url: https://ctxsec.com/items/hunt-socradar-n0n-ransomware-exposed-workspace-opencode-fortigate-stuffing
description: ""
status: "vendor threat intel (SOCRadar Threat Research Unit); victim claims and ransom totals are the group's own"
published: 2026-10-30
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-socradar-n0n-ransomware-exposed-workspace-opencode-fortigate-stuffing.md)

vendor threat intel (SOCRadar Threat Research Unit); victim claims and ransom totals are the group's own

2026-10-30

### Hunt: n0n ransomware's exposed workspace shows credential-only entry (FortiGate SSL-VPN stuffing across 305 devices, exposed AWS keys, weak RDP/WinRM) and an AI coding agent writing its scripts; IOCs inside

SOCRadar found an open Python HTTP file server at `185.157.161[.]148:8877` (AS42675, Sweden) exposing a **n0n** operator's working directory in snapshots on Sept 25 and 26: 1,719 files, including 829 scripts and five C++ encryptor sources. The material implicates at least 23 organizations in 14 countries. SOCRadar says **every documented compromise used weak or stolen credentials, not vulnerability exploitation.**

- **Entry:** credential stuffing against 305 FortiGate SSL-VPN portals (`GET /remote/login`) through a residential SOCKS5 proxy pool, mass RDP scanning, weak RDP/WinRM passwords, exposed AWS access keys and reused hosting-portal sessions.
- **Impact beyond encryption:** theft from 40 S3 buckets and deletion across 12 at one retailer; deleted backups; at one victim the operator switched every Cisco Firepower Management Center access policy to BLOCK.
- **AI use:** the open-source **opencode** agent configured with 154 model entries across seven providers, including "uncensored"/abliterated and self-hosted models, wrote and debugged hundreds of scripts; gateway spend passed $7,216 by Oct 22. SOCRadar saw no autonomous attack system; the operation was human-directed.
- **IOCs (from SOCRadar):** IPs 185.157.161[.]148, 185.157.161[.]93, 81.161.239[.]10 (:8455), 188.214.135[.]130 (:8898/:8899), 198.13.158[.]143, 45.132.114[.]241, 217.18.55[.]185:11434 (self-hosted LLM); domains ntpsync[.]io, n0n-cases[.]net (notice@n0n-cases[.]net), n0n[.]to, uberip[.]com; files `*.n0n`, `*.n0n.tmp`, `n0n_READ_ME.txt`, `C:\Users\Public\n0n\`; Run key value `n0nNote`; hidden admin accounts `svc_upd` ("Software Update"), `svc_reg` ("Registry Service"), `svc`; nenc.exe SHA-1 dc82e9c22c4a06c6bc03701fce2b55f4f490c651.

**Hunt:** high-volume failed then successful FortiGate SSL-VPN logins from residential IPs, new local admins with service-like names, S3 `DeleteObject`/`DeleteBucket` bursts from long-lived keys, and FMC policy changes outside change windows. n0n's leak site listed 93 victims and $283.7M in demands as of Oct 19; SOCRadar found no transactions on the 55 Bitcoin addresses it checked, so payment success is unproven.

Sources: [SOCRadar: n0n Ransomware: Inside an AI-Assisted Extortion Operation](https://socradar.io/blog/n0n-ransomware-ai-assisted-extortion/) · [SOCRadar IOC report: n0n ransomware](https://ioc.socradar.io/reports/n0n-ransomware-inside-an-ai-assisted-extortion-operation-28ee7307fa7e) · [The Register: Crim spent $7K+ on AI services in extortion attacks (Oct 30)](https://www.theregister.com/security/2026/10/30/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see/5306754)