Ransomware Crew Spent $7K on AI Tools, Then Left Their Entire Operation Exposed on a Public Server
A ransomware operator calling itself n0n managed to hit 23 organisations across 14 countries, rack up over seven thousand dollars in AI service costs, and still leave its own server wide open for anyone to browse. The irony practically writes itself.
SOCRadar's threat intelligence team stumbled across the operator's workspace last month: a Python HTTP file server sitting in Sweden, publicly accessible, no authentication. Snapshots taken on September 25 and 26 captured 1,719 files including attack scripts, ransomware source code, extortion infrastructure, and a fully configured AI coding environment. Essentially the entire playbook, served up on a plate.
Despite all the current panic about AI-powered zero-days tearing through enterprise defences, n0n didn't exploit a single vulnerability to gain access to any of its targets. Not one. Every documented intrusion relied on weak or stolen credentials. The group used automated RDP scanning, FortiGate SSL-VPN credential stuffing, exposed AWS keys, and reused hosting portal sessions. Old-school stuff dressed up in new clothes.
In one case tied to e-commerce firm Fanatics, the crew got hold of an exposed AWS access key that let them list, read, and delete S3 objects. They pulled data from 40 buckets, up to 110 GB each, then deleted bank transaction archives and wiped keys across 12 sensitive buckets. No sophisticated exploit required. Just someone leaving credentials where they shouldn't have been.
The AI angle is real, but it's not what the breathless headlines suggest. The operator used OpenCode, an open-source AI coding agent, configured with 154 model entries spanning seven providers. The model list reads like a who's who of the current LLM landscape: GPT-5.x, Claude, Gemini, Grok, DeepSeek, Llama, Mistral, Qwen, and various others, including some with safety training stripped out. By October 22, they'd burned through at least $7,216 in API costs.
What they actually used it for was writing and debugging attack scripts. No autonomous exploitation, no AI finding zero-days. Just a criminal using chatbots to speed up the boring parts of running a ransomware operation. Faster iteration on tooling, not some sci-fi self-directing attack system.
The destructive side of the operation is worth paying attention to, though. Beyond stealing and encrypting files, n0n deleted data and backups in several cases, and in at least one instance changed firewall policies to block traffic. A decryption key doesn't fix any of that. It's a deliberate escalation designed to maximise pressure on victims who might otherwise feel confident in their recovery options.
n0n itself is a newcomer, having only emerged last month, but has already claimed 108 victims. On October 12, it added 38 maritime and logistics organisations across 18 countries to its leak site in a single batch. Researchers linked at least 21 of them to customers of South Korean maritime software provider CyberLogitec, though the company hasn't confirmed a breach. Ransom demands for the maritime firms ranged from $400,000 to $28 million in Bitcoin, with an October 19 deadline. None of the 38 were marked as settled when that deadline passed, and none of the payment addresses showed any transactions. The data was published anyway.
The group is suspected to be Russia-based, though nothing from the exposed server confirmed that definitively. SOCRadar rates them 10 out of 10 for aggressiveness and zero out of 10 for lethality, which is a fairly damning summary.
The attack lifecycle across all documented cases followed a consistent pattern: initial access via stolen credentials, persistence established through hidden admin accounts disguised as services, covert proxies deployed, credentials and session tokens harvested, then data exfiltrated to central storage before the ransom note goes out and the countdown clock starts ticking.
In one particularly odd move, after compromising Transcom, a Netherlands-based financial services firm, the gang sent a secondary ransom alert directly to PayPal's security team, despite the stolen data having nothing to do with PayPal's infrastructure.
The operational ambition is clear. The security discipline is not. Hardcoded encryption keys were found in the exposed workspace, with evidence suggesting they were reused across multiple victims. The group spent thousands on AI tooling while leaving its own server completely unprotected. As SOCRadar's CISO Ensar Seker put it, an operation can have serious destructive capability while still making fundamental mistakes. This one certainly proves the point.