The n0n ransomware group targeted 23 organizations across 14 countries. It used AI tools alongside stolen credentials to steal, encrypt, and sometimes delete data. The group spent over $7,216 on AI services by October 22. Its workspace server was left publicly exposed in Sweden. Researchers found 1,719 files including attack scripts and ransomware source code. The group claimed 108 victims since its emergence last month. It demanded ransoms between $400,000 and $28 million from 38 maritime firms. None of those firms paid by the October 19 deadline. The operator reused hardcoded encryption keys across victims. It also changed firewall policies to block traffic in some cases. The group is believed to be based in Russia. Its tactics included RDP scanning and FortiGate SSL-VPN credential stuffing. It used an exposed AWS access key to steal data from 40 S3 buckets.
What changed
Attackers typically hid their methods and infrastructure from public view.
What it unlocks
Visibility into a live ransomware operation’s scripts, source code, and AI-assisted attack preparation.
- $7,216 spent on AI services by Oct 22
- 108 victims claimed since emergence
- 38 maritime organizations targeted in one batch
- $400,000 to $28M ransom demands
Sources