Crim Spent $7K+ on AI Services in Extortion Attacks, Then Left Evidence for All to See
The Register, Friday, October 30th, 2026
An n0n ransomware operator spent over $7,000 on AI services and targeted 23 organizations, but left its server exposed, and no bugs were exploited.
The n0n ransomware group tried to breach 23 organizations in 14 countries but left its own server exposed with its methods visible.
It used AI-assisted tooling alongside stolen credentials, and in some cases stole and encrypted files and also deleted data and backups.
SOCRadar's Ensar Seker said every documented compromise relied on weak or stolen credentials and found no evidence of vulnerability exploitation.
The gang gained access through widespread RDP scanning and automated FortiGate SSL-VPN credential stuffing.