Threat Intelligence

Exposed Server Reveals How n0n Ransomware Used AI and Stolen Passwords to Hit 23 Organisations

SOCRadar · 28 Oct 2026

Key Takeaway Because this operation succeeded using only weak or stolen passwords, enforce unique strong passwords and multi-factor authentication on every business account, and keep offline backups that attackers cannot reach.

SOCRadar's Threat Research Unit says it discovered an exposed server holding the live workspace of an operator linked to the n0n ransomware group. The open directory contained breach and data theft tooling, the original locker source code, extortion infrastructure, and an AI coding agent environment backed by more than $7,000 in paid AI usage. The findings implicate at least 23 organisations across 14 countries, including a US sports retailer, a cloud provider, a teachers' union, a Venezuelan internet provider, an Argentine ministry and a pharmaceutical subsidiary.

Notably, researchers identified no vulnerability exploitation. Every documented compromise relied on weak or stolen credentials. Where n0n does not encrypt files, it destroys data and backups after stealing them. The group has scaled quickly: on 12 October 2026 it listed 38 maritime, port and logistics organisations across 18 countries on its dark web leak site in one batch. Research linked at least 21 of them to customers of South Korean software provider CyberLogitec, though the company has not confirmed an incident and the supply-chain link remains unverified. None of the listings was marked as settled after the 19 October deadline.

The exposed files show a segmented setup, with separate systems for the AI agent and control panel, the leak site and Bitcoin wallet generation, stolen data storage, and distribution of leaked data via torrents.

ransomware n0n AI credential theft data extortion

Summarised by CISO AI from SOCRadar, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.