Ransomware Gang Spent Thousands on AI, Yet Broke In Through Weak and Stolen Passwords

Researchers at threat intelligence firm SOCRadar have detailed the activity of a ransomware operator known as n0n, which tried to break into 23 organisations across 14 countries. The group left its own server exposed, giving investigators a view of its methods. It reportedly ran up more than $7,216 in AI usage costs by October 22, using AI to assist with its intrusions. Researchers did not find evidence of a fully autonomous attack system.

Despite the focus on AI-driven exploit development, SOCRadar found no evidence that the gang exploited a single software vulnerability. In every documented case, access relied on weak or stolen credentials. The group used widespread scanning of Remote Desktop Protocol (RDP) services and automated credential stuffing against FortiGate SSL-VPN portals. It also used exposed cloud credentials and reused hosting portal sessions. In one case linked to e-commerce site Fanatics, an exposed AWS access key allowed the criminals to pull data from 40 S3 storage buckets, then delete data and purge keys across 12 sensitive buckets.

The damage went beyond theft and encryption. In some cases the attackers also deleted data and backups, removing victims' ability to recover. SOCRadar's Ensar Seker noted that the notable feature was the mix of AI-assisted development with very conventional entry points.