n0n ransomware gang used AI coding agent in extortion spree, exposed own server

A ransomware group called n0n used an open-source AI coding agent (OpenCode) alongside stolen credentials to breach dozens of organizations worldwide, spending over $7,000 on AI usage; researchers found the gang's own command server exposed online, revealing its tooling, scripts and victim data.

Disclosed 25 September 2026 · Record updated 30 October 2026

Impact

At least 108 organizations across multiple countries and sectors (including maritime/logistics, e-commerce and financial services) had data stolen, encrypted, or destroyed; some backups were wiped, eliminating recovery options.

Our coverage

Incidents

Ransomware crew used AI coding agent, then left its server open

SOCRadar says the n0n gang spent more than $7,200 on AI models to script attacks, but got in using stolen passwords, not exploits.

30 Oct 2026

Sources

theregister.comhttps://theregister.com/security/2026/10/30/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see/5306754