Ransomware crew used AI coding agent, then left its server open

A ransomware operation calling itself n0n used an open-source AI coding agent to help build its attack tooling, then left its own working server exposed on the public internet, threat intelligence firm SOCRadar said in research reported on 30 October 2026.

SOCRadar's threat hunters found the operator's workspace, a publicly accessible Python HTTP file server hosted in Sweden on port 8877, and documented the open directory in snapshots taken on 25 and 26 September 2026. "Across those snapshots, we identified 1,719 files, including attack scripts, ransomware source code, extortion infrastructure, and an AI coding agent environment," said Ensar Seker, chief information security officer at SOCRadar. He said the find gave researchers visibility into how the operator prepared attacks and handled stolen data.

According to SOCRadar, the gang attempted to break into 23 organisations across 14 countries. The AI element was OpenCode, an open-source coding agent, configured with 154 model entries across seven providers. The listed models included Gemini, Mistral, Nemotron, Llama, Claude, GPT-5.x, Grok, Kimi, GLM, DeepSeek, MiniMax and Qwen, among others, with some stripped of safety training and others marketed as "uncensored". The operator had run up more than $7,216 in AI usage costs by 22 October.

Seker said the agent was used to write and debug hundreds of scripts, which "shows how AI can help an attacker turn basic access into a broader, tailored operation". SOCRadar found no evidence of a fully autonomous attack system, and no evidence of any software vulnerability being exploited. "In every documented compromise in this investigation, access relied on weak or stolen credentials," Seker said.

The entry methods were conventional. The group scanned widely for exposed Remote Desktop Protocol services and ran automated credential stuffing against FortiGate SSL-VPN portals. To reach ChiBiTek, a US managed services provider, the crew used a 15-thread residential SOCKS5 proxy pool to test credential combinations against FortiGate login pages, SOCRadar said. In a case linked to e-commerce site Fanatics, the researchers said n0n used an exposed AWS access key with permissions to list, read and delete objects, pulling data from 40 S3 storage buckets of up to 110 GB each before deleting records including bank-transaction archives and purging keys across 12 buckets.

Seker said the destruction was as notable as the AI use. In some cases the operator deleted data and backups, and in one case changed firewall policies to block traffic. "That creates a recovery problem that a decryption key alone cannot solve," he said.

The group has claimed 108 victims since it emerged last month. On 12 October it added 38 maritime, port and logistics organisations across 18 countries to its leak site in a single batch. Researchers have linked at least 21 of them to customers of South Korean maritime software provider CyberLogitec, which has not confirmed an intrusion. Ransom demands for the maritime firms ranged from $400,000 to $28 million in Bitcoin, with a 19 October deadline. None of the 38 listings were marked settled, no payment addresses showed transactions, and all the stolen data was published.

SOCRadar attributed the server to a single operator or small team and said the group is believed to be based in Russia, though the exposed files offered no definitive attribution. The firm rates the gang 10 out of 10 for aggressiveness and zero out of 10 for lethality.