n0n Ransomware: Inside an AI-Assisted Extortion Operation

In September 2026, an exposed staging server revealed the complete operational workspace of a n0n ransomware operator, including breach tools, encryptor source code, extortion infrastructure, and an AI coding agent environment with over $7,000 in paid LLM API usage. The investigation identified at least 23 victim organizations across 14 countries spanning multiple sectors. Every documented compromise relied exclusively on weak or stolen credentials, with no vulnerability exploitation observed. The operation combines data exfiltration with either encryption or complete data destruction, including backup deletion. The operator leveraged an AI coding agent configured with 154 models to generate hundreds of attack scripts, demonstrating human-directed operations augmented by artificial intelligence. By October 2026, n0n had listed 93 victims with combined ransom demands totaling $283.7 million, using credential stuffing against FortiGate SSL-VPN devices, exposed cloud keys, and compromised management portals a...

• Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress ExploitationCampaign2026-09-22
• Recent AI-Assisted Cyber Attacks in Japan: Investigating Attack Infrastructure and TechniquesCampaign2026-10-21
• Inside a Global AI-Assisted Hacking CampaignMalware2026-10-22
• Akira Ransomware Attack InvestigationMalware2026-10-07
• TASK#STOMP PowerShell Backdoor Steals Business Documents and Maintains Persistent Remote AccessMalware2026-09-24