In September 2026, an exposed staging server revealed the complete operational workspace of a n0n ransomware operator, including breach tools, encryptor source code, extortion infrastructure, and an AI coding agent environment with over $7,000 in paid LLM API usage. The investigation identified at least 23 victim organizations across 14 countries spanning multiple sectors. Every documented compromise relied exclusively on weak or stolen credentials, with no vulnerability exploitation observed. The operation combines data exfiltration with either encryption or complete data destruction, including backup deletion. The operator leveraged an AI coding agent configured with 154 models to generate hundreds of attack scripts, demonstrating human-directed operations augmented by artificial intelligence. By October 2026, n0n had listed 93 victims with combined ransom demands totaling $283.7 million, using credential stuffing against FortiGate SSL-VPN devices, exposed cloud keys, and compromised management portals a...
