A staging server left open by an operator in the n0n extortion group has given researchers a detailed view of how its attacks work, from AI-written scripts to firewall sabotage. Despite all the talk of AI-discovered exploits, every breach SOCRadar documented began with a password that was weak, reused or already stolen.
What happened
On 14 October we covered n0n’s claim to have hit 38 shipping and logistics firms in a single leak-site batch, with UK firm BMT IQ among those named. Maritime security firm Cydome has since argued that much of that listing probably comes from one support archive linked to South Korean software vendor CyberLogitec, which has not confirmed an incident. This follow-up looks inside the operation itself.
SOCRadar’s Threat Research Unit published its analysis on 28 October, and The Register reported it with further comment from the firm on 30 October. The researchers found a Python HTTP file server on a Swedish IP address that was serving one operator’s working directory to anyone who connected. Snapshots from 25 and 26 September captured 1,719 files, including 829 scripts, C++ source for five encryptors and a configured AI coding agent.
From that material SOCRadar linked at least 23 organisations in 14 countries to this operator. Fifteen ended up on the leak site, four were compromised but never published, and four saw access attempts with no clear outcome. Those named or described range from sports retailer Fanatics, cloud host Dediserve, US managed service provider ChiBiTek and Dutch financial services firm Transcom to an ISP in Venezuela, a ministry in Argentina and a teachers’ union. Tracked activity ran from 17 September to 22 October.
The technical picture
The headline finding is that SOCRadar found no evidence of the operator exploiting any vulnerabilities. “In every documented compromise in this investigation, access relied on weak or stolen credentials,” SOCRadar CISO Ensar Seker told The Register. Entry points were familiar: credential stuffing, routed through residential proxies, against 305 FortiGate SSL-VPN appliances the operator had shortlisted, weak RDP and WinRM administrator passwords, long-lived AWS access keys left exposed, and hosting control panel sessions that could be reused.
After getting in, the operator followed a consistent routine. Hidden local administrator accounts named to look like services (svc_upd, svc_reg) supplied persistence, alongside SYSTEM scheduled tasks and a Run key that opens the ransom note at every logon. Endpoint protection was switched off. Browser password stores and live session cookies were stolen, including by copying administrators’ Chrome profiles and controlling them through the browser’s debugging interface. In one case MFA codes were simply read from a staff mailbox the attacker had already taken over. The toolkit also included scripts to copy the Active Directory database from a shadow copy.
The damage went beyond encryption. At Fanatics, according to SOCRadar’s findings as reported by The Register, one exposed AWS key with list, read and delete rights was used to pull data from 40 S3 buckets and then wipe data across a dozen, bank-transaction archives included. SOCRadar also reports that at the Venezuelan ISP, Inter, the operator flipped every firewall rule on its Cisco Firepower Management Center to block, and claimed to have cut national traffic. At Dediserve, according to SOCRadar, tenant backups were extracted. The locker itself is basic AES-256-CBC, built for Windows, Linux and PowerShell, with a separate OpenSSL step used on firewall appliances. Each build carries a single hardcoded key, and SOCRadar believes two victims may share one, which could make decryption possible.
The operator ran opencode, an open-source coding agent, configured with 154 model entries from seven providers. These spanned mainstream models, “uncensored” and abliterated versions without safety training, plus a self-hosted model. It produced and fixed hundreds of scripts for the intrusions, and the AI bill exceeded $7,216 by 22 October. SOCRadar is explicit that this was a human-directed operation using AI for support, not an autonomous attack system.
Why it matters for UK organisations
Nothing in this toolkit was exotic. FortiGate SSL-VPNs, internet-facing RDP, AWS access keys sitting in code or configuration, and hosting panels without strong MFA are all common across UK SMEs, managed service providers and the public sector. Several victims were themselves providers, including a cloud host and an MSP, and n0n deliberately puts pressure on a victim’s customers and suppliers. Its email to PayPal’s security team about the Transcom breach shows that. A UK firm can find itself named in an extortion campaign without its own network ever being touched.
The destructive element matters for recovery planning too. As Seker noted, deleted data and blocked traffic create a recovery problem that a decryption key alone cannot solve. That should change how UK boards think about paying. Data deleted from S3 or deleted provider-hosted backups cannot be bought back.
The AI angle is easy to misread. There is no sign this operator used AI to find zero-days. AI made a mediocre criminal productive, turning credential lists into hundreds of tailored scripts across dozens of targets for a few thousand dollars. Expect more volume, not cleverer intrusions.
Expert view
This report matches what I see on engagements far more closely than the current AI hype does. When we run external infrastructure tests, the quickest way into a network is still a VPN portal with no MFA, or an administrator account using a password that turns up in an infostealer log. The operator’s real edge was patience and automation, and both are now cheap to come by.
The firewall sabotage deserves more attention. Management planes for FortiManager, FMC and similar platforms are often reachable from wider networks than they should be, and policy changes rarely need a second person to approve them. Once an attacker controls the device you rely on for containment, your incident response options narrow very quickly.
Criminal opsec is often poor too: one open file server handed defenders a full playbook and indicators, and blue teams should use them.
What to do now
- Enforce phishing-resistant MFA on every remote access path: SSL-VPN, RDP gateways, WinRM, hosting and cloud consoles. Cyber Essentials already requires MFA on cloud services; extend it to all external admin interfaces.
- Hunt for credential stuffing against VPN logins. Review FortiGate authentication logs for high volumes of failures from residential IP ranges, and reset any credentials that appear in infostealer data.
- Remove long-lived cloud keys. Replace them with short-lived roles, split list, read and delete permissions, enable S3 Object Lock and versioning, and alert on bulk DeleteObjects calls.
- Lock down firewall management. Restrict FMC and FortiManager to dedicated management networks with allow-lists and MFA, and require approval for policy changes.
- Audit local administrator accounts for hidden or service-style names, and check scheduled tasks and Run keys against SOCRadar’s published indicators (Cyber Essentials user access control).
- Test offline, immutable backup restores on the assumption that an attacker will try to delete provider-hosted backups first.
Bottom line
n0n’s exposed workspace shows the current threat as it actually is: AI used to speed up commodity tooling, aimed at the oldest weakness of all. The defences are not new either. MFA everywhere, no standing cloud keys, a protected management plane and backups an attacker cannot reach would have stopped most of what this operator did.
Sources
- SOCRadar: n0n Ransomware: Inside an AI-Assisted Extortion Operation
- The Register: Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see
- Cydome: n0n cyber extortion incident involving 38 maritime companies likely traces back to a single vendor
- SOCRadar: n0n group global ports and shipping leak
