Ransomware Operator n0n Spent Over $7,200 on AI Tools in Extortion Attacks

The Register reports that a n0n ransomware operator spent more than $7,216 on AI services while attempting to breach 23 organizations across 14 countries. Researchers at SOCRadar found no evidence that the operator exploited software vulnerabilities, with access instead relying on weak or stolen credentials, exposed cloud credentials, and reused hosting sessions.

The operator used OpenCode with 154 model entries across seven providers to write and debug hundreds of scripts. The configured models included Gemini, Mistral, Llama, Claude, GPT-5.x, Grok, DeepSeek, Qwen, and others. Researchers found no evidence of a fully autonomous attack system.

SOCRadar discovered the operator's publicly accessible server in Sweden and recorded 1,719 files, including attack scripts, ransomware source code, extortion infrastructure, and the AI coding environment. The attacks involved data theft, encryption, deletion of data and backups, and changes to firewall policies. The exposed files also contained hardcoded encryption keys that may have been reused across victims.