# N0n ransomware group spends $7K on AI tools, then leaves its own server wide open > Source: > Published: 2026-10-30 19:42:39+00:00 # N0n ransomware group spends $7K on AI tools, then leaves its own server wide open Photo: panumas nikhomkhai / Pexels A SOCRadar investigation found the extortion crew's staging server exposed, revealing attack scripts, encryptor source code and an AI coding setup A ransomware crew that tried to break into 23 organizations across 14 countries forgot one small detail: locking its own door. The n0n extortion group left a staging server exposed online, putting its tools, scripts and methods on display for anyone who looked. The find matters because it gives defenders a rare inside look at a modern ransomware operation. That operation pairs paid AI services with one of the oldest tricks in the book: logging in with stolen passwords. ## What was sitting on the server SOCRadar’s Threat Research Unit found the server in late September 2026. It held 1,719 files. Of those, 829 were attack scripts. The server also stored source code for five versions of a custom encryptor, the program that scrambles victims’ files so they can’t be opened without a key. Researchers also found configuration details for an AI coding agent called opencode. The setup drew on 154 models from a range of providers. The group’s AI spending was not trivial. By mid-to-late October, n0n had racked up more than $7,216 in API usage on large language model services. ## Old-school break-ins with a new-school assistant For all the AI tooling, the way n0n got through the door was strikingly conventional. Its initial access leaned on credentials, not zero-day exploits. The group scanned widely for exposed Remote Desktop Protocol (RDP) services, which let people control a computer remotely. It also ran automated credential stuffing against FortiGate SSL-VPN appliances. Credential stuffing means taking leaked username and password pairs and trying them on a different system at machine speed. SOCRadar’s findings show n0n targeted 305 FortiGate SSL-VPN appliances this way, exploiting weak passwords and compromised logins. ### AI, tech, and the markets they move—in one daily briefing. Daily. Free. Join 34,000+ readers across crypto, finance, and policy. Once inside, the crew did more than steal and encrypt. In some cases, it also deleted data and backups, wiping out victims’ ability to restore their own information. ## A leak site with big numbers and no confirmed payouts N0n emerged in September 2026 and has claimed attacks across logistics, healthcare and government. As of mid-October, the group’s Tor leak site listed 93 victims. Ransom demands across those listings totaled $283.7 million. Individual demands ranged from approximately $2.4 million to as much as $25 million per victim. There is a gap worth noting. The leak site lists 93 victims, while the confirmed count of targeted organizations stands at 23 across 14 countries. There have been no confirmed ransom payments to n0n so far. ## Why this matters beyond one sloppy crew The most useful takeaway for defenders is how little the AI layer changed the front end of the attack. N0n reportedly spent thousands on AI services, yet still got in by trying passwords on internet-facing VPNs and remote desktop services. The AI component appears to sit behind the door, not in front of it. A coding agent wired into 154 models suggests a crew using AI to write, adjust and manage its tooling at scale, which may help explain how a group could generate 829 attack scripts. The backup deletion is the other detail organizations should take seriously. Many companies treat backups as their ransomware insurance policy. If attackers specifically hunt for and destroy those copies, backups need to be isolated from the main network to keep that insurance valid. For the sectors n0n has claimed to hit, the exposure is uneven. A logistics firm losing data is disruptive. A healthcare provider losing records and the backups behind them is a far more serious problem, both operationally and for the patients involved. ## What to watch next The exposed server hands researchers a detailed map of n0n’s methods, including five iterations of its encryptor. The other thing to track is whether any of those multimillion-dollar demands turn into confirmed payments. Until then, n0n’s headline figure is a claim from a group that just proved it can’t reliably secure its own infrastructure. For organizations running FortiGate SSL-VPN gear or exposed RDP services, the lesson is less about AI and more about hygiene. The attackers paid for cutting-edge tools. Their entry ticket was still a password someone failed to protect. **Disclosure:** This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our [Editorial Policy](https://cryptobriefing.com/editorial-policy/). ## More in Technology [See all](https://cryptobriefing.com/tech/)