AI Wrote This Ransomware Crew’s Tools. Stolen Passwords Got It In.

Estimated reading time: 7 minutes

AI-built ransomware is one of the most talked-about fears in cyber risk. SOCRadar’s researchers found a working example with the lights on and published what they saw. The AI wrote the tools. Weak and stolen passwords opened every door SOCRadar could trace.

Credit to SOCRadar‘s Threat Research Unit. In September, it found a server left open by an operator tied to the n0n ransomware group. The server held the crew’s live workspace, AI coding agent included.

SOCRadar captured it twice, on Sept. 25 and 26. It published a 58-page report this month. SOCRadar sells threat intelligence. Its full list of indicators sits on its platform.

The report rewards a full read. Here is what stood out to us about AI ransomware in practice.

What SOCRadar Found Inside An AI Ransomware Workspace

The server held 1,719 files. They included 829 attack scripts and the source code for five versions of the group’s encryption program.

The files tied the operator to at least 23 organizations in 14 countries. Fifteen later appeared on n0n’s leak site. Four more were compromised but not published. The rest showed access attempts with no outcome.

The report names the victims. They include a US sports retailer, a cloud host, and a New York teachers’ union. A Venezuelan internet provider and an Argentine ministry are also on the list. None has publicly confirmed an attack, as far as we can find.

The group runs well beyond this one server. By Oct. 19, its leak site listed 93 victims with ransom demands totaling $283.7 million.

The leak site carries five entries marked “HONORED – data destroyed.” That is the crew’s label for victims who paid. The entries are anonymous. One appears to be an internal test. Another is a US company the site had named earlier.

SOCRadar could not confirm a single payment. It checked the 55 ransom addresses it had collected. None showed any transaction as of Oct. 16. We checked all 55 again on Oct. 28, using public blockchain records. None had received any bitcoin.

That does not settle the question. The crew gives each victim its own bitcoin address. SOCRadar did not have one for every victim. The report offers two explanations. Payments may have gone to addresses SOCRadar never collected. Or the records may be deceptive. The report does not choose between them.

The AI Wrote The Code. A Human Ran The Operation.

The operator used opencode, an open-source AI coding agent. It was set up with 154 models from seven providers. They included commercial models and models sold as “uncensored.” One had its safety training removed. Another ran on a rented server.

The agent wrote and debugged hundreds of attack scripts. It fixed bugs in the crew’s own tools. It even kept the encryption keys in its memory file.

The bill was small. Spending on the AI services passed $7,216 by Oct. 22, SOCRadar found. Most of it went to the models without safety limits.

SOCRadar draws a careful line. The evidence points to a human-directed operation supported by AI, the report says. It found no fully autonomous attack system.

Every Known Way In Used A Password

SOCRadar found no exploit code in the crew’s files. “No vulnerability exploitation was identified,” the report says. Every compromise it could trace relied on weak or stolen credentials. Three more targets, all cloud databases, sat in a folder the crew labeled “0-day.” No exploit code turned up there either. How the crew got in is unknown.

The biggest pipeline tested stolen passwords against 305 FortiGate SSL-VPN gateways, routed through residential proxies. Others used weak remote desktop passwords and a long-lived Amazon Web Services key.

At the cloud host, the crew started with admin logins stolen from the browser on an infected Windows computer. It got past MFA by reading login codes from a staff mailbox it controlled. Codes sent by email were the weak point. That is the gap phishing-resistant MFA is built to close.

The pattern matches what we heard from Bitdefender this week. Its incident responders say attackers mostly log in with stolen credentials. Cisco Talos says AI is finding software flaws at a record pace. In every case SOCRadar traced, this crew skipped the flaws and used the passwords.

Destruction Changes The Ransom Math

Encryption was only one of n0n’s tools. Deletion was another. At the sports retailer, an exposed AWS key had rights to list, read, and delete storage. The crew copied data from 40 storage buckets. It then deleted a bank-transaction archive and twelve buckets, claiming its copy was the only complete one left. The demand was 30 bitcoin, about $2.43 million, SOCRadar reported.

At the cloud host, the crew claims to have wiped 46 servers and their backups. Its note told the victim, “the only restore path is the disk images we hold.”

At the Venezuelan internet provider, the crew used the victim’s own firewall manager. It switched every access rule to block and claimed to cut national network traffic.

For an insurer, destroyed data changes the claim. A ransom payment buys back nothing that was deleted. Recovery then rests on backups the crew could not reach.

Pressure Beyond The Victim

n0n’s extortion messages target more than the victim. Countdown warnings go to union leadership, managed service providers, clients, and the media, SOCRadar found. In one case, the crew emailed the security team of a major payments company. The breached data sat with one of its contact-center providers.

The crew’s own messaging works the regulatory clock. Once files leak, it tells victims, “notification obligations typically apply from this point.”

The crew also set hard terms. Victims had to pay 10% of the ransom just to open a negotiation portal. They paid before they could inspect what was stolen. In October, the crew dropped negotiation entirely. Victims had to pay in full before a countdown ran out. Otherwise, their data was published automatically.

One October listing named 38 maritime, port, and logistics companies at once. Demands ran from $0.4 million to $28 million per company. SOCRadar puts the batch total at $275.8 million. That is most of the $283.7 million on the leak site.

The crew gave the companies seven days to pay, until Oct. 19. None of the 38 was marked as settled, SOCRadar found. All were then published.

None had confirmed an attack, The Maritime Executive reported. SOCRadar linked at least 21 to customers of one maritime software provider. That link is unverified. The provider has not confirmed an incident. One listing reused another victim’s sample file. Most of the $283.7 million rests on listings no one has confirmed.

What Cyber Insurance Underwriters Can Take From The n0n Report

SOCRadar’s recommendations read like an application checklist:

• Phishing-resistant MFA on VPNs, remote desktop and admin portals.
• Short-lived cloud credentials in place of long-lived keys, with no single account able to list, read, and delete storage.
• Object Lock, versioning and alerts on mass deletions.
• Offline or immutable backups.
• Firewall management consoles locked to approved addresses and MFA.

The crew also made mistakes. It left its workshop open to the internet. Its encryption program used one hardcoded key per build. One key appears to be shared by two victims. That could let one victim’s decryptor unlock another’s files, the report says.

That is the takeaway we keep coming back to. The tools were new and cheap. The way in was the oldest one there is.

FAQ – AI Ransomware

What is n0n ransomware?

A data-theft and destructive extortion group tracked since September 2026. By Oct. 19, its leak site listed 93 victims and $283.7 million in ransom demands.

How did n0n use AI?

An open-source AI coding agent wrote and debugged hundreds of attack scripts. SOCRadar counted more than $7,216 in AI spending. It found a human-directed operation and no autonomous attack system.

How did n0n get into networks?

With weak or stolen credentials in every documented case. SOCRadar found no software vulnerabilities exploited. Entry points included FortiGate VPN logins, remote desktop passwords and an exposed cloud key.

Does paying n0n restore data?

Not always. In some cases, the group copied data, then deleted the originals. A payment cannot restore data the attackers destroyed.

Did any n0n victims pay?

It is unclear. The leak site shows five entries marked “honored,” the crew’s label for paid. SOCRadar found no transactions on the 55 ransom addresses it collected as of Oct. 16, 2026. A Cyber Insurance News check on Oct. 28 found none either. SOCRadar did not have an address for every victim.

What controls does SOCRadar recommend?

Phishing-resistant MFA on remote access, short-lived cloud credentials, split storage delete rights, Object Lock, immutable backups and locked-down firewall management.

Related Cyber Insurance Posts

• Most Former Employees Say Their Work Access Outlived The Job. Insurers Have Started Asking.
• Arch Insurance Adds Cyber Extension For Event Cancellation Losses(Opens in a new browser tab)
• Cyber Insurance Losses Rise As Prices Keep Falling, NAIC Report Shows(Opens in a new browser tab)
• Commvault Expands Google Cloud Collaboration For Cyber Resilience(Opens in a new browser tab)