As cited
Copy frozen at (site build).
ransomware
Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see
The n0n ransomware group attempted to breach 23 organizations across 14 countries using stolen credentials, remote desktop scanning, and credential stuffing, spending over $7,216 on artificial intelligence (AI) services to develop attack scripts. The operator exposed its Swedish-hosted server containing 1,719 files revealing attack methods, ransomware source code, and AI coding environments. Despite claiming 108 victims since emerging in September, the gang deployed destructive tactics including data deletion and backup destruction alongside encryption, yet failed to exploit any vulnerabilities to gain initial access.
Why it matters: Organizations relying on weak or default credentials, exposed cloud keys, and unpatched remote access portals face immediate compromise risk from this active group; practitioners should audit credential hygiene, cloud access controls, and FortiGate SSL-virtual private network (VPN) security as the group demonstrates these are sufficient for large-scale extortion operations.
- Source published
- First seen by Cybersecurity Tracker