AI coding agent wrote n0n extortion group's scripts; every break-in used weak or stolen passwords

Security firm SOCRadar says an exposed server reveals how the n0n extortion group used an AI coding agent to write and debug hundreds of attack scripts, hitting at least 23 organisations in 14 countries between September and October 2026. Every documented break-in used weak, reused or stolen passwords, not software flaws. If you run FortiGate SSL-VPN, RDP or cloud access keys, enforce phishing-resistant multi-factor authentication and make sure your backups cannot be deleted by an attacker.

What happened, in plain English

n0n is a criminal group that breaks into organisations, copies their data, then encrypts or simply deletes files and backups and demands payment not to leak what it stole. SOCRadar has tracked it since September 2026.

On October 28, 2026, SOCRadar's Threat Research Unit (STRU) published research on a server the operator had left open to the internet. A basic file-sharing service on it exposed the operator's working folder: 1,719 files, including 829 scripts and the source code of the encryption tool, captured on September 25 and 26, 2026.

The files show the operator working with opencode, a free, open-source AI coding assistant of the kind developers use every day. The assistant was used to write and fix the scripts that run each step of an attack. It was connected to 154 AI model options from seven providers, including models whose safety training had been deliberately removed and one model the operator hosted itself. SOCRadar says the spending on these models passed $7,216 by October 22, 2026.

The interesting part is how they got in. SOCRadar found no exploited vulnerabilities at all. The group tried leaked and guessed passwords against 305 FortiGate SSL-VPN gateways (the remote-access entry point many companies use), plus weakly protected Remote Desktop and Windows remote-management logins, exposed Amazon Web Services (AWS) keys and reused hosting-portal sessions.

Think of it as a burglar who now has a tireless assistant to write lock-picking notes — but who still walks in through doors whose keys were left under the mat.

Are you affected? What to do now

SOCRadar links the server to at least 23 organisations across 14 countries and 15 sectors. Separately, n0n's leak site listed 93 victims as of October 19, 2026, including 38 maritime, port and logistics organisations added in one batch on October 12. A possible link between many of those and one maritime software supplier is reported by other researchers and is unconfirmed — SOCRadar says the supplier has not confirmed an incident.

You should care if your organisation exposes any of these to the internet: SSL-VPN portals (FortiGate in particular), Remote Desktop (RDP) or WinRM, firewall management interfaces, hosting control panels, or long-lived cloud access keys.

Checklist, in order:

• Require phishing-resistant multi-factor authentication (MFA) — such as passkeys or hardware security keys — on SSL-VPN, RDP and every admin portal. Passwords alone were enough in every case SOCRadar documented.
• Check VPN login logs for credential stuffing: many failed logins across many usernames, often from residential IP addresses that look like home internet users.
• Reset credentials that appear in infostealer logs or breach data, and stop reusing admin passwords across systems.
• Lock down firewall management: allow it only from known IP addresses, require MFA and approval for policy changes, and alert when an API (REST) token is created from an unfamiliar address. In one case the operator switched every firewall rule to "block".
• Replace long-lived cloud keys with short-lived roles, separate list/read/delete permissions, and turn on versioning and Object Lock for storage buckets. Alert on mass deletions.
• Keep at least one backup copy offline or immutable. n0n deletes Windows shadow copies, wipes free disk space and removes provider-hosted backups.
• Look for hidden admin accounts disguised as service accounts (SOCRadar lists names such as svc_upd and svc_reg) and for unexpected scheduled tasks running as SYSTEM.
• Hunt with the published indicators. SOCRadar's post lists IP addresses, domains, file hashes, ransom-note names (n0n_READ_ME.txt, .n0n extension) and roughly 55 Bitcoin addresses. Take them from the original source, not from coverage.
• Brief your managed service provider (MSP). n0n pressured victims by contacting their customers, MSPs and the media.

If your remote access already requires phishing-resistant MFA, your cloud keys are short-lived and your backups are immutable, there is nothing new to do beyond checking the indicators.

The expert view

Remove the AI and n0n is a familiar, rather unsophisticated extortion crew: valid-account access, browser credential and session-cookie theft, hidden local admins, per-victim exfiltration pipelines, then destruction. The locker itself is simple — AES-256-CBC with one hardcoded key per build and no per-victim key derivation. SOCRadar notes one key is likely shared by two victims, so a decryptor for one case might work for the other. Several victims saw data and backups deleted rather than encrypted, which makes recovery planning, not decryption, the real defence.

What the AI changes is labour. A general-purpose coding agent, not purpose-built "malicious AI", produced and debugged the glue code — wrapper scripts that stop databases, purge shadow copies and stage exfiltration across many targets in parallel. The model list is telling: a mix of mainstream providers, "abliterated" models with refusals stripped out, and a self-hosted model. That is a hedge against any single provider's safety controls or account bans, and it shows how cheap model access has become relative to ransom demands of 0.5 to 33 BTC per victim (up to $28M per organisation in the October port wave, per SOCRadar).

SOCRadar is explicit that this is "a human-directed operation supported by AI; no fully autonomous attack system was observed." That matches the pattern in other recent leaks of attacker infrastructure — including SOCRadar's own October 20 report on INC and The Gentlemen affiliates driving intrusions through the same opencode agent. The agent compresses effort and lets a small team work many victims at once; initial access still depends on weak identity controls. Credential stuffing against VPNs through residential proxies is years old and well understood. The defences against it are too.

Two more details deserve attention. First, the operator used destructive actions against network infrastructure itself — rewriting a provider's firewall policy and pushing a block rule — which shows why management-plane access needs the same protection as domain admin. Second, the extortion economics look weak so far: SOCRadar checked all 55 collected Bitcoin addresses on October 16, 2026 and found zero transactions.

What is still unknown: SOCRadar assesses with medium confidence that the exposed server belongs to a single operator or small team, while the wider framework suggests a multi-operator group. It gives no geographic attribution, and neither do we. The maritime supply-chain link is unverified. SOCRadar's report contains no statement from Fortinet, and nothing in its findings points to a Fortinet software flaw — the problem was passwords.

Official sources

• SOCRadar Threat Research Unit — "n0n Ransomware: Inside an AI-Assisted Extortion Operation" (October 28, 2026)
• SOCRadar whitepaper — "Automating Extortion: Inside an AI-Assisted n0n Ransomware Operation"
• SOCRadar — "INC and The Gentlemen Ransomware: Exposed AI Infrastructure" (October 20, 2026, updated October 23)