--- title: Crim spent $7K+ on AI services in extortion attacks,... description: A ransomware group called n0n tried to break into 23 organizations across 14 countries using stolen or weak credentials, not software exploits. The operator... canonical: https://daily.dev/posts/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see-xkt70klbi twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see | daily.dev og:description: A ransomware group called n0n tried to break into 23 organizations across 14 countries using stolen or weak credentials, not software exploits. The operator... og:url: https://daily.dev/posts/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see-xkt70klbi og:image: https://api.daily.dev/og/posts/xKt70KlbI.png og:image:alt: Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see **[The Register](https://daily.dev/sources/theregister)** · 6 min read · 0 upvotes · 0 comments ## Summary A ransomware group called n0n tried to break into 23 organizations across 14 countries using stolen or weak credentials, not software exploits. The operator spent over $7,216 on AI services by October 22, using the open-source coding agent OpenCode configured with 154 model entries across seven providers to write and debug attack scripts. Researchers at SOCRadar found the group's own workspace exposed on a server in Sweden, revealing 1,719 files including ransomware source code and hardcoded encryption keys reused across victims. In one case, an exposed AWS key let the group pull data from 40 S3 buckets, and the group purged keys across 12 sensitive buckets. The group has claimed 108 victims and demanded ransoms from $400,000 to $28 million in one batch. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did the n0n ransomware group gain access to victim networks? Access relied entirely on weak or stolen credentials, not software exploits. The group used widespread RDP scanning and automated FortiGate SSL-VPN credential stuffing, including a 15-thread residential SOCKS5 proxy pool to test credentials against FortiGate login portals. In other cases it used exposed cloud credentials and reused hosting portal sessions, such as an exposed AWS access key used to raid S3 buckets. _Teams hardening VPN and cloud credential hygiene can track emerging attack patterns like this on daily.dev._ ### What AI coding tool was used by the n0n ransomware operator? The operator used OpenCode, an open-source AI coding agent, configured with 154 model entries across seven providers including Gemini, Mistral, Claude, GPT-5.x, Grok, and DeepSeek, some with safety training removed or marketed as uncensored. The AI was used to write and debug hundreds of attack scripts, costing more than $7,216 by October 22. _Developers tracking how AI coding agents get misused follow incidents like this on daily.dev._ ### How much ransom did the n0n group demand from maritime companies it attacked? The group demanded between $400,000 and $28 million in Bitcoin from 38 maritime, port and logistics organizations added to its leak site in a single batch on October 12. After the October 19 deadline passed with no payments detected on-chain, all of the affected organizations' stolen data was published. _Security teams assessing extortion risk in their supply chain can follow cases like this on daily.dev._ ## Similar posts on daily.dev - [I Asked 100 Agents to Hack Me](https://daily.dev/posts/i-asked-100-agents-to-hack-me-wrbcfxglt) · Tech Lead Digest · 1 upvotes · 0 comments - [Ship Fast, Leak Faster: Securing AI Agents before they cost you millions](https://daily.dev/posts/ship-fast-leak-faster-securing-ai-agents-before-they-cost-you-millions-t5kqfz2gr) · Softbinator · 0 upvotes · 0 comments - [South Africa’s fraud problem is persuasion, not hacking](https://daily.dev/posts/south-africa-s-fraud-problem-is-persuasion-not-hacking-ktyviae0s) · TechCentral · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#ransomware](https://daily.dev/tags/ransomware), [#aws-s3](https://daily.dev/tags/aws-s3), [#opencode](https://daily.dev/tags/opencode) [View this post on daily.dev](https://daily.dev/posts/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see-xkt70klbi) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see","url":"https://daily.dev/posts/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see-xkt70klbi","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see-xkt70klbi"},"datePublished":"2026-10-30T19:40:03.906Z","dateModified":"2026-10-30T19:40:34.121Z","description":"A ransomware group called n0n tried to break into 23 organizations across 14 countries using stolen or weak credentials, not software exploits. The operator...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/49412d3401b757ac68ec1b7879a5e403?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/49412d3401b757ac68ec1b7879a5e403?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see-xkt70klbi","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,ransomware,aws-s3,opencode","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see-xkt70klbi#faq","mainEntity":[{"@type":"Question","name":"How did the n0n ransomware group gain access to victim networks?","acceptedAnswer":{"@type":"Answer","text":"Access relied entirely on weak or stolen credentials, not software exploits. The group used widespread RDP scanning and automated FortiGate SSL-VPN credential stuffing, including a 15-thread residential SOCKS5 proxy pool to test credentials against FortiGate login portals. In other cases it used exposed cloud credentials and reused hosting portal sessions, such as an exposed AWS access key used to raid S3 buckets. Teams hardening VPN and cloud credential hygiene can track emerging attack patterns like this on daily.dev."}},{"@type":"Question","name":"What AI coding tool was used by the n0n ransomware operator?","acceptedAnswer":{"@type":"Answer","text":"The operator used OpenCode, an open-source AI coding agent, configured with 154 model entries across seven providers including Gemini, Mistral, Claude, GPT-5.x, Grok, and DeepSeek, some with safety training removed or marketed as uncensored. The AI was used to write and debug hundreds of attack scripts, costing more than $7,216 by October 22. Developers tracking how AI coding agents get misused follow incidents like this on daily.dev."}},{"@type":"Question","name":"How much ransom did the n0n group demand from maritime companies it attacked?","acceptedAnswer":{"@type":"Answer","text":"The group demanded between $400,000 and $28 million in Bitcoin from 38 maritime, port and logistics organizations added to its leak site in a single batch on October 12. After the October 19 deadline passed with no payments detected on-chain, all of the affected organizations' stolen data was published. Security teams assessing extortion risk in their supply chain can follow cases like this on daily.dev."}}]} ```