一个名为n0n的勒索软件团伙试图入侵14个国家的23个组织，但自己却没能守住大门，导致服务器暴露，其所有作案手法一览无余。这些罪犯在数据窃取狂潮中结合使用了新工具（人工智能）和旧工具（被盗凭证），在某些情况下，他们不仅窃取和加密文件，还删除了数据和备份，剥夺了受害者恢复信息的能力。尽管人们对“泄密末日”充满恐惧和炒作，担心人工智能会发现并开发针对影响全球大多数组织的重大漏洞的利用程序，但这些歹徒甚至没有利用单个漏洞来进入任何受害者的IT环境。
A n0n ransomware operator tried to break into 23 organizations across 14 countries, but couldn't secure its own front door, leaving its server exposed with all of its methods on view. The criminals used a mix of new (AI) and old (stolen credentials) tooling during their data-theft spree, and in some cases not only stole and encrypted files, but also deleted data and backups, eliminating victims’ ability to recover their information. And despite the fear and hype around the breachpocalypse, with AI finding and developing exploits for critical vulnerabilities affecting most organizations across the globe, these crooks did not exploit a single bug to gain entry into any of their victims’ IT environments.
威胁情报公司SOCRadar的首席信息安全官恩萨尔·塞克（Ensar Seker）表示：“在此次调查记录的每一次入侵中，访问权限都依赖于薄弱或被盗的凭证。”塞克告诉《The 》，引人注目的是人工智能辅助开发与非常传统的切入点的结合。“我们在所审查的案例中没有发现漏洞利用的证据。”
“In every documented compromise in this investigation, access relied on weak or stolen credentials,” said Ensar Seker, chief information security officer of threat intelligence firm SOCRadar. “What stands out is the combination of AI-assisted development and very conventional entry points,” Seker told The. “We found no evidence of vulnerability exploitation in the cases examined.”
该团伙利用广泛的远程桌面协议（RDP）扫描和自动化的FortiGate SSL-VPN凭证填充（credential stuffing），大规模入侵各个组织。为了访问总部位于美国的IT托管服务提供商ChiBiTek，该团伙使用了一个15线程的住宅SOCKS5代理池，在FortiGate门户网站（GET /remote/）上测试凭证（IP:端口：用户名：密码）。
The gang breaks into organizations at scale using widespread Remote Desktop Protocol (RDP) scanning and automated FortiGate SSL-VPN credential stuffing. To access US-based IT managed services provider ChiBiTek, the crew used a 15-thread residential SOCKS5 proxy pool to test credentials (ip:port:user:password) against FortiGate portals (GET /remote/).
运营者还通过暴露的云凭证和重复使用的托管门户会话进入系统。在一个与电子商务网站Fanatics有关的案例中，SOCRadar发现，n0n使用了一个暴露的AWS访问密钥，该密钥具有列出、读取和删除S3存储桶中对象的权限。然后，罪犯使用该密钥从40个S3存储桶中提取数据，每个存储桶的数据量高达110 GB，并最终删除了包括银行交易档案在内的数据，同时清除了12个敏感存储桶中的密钥。
The operators also gained entry using exposed cloud credentials and reused hosting portal sessions. In one case linked to e-commerce site Fanatics, SOCRadar found that n0n used an exposed AWS access key with permissions to list, read, and delete objects in S3 buckets. The criminals then used this key to pull data from 40 S3 buckets, with up to 110 GB per bucket, and ultimately deleted data, including bank-transaction archives, and purged keys across 12 sensitive buckets.
AI辅助勒索 虽然威胁猎手未发现完全自主攻击系统的证据，但勒索软件运营者确实利用AI协助实施这些入侵，截至10月22日产生了超过7216美元的AI使用费用。具体而言：犯罪分子使用了OpenCode这一开源AI编码代理，配置了跨越七家供应商的154个模型条目。模型包括Gemini、Mistral、Nemotron、Llama、Claude、GPT-5.x、Grok、Kimi、GLM、DeepSeek、MiniMax、Qwen以及许多其他模型，其中一些移除了安全训练，另一些则被宣传为“无审查”模型。
AI-assisted extortion While the threat hunters didn’t find any evidence of a fully autonomous attack system, the ransomware operator did use AI to assist with these intrusions, incurring more than $7,216 in AI usage costs by October 22. Specifically: the criminal or criminals used OpenCode, an open-source AI coding agent, configured with 154 model entries across seven providers. Models included Gemini, Mistral, Nemotron, Llama, Claude, GPT-5.x, Grok, Kimi, GLM, DeepSeek, MiniMax, Qwen, and many, many others, some with safety training removed and others marketed as “uncensored” models.
“运营者利用AI编写和调试了数百个脚本。这表明AI如何帮助攻击者将基础访问权限转化为更广泛、量身定制的行动，”Seker表示。他补充道：“破坏性行为同样意义重大。运营者不仅窃取和加密文件：在某些情况下，它删除了数据和备份，在一个案例中更改了防火墙策略以阻断流量。这造成了仅靠解密密钥无法解决的恢复问题。”
“The operator used AI to write and debug hundreds of scripts. That shows how AI can help an attacker turn basic access into a broader, tailored operation,” Seker said. “The destructive behavior is equally significant,” he added.
SOCRadar的威胁猎手上月发现了运营者的工作空间——一个托管在瑞典、IP为185.157.161[.]148、端口8877的公开可访问Python HTTP文件服务器，并在9月25日和26日通过快照记录了暴露的目录。 “在这些快照中，我们识别出1719个文件，包括攻击脚本、勒索软件源代码、勒索基础设施和AI编码代理环境，”Seker说。
“The operator did more than steal and encrypt files: in some cases, it deleted data and backups, and in one case changed firewall policies to block traffic. That creates a recovery problem that a decryption key alone cannot solve.”SOCRadar’s threat hunters found the operator’s workspace - a publicly accessible Python HTTP file server hosted in Sweden at 185.157.161[.]148 on port 8877 - last month, and documented the exposed directory in snapshots on September 25 and 26.
“这让我们得以窥见受害者名单背后的运作，包括运营者如何准备攻击和处理窃取的数据。” 认识n0n 这也让我们近距离观察了n0n，这个数据窃取和勒索领域的新来者自上月出现以来已声称拥有108名受害者。10月12日，该组织一次性在其泄露网站上新增了跨越18个国家的38家海事、港口和物流组织。
“Across those snapshots, we identified 1,719 files, including attack scripts, ransomware source code, extortion infrastructure, and an AI coding agent environment,” Seker said. “This gave us visibility into the operation behind the victim listings, including how the operator prepared attacks and handled stolen data.”Meet n0n It also provided a close look at n0n, a newcomer to the data-theft and extortion game that has claimed 108 victims since it emerged last month.
研究人员已将其中至少21起事件与韩国海事软件供应商CyberLogitec的客户联系起来，尽管这家软件供应商尚未证实遭到入侵。这群罪犯为这些海事企业设定了10月19日的最后期限，勒索金额从40万美元到2800万美元不等，需以比特币支付。然而，在最后期限过后，38个被列出的对象中没有一个被标记为“已解决”，并且其支付地址均未显示任何交易。
On October 12, the group added 38 maritime, port and logistics organizations across 18 countries to its leak site in a single batch. Researchers have linked at least 21 of them to customers of South Korean maritime software provider CyberLogitec, although the software provider has not confirmed an intrusion. The crooks set an October 19 deadline for the maritime firms, with ransom demands ranging from $400,000 to $28 million, payable in Bitcoin.
所有受影响机构被盗的数据均被公布。尽管该团伙声称的少数受害者在n0n的泄密网站上被标记为“已兑现——数据已销毁”，表明受害机构支付了勒索赎金，但SOCRadar并未在链上验证任何交易。在其个人资料详情中，这家安全机构对该团伙的“侵略性”评分为10分（满分10分），对“杀伤力”评分为0分（满分10分）。据信该组织总部位于俄罗斯，尽管SOCRadar发现并将其归属于某个单一运营商或小型团队的服务器并未提供任何确切的地理或国家归属信息。
After the deadline, however, none of the 38 listings were marked “settled” and none of their payment addresses showed any transaction. All affected organizations’ stolen data was published. While a handful of the gang’s claimed victims have been marked “honored - data destroyed” on n0n’s leak site, indicating the victim orgs paid the ransom demand, SOCRadar hasn’t validated any transactions on-chain. In its profile details, the security shop rates the gang a 10 out of 10 for "aggressiveness" and a zero out of 10 for “lethality.”
该暴露服务器记录的每一个案例都遵循相同的生命周期，从初始访问到建立持久性，并通过伪装成服务的隐藏管理员账户、隐蔽代理、凭证和会话令牌窃取、邮箱以及电子邮件多因素身份验证代码来收集凭证。随后，这群罪犯收集敏感数据，并将所有内容发送至运营商的中央存储库，攻击影响则根据目标机构的不同，在数据窃取、加密、破坏和网络中断之间转换。
The group is believed to be based in Russia, although the server uncovered by SOCRadar, which it attributed to a single operator or small team, didn’t provide any definitive geographic or national attribution. Every case that the exposed server documented followed the same lifecycle, moving from initial access to establishing persistence and credential collection via hidden admin accounts disguised as services, covert proxies, credential and session-token theft, mailboxes and emailed multi-factor authentication codes.
在闯入总部位于荷兰的金融服务提供商Transcom后，这些罪犯直接向贝宝（PayPal）的安全团队发送了二次勒索警报，尽管被入侵的数据仅存在于Transcom的网络上。愚蠢的错误与安全基础的缺失最后，犯罪分子发送勒索信，在泄露网站上发布倒计时时钟，为受害者建立谈判室和电子邮箱——随后在组织拒不支付时泄露被盗文件或销毁备份。
The crooks then collected sensitive data and sent everything to the operator’s central storage with the attack impact shifting between data-theft, encryption, destruction, and network disruption, depending on the targeted organization. After breaking into Transcom, a Netherlands-based financial services provider, the crims sent a secondary ransom alert directly to PayPal's security team, even though the compromised data was only on Transcom's network.
在某些情况下，为对受害公司施加更大压力，n0n 还会向企业的服务提供商、客户和媒体机构广播自动化的倒计时警告。尽管手段激进，但正如 The 此前报道的其他愚蠢罪犯一样，该操作者在基本安全卫生方面依然捉襟见肘。“运营野心与安全纪律之间存在显著鸿沟，”Seker 表示。“该操作者在 AI 服务上投入数千美元，却将自己的工作空间暴露在外。储物柜中还硬编码了加密密钥，且有证据表明这些密钥在多个受害者之间被复用。一个行动可能具备严重的破坏能力，却仍在犯下根本性错误。”®
Stupid mistakes and n0n security basics Finally, the crims send ransom notes, post a countdown clock on the leak site, establish negotiation rooms and emails for victims - and then leak the stolen files or destroy backups when the organizations don’t pay up. In some cases, and to apply increased pressure on victimized companies, n0n also broadcasts automated countdown warnings to businesses’ service providers, clients, and media outlets. Despite its aggressive tactics, the operator in this case - as with other stupid criminals The has gleefully documented in earlier stories - still struggles with basic security hygiene. “There is a striking gap between operational ambition and security discipline,” Seker said. “The operator invested thousands of dollars in AI services while leaving its own workspace exposed. The locker also contained hardcoded encryption keys, with evidence suggesting reuse across victims. An operation can have serious destructive capability while still making fundamental mistakes.”®