SOCRadar: n0n ransomware group used AI tools to build attack scripts
Researchers found 829 attack scripts, including ransomware encryption source code, on an exposed server and linked the group to at least 23 organizations in 14 countries.
SOCRadar published a threat analysis report on October 28, 2026, examining the attack server and internal working environment of the ransomware group n0n, according to dailysecu.com. The report describes how the group used AI coding agents to write and debug its attack scripts.
Researchers found 1,719 files on the exposed server, of which 829 were attack scripts, including the source code of a ransomware encryption program. According to the report, the group spent more than 216 dollars... no, 7,216 dollars on AI model usage.
The report says humans directed the attacks, while AI was used for tool development and task automation rather than for the entire attack process upfront. The group targeted VPN services on about 305 security appliances worldwide with repeated credential attempts, and also used RDP, WinRM, exposed cloud access keys and stolen admin accounts.
SOCRadar identified at least 23 organizations in 14 countries in the attackers' internal materials. Some showed confirmed compromise, while others only showed access attempts.
As of October 19, the group listed 93 victim organizations on its leak site, with ransom demands totaling about 283.7 million dollars.
Group active since September 2026
n0n's activity has been observed since September 2026 as a financially motivated cybercrime group.
Quick answers
What did SOCRadar find on the n0n attack server?
Researchers found 1,719 files, of which 829 were attack scripts, including the source code of a ransomware encryption program.
How much did n0n spend on AI model usage?
The group spent more than 7,216 dollars on AI model usage, according to the report.
How many victims has n0n listed?
As of October 19, the group listed 93 victim organizations on its leak site, with ransom demands totaling about 283.7 million dollars.