Ransomware gang n0n used $7,216 of AI and no software bug
SOCRadar found that each known break-in of the n0n gang used weak or stolen passwords.
The security firm SOCRadar reports that a new ransomware gang, n0n, tried to go into 23 organizations in 14 countries. The gang left its server open. SOCRadar saw 1,719 files and AI costs of more than $7,216 by 22 October. It found no software bug in use as an entry point, and the gang removed data and backups in some cases.
How it works
The gang scans for open remote ports and tests stolen passwords on VPN portals. It also used an open cloud key to read and remove data in 40 storage buckets. The operator used OpenCode, an open-source AI coding tool, with 154 model entries from seven providers. SOCRadar reports that the AI helped to write hundreds of scripts.
The numbers
The gang claims 108 victims since last month. On 12 October it listed 38 shipping and port firms and asked for $400,000 to $28 million from each. After the 19 October deadline, none of the 38 payment addresses showed a payment. SOCRadar did not check a payment on the public ledger.
What is not known
SOCRadar found no proof of an AI system that attacks alone. The gang is thought to be in Russia, but the server gave no clear proof. CyberLogitec, a software maker, did not make sure of a break-in.
Insight: AI makes attacks bigger but they start at a used door
SOCRadar found OpenCode in this work and in a work on 62 targets. In n0n, AI gave scale, but the entry was a weak password. This reads as a race in which cheap AI makes the attack wide, but the door stays the same, and the side that closes it gains. Repair passwords and open keys before you buy new AI defense.
Sources
Posted
