SOCRadar Details n0n’s AI-Assisted Ransomware Operation

Oct 28, 2026 · Original article ↗

Summary

SOCRadar says an exposed workspace linked n0n to 23 organizations, including access attempts, and revealed credential-based intrusions, data theft and destruction tooling, and AI-assisted scripting. The analysis includes technical findings and defenses; some claims are未

Key points

SOCRadar’s Threat Research Unit says it found an exposed server containing 1,719 files from a n0n operator’s workspace across two September 2026 snapshots.
The workspace identified 23 organizations: 15 were published on n0n’s leak site, four were reportedly compromised but not published, and four had access attempts with no outcome shown.
The researchers found no vulnerability exploitation in the documented compromises; access relied on weak or stolen credentials.
Entry methods included credential stuffing against 305 FortiGate SSL-VPN appliances, exposed AWS keys, weak RDP/WinRM credentials, and reused hosting-portal sessions.
The n0n locker uses AES-256-CBC variants; wrapper scripts perform destructive actions, and one encryption key may be shared across two victims.
The operator’s opencode environment had 154 model entries and produced or debugged hundreds of attack scripts. SOCRadar says the evidence indicates human-directed use, not a fully autonomous attack system.
The article recommends phishing-resistant MFA, restricted firewall-management access, shorter-lived cloud credentials, and offline or immutable backups.

Article Details

Attack Vectors: Credential stuffing against FortiGate SSL-VPN portals using residential proxies.
Weak or compromised RDP/WinRM credentials, exposed AWS IAM keys, and reused hosting-management sessions.
The operator stole browser credentials, session tokens, mailbox contents, and emailed MFA codes.
The operator hijacked Cisco Firepower Management Center instances and changed access policies to BLOCK.
Data was exfiltrated to operator-controlled storage; the operator encrypted some systems and destroyed data or backups in others.
Defensive Notes: Enforce phishing-resistant MFA on RDP, SSL-VPNs, and administrative portals; monitor /remote/logincheck for credential stuffing and invalidate credentials found in infostealer logs.
Restrict FortiManager and FMC interfaces with IP allow-lists and MFA, require approval for policy changes, and flag REST-token creation from unknown IPs.
Replace long-lived cloud keys with short-lived roles, separate S3 list/read/delete permissions, enable Object Lock and versioning, and alert on high-volume DeleteObjects calls.
Maintain air-gapped or immutable backups because the group deletes shadow copies, wipes free space, and removes provider-hosted backups.
Hunt EDR, CloudTrail, WinRM/RDP, and firewall logs for the article's listed indicators and behaviors, including unexpected SSM commands and firewall policy changes.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`n0n-cases[.]net`	Domain used as the sender domain for extortion emails.
DOMAIN	`n0n[.]to`	Clearnet leak-site domain identified as belonging to the n0n ransomware group; reported inactive.
DOMAIN	`ntpsync[.]io`	Beacon cover domain used by the operation.
DOMAIN	`uberip[.]com`	Identified as an actor mail domain.
EMAIL	`notice@n0n-cases[.]net`	Extortion email sender address attributed to the operation.
IPV4	`185[.]157[.]161[.]148`	Exposed operator workspace; identified as the agent box hosting the kserver C2 and /x/i beacon.
IPV4	`185[.]157[.]161[.]93`	Identified as the ntpsync[.]io origin serving PHP payloads.
IPV4	`188[.]214[.]135[.]130`	Operator infrastructure identified as the “raas” leak backend and payload host.
IPV4	`198[.]13[.]158[.]143`	Identified as an operator SSH pivot and SOCKS hop to victim SaaS tenants.
IPV4	`45[.]132[.]114[.]241`	Identified in the IOC table as an operator scrub-list IP.
IPV4	`81[.]161[.]239[.]10`	Operator infrastructure identified as the “monster” loot vault, implant C2, and payload host.
SHA1	`dc82e9c22c4a06c6bc03701fce2b55f4f490c651`	Hash of nenc.exe, identified in the IOC table as a n0n locker artifact.
SHA256	`340172627cdf40927784956be784bd2b3f5d1584cb79cf31064f387bbe9acb28`	Hash of nenc2.cpp, identified as Windows locker version 2 source.
SHA256	`886b3608d05069d314fa6300404de6627f96b13a95c5633f6c91dfc2a545ac87`	Hash of nenc2l.cpp, identified as Linux locker source.
SHA256	`d1fd3a8ac4ada74b8ccbcdf5134797acff401b7fb50e16549b337781dfe1a486`	Hash of nenc.cpp, identified as Windows locker version 1 source.