n0n ransomware breaks in with stolen or weak passwords (credential stuffing on FortiGate SSL-VPN, leaked AWS keys, RDP/WinRM), steals and wipes data and backups, and uses AI coding agents to write its tools; 93 victims including 38 port and maritime orgs

SOCRadar (28 Oct 2026) found an exposed workspace belonging to an operator of the n0n ransomware group (active since September 2026; operations seen 17 Sep to 22 Oct). No vulnerability was exploited. Every break-in used weak or stolen credentials: credential stuffing through residential proxies against 305 FortiGate SSL-VPN appliances, exposed long-lived AWS IAM access keys, weak RDP/WinRM admin passwords, and hijacked hosting management portals (OnApp, Zabbix). The group took over Cisco Firepower Management Center consoles and switched every access policy to BLOCK, exfiltrated S3 buckets and deleted them, and either encrypted files (AES-256 locker for Windows and Linux, .n0n extension) or destroyed the data and backups. The operator used the opencode AI coding agent with 154 models, including uncensored ones, to write hundreds of attack scripts; LLM spend passed $7,216. As of 19 Oct, 93 victims were listed with $283.7M in demands, including 38 maritime, port and logistics orgs added on 12 Oct. Confirmed victims named include Dediserve, Fanatics, the Venezuelan ISP Inter and ChiBiTek. A link from 21 of the port victims to CyberLogitec software is reported but unconfirmed. Attribution is unknown.

Summary written from the sources below. Check the originals before acting.