{"id":"CMP-202611-vsngdo","kind":"campaign","aliases":[],"related":[],"title":"n0n ransomware breaks in with stolen or weak passwords (credential stuffing on FortiGate SSL-VPN, leaked AWS keys, RDP/WinRM), steals and wipes data and backups, and uses AI coding agents to write its tools; 93 victims including 38 port and maritime orgs","description":null,"summary":"SOCRadar (28 Oct 2026) found an exposed workspace belonging to an operator of the n0n ransomware group (active since September 2026; operations seen 17 Sep to 22 Oct). No vulnerability was exploited. Every break-in used weak or stolen credentials: credential stuffing through residential proxies against 305 FortiGate SSL-VPN appliances, exposed long-lived AWS IAM access keys, weak RDP/WinRM admin passwords, and hijacked hosting management portals (OnApp, Zabbix). The group took over Cisco Firepower Management Center consoles and switched every access policy to BLOCK, exfiltrated S3 buckets and deleted them, and either encrypted files (AES-256 locker for Windows and Linux, .n0n extension) or destroyed the data and backups. The operator used the opencode AI coding agent with 154 models, including uncensored ones, to write hundreds of attack scripts; LLM spend passed $7,216. As of 19 Oct, 93 victims were listed with $283.7M in demands, including 38 maritime, port and logistics orgs added on 12 Oct. Confirmed victims named include Dediserve, Fanatics, the Venezuelan ISP Inter and ChiBiTek. A link from 21 of the port victims to CyberLogitec software is reported but unconfirmed. Attribution is unknown.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-01T18:54:46+00:00","products":[{"name":"FortiGate SSL-VPN","fixed":[],"vendor":"Fortinet"},{"name":"Cisco Firepower Management Center","fixed":[],"vendor":"Cisco"},{"name":"FortiManager","fixed":[],"vendor":"Fortinet"},{"name":"AWS IAM","fixed":[],"vendor":"Amazon"},{"name":"Amazon S3","fixed":[],"vendor":"Amazon"},{"name":"Windows RDP","fixed":[],"vendor":"Microsoft"},{"name":"WinRM","fixed":[],"vendor":"Microsoft"},{"name":"Zabbix","fixed":[],"vendor":"Zabbix"},{"name":"OnApp","fixed":[],"vendor":"OnApp"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"FortiGate: bursts of /remote/logincheck requests, especially with Cookie: APBSID=n0n. Cisco FMC/FortiManager: REST tokens issued to non-management IPs, default policy flipped to BLOCK, Snort rule 'n0n-lock' (sid 2100001), authorized_keys entries ending in root@3090-AI, OpenSSL-encrypted *.n0n files under /Volume/lib. AWS CloudTrail: ListBuckets, then sustained GetObject, then DeleteObjects in batches of 1,000, PutObject of n0n_READ_ME.txt, ssm:SendCommand from new or long-idle keys. Windows: C:\\Users\\Public\\n0n\\, *.n0n / *.n0n.tmp / n0n_READ_ME* files, Run key n0nNote, hidden local admins svc_upd, svc_reg or svc (SpecialAccounts\\UserList=0), SYSTEM scheduled tasks named *Sync, *Audit, *Exfil, NetAssist or ChromeDbg*, Chrome started with --remote-debugging-port on cloned profiles, portproxy 9223->127.0.0.1:9222. Hosting: new OnApp recipes or Zabbix scripts with 'maintenance' names, VMs tagged mnt-*. Staging server seen: 185.157.161[.]148:8877 (AS42675).","fix":"Put phishing-resistant MFA on SSL-VPN, RDP, WinRM and every admin portal, and rate-limit or alert on VPN login failures. Reset any credentials that show up in infostealer logs. Allow-list the IPs that can reach FortiManager and Cisco FMC, require MFA there, and require approval for policy changes. Replace long-lived AWS access keys with short-lived roles, split S3 list, read and delete permissions, turn on S3 versioning and Object Lock, and alert on large DeleteObjects runs. Keep offline or immutable backups that a cloud or hosting admin account cannot delete. Search your logs now for the indicators listed.","status":"open","published_at":null,"first_seen_at":"2026-11-01T18:54:46+00:00","triaged_at":"2026-11-01T18:54:46+00:00","updated_at":"2026-11-01T18:54:46+00:00","category":"infrastructure","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':45A '-256':169B '12':230B '154':192B '17':93B '19':210B '2026':73B,90B '21':247B '216':207B '22':96B '28':71B '283.7':217B '305':117B '38':39A,222B '7':206B '93':36A,212B 'access':129B,154B 'activ':87B 'add':228B 'admin':133B 'ae':168B 'agent':31A,190B 'ai':29A,188B 'amazon':59A 'applianc':122B 'attack':201B 'attribut':259B 'aw':18A,127B 'aws':57A 'backup':26A,182B 'belong':78B 'block':157B 'break':3A,104B 'break-in':103B 'bucket':160B 'campaign':66B 'center':55A,149B 'chibitek':243B 'cisco':52A,146B 'cmp':44A 'code':30A,189B 'confirm':232B 'consol':150B 'credenti':10A,110B,111B 'cyberlogitec':253B 'data':24A,180B 'dediserv':236B 'delet':162B 'demand':220B 'destroy':178B 'earli':68B 'early-warn':67B 'either':165B 'encrypt':166B 'everi':102B,153B 'exfiltr':158B 'exploit':101B 'expos':76B,123B 'extens':176B 'fanat':237B 'file':167B 'firepow':147B 'firepower':53A 'fortig':13A,118B 'fortigate':48A 'fortimanager':56A 'found':74B 'group':86B,143B 'hijack':136B 'host':137B 'hundr':199B 'iam':58A,128B 'includ':38A,194B,221B,235B 'inter':241B 'isp':240B 'key':19A,130B 'leak':17A 'link':245B 'linux':174B 'list':215B 'live':126B 'llm':203B 'locker':170B 'logist':226B 'long':125B 'long-liv':124B 'm':218B 'manag':138B,148B 'management':54A 'maritim':42A,223B 'model':193B 'n0n':1A,47A,84B,175B 'name':234B 'oct':72B,97B,211B,231B 'onapp':65A,140B 'one':196B 'opencod':187B 'oper':81B,91B,184B 'org':43A,227B 'pass':205B 'password':9A,134B 'polici':155B 'port':40A,224B,250B 'portal':139B 'proxi':115B 'ransomwar':2A,85B 'rdp':62A 'rdp/winrm':20A,132B 'report':256B 'residenti':114B 's3':60A,159B 'script':202B 'seen':92B 'sep':94B 'septemb':89B 'sinc':88B 'socradar':70B 'softwar':254B 'spend':204B 'ssl':15A,50A,120B 'ssl-vpn':14A,49A,119B 'steal':21A 'stolen':6A,109B 'stuf':11A,112B 'switch':152B 'took':144B 'tool':35A 'uncensor':195B 'unconfirm':258B 'unknown':261B 'use':28A,106B,185B 'venezuelan':239B 'victim':37A,213B,233B,251B 'vpn':16A,51A,121B 'vsngdo':46A 'vulner':99B 'warn':69B 'weak':8A,107B,131B 'window':172B 'windows':61A 'winrm':63A 'wipe':23A 'workspac':77B 'write':33A,198B 'zabbix':64A,141B","nicknames":["n0n"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-28T08:02:51+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-vsngdo","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-01T18:54:46+00:00","fetched_at":"2026-11-01T18:54:46+00:00","note":null}],"documents":[{"id":40294,"url":"https://bsky.app/profile/campuscodi.risky.biz/post/3mzbhp7aaf22h","title":"@campuscodi.risky.biz: You know that ransomware group that breached a bunch of port authorities and mar","kind":"post","source":"bluesky","publisher":null,"text":"You know that ransomware group that breached a bunch of port authorities and maritime orgs? Yeah, that was AI-driven hacking.\n\nA ransomware group launched 6 weeks ago breached close to 100 orgs with just $7,000 in LLM costs\n\nsocradar.io/blog/n0n-ran...\nhttps://socradar.io/blog/n0n-ransomware-ai-assisted-extortion/\n\nlikes 0 reposts 0","published_at":"2026-11-01T18:44:11+00:00","relation":"describes","confidence":null,"note":null},{"id":40297,"url":"https://socradar.io/blog/n0n-ransomware-ai-assisted-extortion/","title":"n0n Ransomware: Inside an AI-Assisted Extortion Operation (SOCRadar)","kind":"blog","source":"analyst","publisher":null,"text":"SOCRadar STRU found exposed n0n operator workspace at 185.157.161[.]148:8877 (Sept 25-26, 2026). Access only via weak/stolen credentials: credential stuffing on 305 FortiGate SSL-VPN appliances (/remote/logincheck, Cookie APBSID=n0n) via residential proxies, exposed long-lived AWS IAM keys, weak RDP/WinRM creds, hosting portals (OnApp, Zabbix). Hijacked Cisco Firepower Management Center to flip policies to BLOCK. AES-256-CBC locker (.n0n extension, n0n_READ_ME notes, C:\\Users\\Public\\n0n\\), deletes data and backups. AI coding agent opencode with 154 models, >$7,216 LLM spend. 93 victims listed as of Oct 19, incl. 38 maritime/port/logistics orgs on Oct 12; 21 linked to CyberLogitec customers (unconfirmed). Indicators: Registry Run n0nNote, hidden admins svc_upd/svc_reg/svc, authorized_keys root@3090-AI on FMC, Snort rule n0n-lock sid 2100001, CloudTrail ListBuckets+GetObject+DeleteObjects 1000-batches, PutObject n0n_READ_ME.txt, ssm:SendCommand from new keys, Chrome --remote-debugging-port on cloned profiles, portproxy 9223->9222.","published_at":"2026-10-28T08:02:51+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}