---
id: "CMP-202611-vsngdo"
kind: "campaign"
aliases: []
title: "n0n ransomware breaks in with stolen or weak passwords (credential stuffing on FortiGate SSL-VPN, leaked AWS keys, RDP/WinRM), steals and wipes data and backups, and uses AI coding agents to write its tools; 93 victims including 38 port and maritime orgs"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "FortiGate SSL-VPN", "fixed": [], "vendor": "Fortinet"}, {"name": "Cisco Firepower Management Center", "fixed": [], "vendor": "Cisco"}, {"name": "FortiManager", "fixed": [], "vendor": "Fortinet"}, {"name": "AWS IAM", "fixed": [], "vendor": "Amazon"}, {"name": "Amazon S3", "fixed": [], "vendor": "Amazon"}, {"name": "Windows RDP", "fixed": [], "vendor": "Microsoft"}, {"name": "WinRM", "fixed": [], "vendor": "Microsoft"}, {"name": "Zabbix", "fixed": [], "vendor": "Zabbix"}, {"name": "OnApp", "fixed": [], "vendor": "OnApp"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-01T18:54:46+00:00"
updated_at: "2026-11-01T18:54:46+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-01T18:54:46+00:00"}]
---

# n0n ransomware breaks in with stolen or weak passwords (credential stuffing on FortiGate SSL-VPN, leaked AWS keys, RDP/WinRM), steals and wipes data and backups, and uses AI coding agents to write its tools; 93 victims including 38 port and maritime orgs

SOCRadar (28 Oct 2026) found an exposed workspace belonging to an operator of the n0n ransomware group (active since September 2026; operations seen 17 Sep to 22 Oct). No vulnerability was exploited. Every break-in used weak or stolen credentials: credential stuffing through residential proxies against 305 FortiGate SSL-VPN appliances, exposed long-lived AWS IAM access keys, weak RDP/WinRM admin passwords, and hijacked hosting management portals (OnApp, Zabbix). The group took over Cisco Firepower Management Center consoles and switched every access policy to BLOCK, exfiltrated S3 buckets and deleted them, and either encrypted files (AES-256 locker for Windows and Linux, .n0n extension) or destroyed the data and backups. The operator used the opencode AI coding agent with 154 models, including uncensored ones, to write hundreds of attack scripts; LLM spend passed $7,216. As of 19 Oct, 93 victims were listed with $283.7M in demands, including 38 maritime, port and logistics orgs added on 12 Oct. Confirmed victims named include Dediserve, Fanatics, the Venezuelan ISP Inter and ChiBiTek. A link from 21 of the port victims to CyberLogitec software is reported but unconfirmed. Attribution is unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :FortiGate SSL-VPN affected ? fixed ?
- :Cisco Firepower Management Center affected ? fixed ?
- :FortiManager affected ? fixed ?
- :AWS IAM affected ? fixed ?
- :Amazon S3 affected ? fixed ?
- :Windows RDP affected ? fixed ?
- :WinRM affected ? fixed ?
- :Zabbix affected ? fixed ?
- :OnApp affected ? fixed ?

## How to check

FortiGate: bursts of /remote/logincheck requests, especially with Cookie: APBSID=n0n. Cisco FMC/FortiManager: REST tokens issued to non-management IPs, default policy flipped to BLOCK, Snort rule 'n0n-lock' (sid 2100001), authorized_keys entries ending in root@3090-AI, OpenSSL-encrypted *.n0n files under /Volume/lib. AWS CloudTrail: ListBuckets, then sustained GetObject, then DeleteObjects in batches of 1,000, PutObject of n0n_READ_ME.txt, ssm:SendCommand from new or long-idle keys. Windows: C:\Users\Public\n0n\, *.n0n / *.n0n.tmp / n0n_READ_ME* files, Run key n0nNote, hidden local admins svc_upd, svc_reg or svc (SpecialAccounts\UserList=0), SYSTEM scheduled tasks named *Sync, *Audit, *Exfil, NetAssist or ChromeDbg*, Chrome started with --remote-debugging-port on cloned profiles, portproxy 9223->127.0.0.1:9222. Hosting: new OnApp recipes or Zabbix scripts with 'maintenance' names, VMs tagged mnt-*. Staging server seen: 185.157.161[.]148:8877 (AS42675).

## Fix

Put phishing-resistant MFA on SSL-VPN, RDP, WinRM and every admin portal, and rate-limit or alert on VPN login failures. Reset any credentials that show up in infostealer logs. Allow-list the IPs that can reach FortiManager and Cisco FMC, require MFA there, and require approval for policy changes. Replace long-lived AWS access keys with short-lived roles, split S3 list, read and delete permissions, turn on S3 versioning and Object Lock, and alert on large DeleteObjects runs. Keep offline or immutable backups that a cloud or hosting admin account cannot delete. Search your logs now for the indicators listed.

## Timeline

- 2026-11-01T18:54:46+00:00 analyst

## Documents

- [describes] @campuscodi.risky.biz: You know that ransomware group that breached a bunch of port authorities and mar https://bsky.app/profile/campuscodi.risky.biz/post/3mzbhp7aaf22h
- [describes] n0n Ransomware: Inside an AI-Assisted Extortion Operation (SOCRadar) https://socradar.io/blog/n0n-ransomware-ai-assisted-extortion/

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_