N0n ransomware group spends $7K on AI tools, then leaves its own server wide open

A SOCRadar investigation found the extortion crew's staging server exposed, revealing attack scripts, encryptor source code and an AI coding setup A ransomware crew that tried to break into 23 organizations across 14 countries forgot one small detail: locking its own door. The n0n extortion group left a staging server exposed online, putting its tools, scripts and methods on display for anyone who looked. The find matters because it gives defenders a rare inside look at a modern ransomware operation. That operation pairs paid AI services with one of the oldest tricks in the book: logging in with stolen passwords. What was sitting on the server SOCRadar’s Threat Research Unit found the server in late September 2026. It held 1,719 files. Of those, 829 were attack scripts. The server also stored source code for five versions of a custom encryptor, the program that scrambles victims’ files so they can’t be opened without a key. Researchers also found configuration details for an AI coding agent called opencode. The setup drew on 154 models from a range of providers. The group’s AI spending was not trivial. By mid-to-late October, n0n had racked up more than $7,216 in API usage on large...