In September 2026, the SOCRadar Threat Research Unit (STRU) discovered an exposed staging server holding the live workspace of an operator tied to the n0n ransomware group. The open directory exposed the operation’s full September workflow: breach and exfiltration tooling, original locker source code, extortion infrastructure, and an AI coding agent environment backed by more than $7,000 in paid LLM API usage.
n0n Ransomware: Inside an AI-Assisted Extortion Operation
About this summary. This is a short excerpt from the description that SOCRadar published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://socradar.io/blog/n0n-ransomware-ai-assisted-extortion/
Source attribution: headline and facts are from SOCRadar (socradar.io). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
New LiteLLM Supply Chain Attack Hits PyPI and Docker
A new LiteLLM supply chain attack has turned version 1.107.0, an official release of the popular open-source LLM gateway, into a credential stealer. On October 21, 2026…
From Instructions to Exploits: Applying Program Analysis to Malicious Agent Skills Across Natural Language and Code
arXiv:2610.33489v1 Announce Type: new Abstract: LLM-powered agents increasingly rely on third-party skills that combine natural-language instructions with executable…
26th October – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 26th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Japanese cloud…
LiteLLM hit by second supply chain attack this year, users urged to rotate credentials
A malicious release of LiteLLM pushed to PyPI and Docker registries on Wednesday carried malware built to harvest cloud logins, developer secrets and API keys for AI…
Security Affairs newsletter Round 600 by Pierluigi Paganini – INTERNATIONAL EDITION
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new…
FortiBleed Is Still Active, Locking Organizations Out
FortiBleed Is Still Active, Locking Organizations Out On October 6, 2026, the FBI and the U.S. Secret Service published a joint Cybersecurity Advisory on FortiBleed, the…