n0n Ransomware Spent $7,216 on AI

The n0n extortion gang splurged more than seven thousand two hundred dollars on AI tools. By October 22 they logged $7,216 in AI usage across dozens of models. They fed OpenCode with 154 model entries from providers like Gemini, Claude and GPT-5.x. AI wrote and debugged hundreds of scripts, turning stolen credentials into tailored attacks. The crew breached 23 organizations in 14 countries using only weak or stolen logins. They scanned RDP endpoints and stuffed FortiGate SSL-VPN passwords with a 15-thread SOCKS5 pool. An exposed AWS key let them pull up to 110 GB from 40 S3 buckets and wipe them. Their Swedish server at 185.157.161.148:8877 exposed 1,719 files, revealing ransomware code, AI tools and the unpaid ransom demands. "AI helped turn basic access into a broader, tailored operation," warned Ensar Seker of SOCRadar.