Summary
- SOCRadar examined an exposed operator workspace containing 1,719 files.
- Its investigation identified activity involving 23 organisations across 14 countries.
- Documented intrusions relied on compromised credentials rather than exploitation of software vulnerabilities.
An exposed server associated with the n0n ransomware operation has revealed how an attacker combined stolen credentials, intrusion scripts, destructive commands, and AI-assisted software tooling. Researchers at SOCRadar examined material stored in a publicly accessible workspace, providing evidence of how the operator prepared and conducted attacks.
The investigation covered 1,719 files identified across snapshots gathered in September 2026. The contents included code, credentials, operational notes, and supporting infrastructure records. SOCRadar associated the material with activity involving 23 organisations across 14 countries, but the records do not establish that every named organisation suffered a completed ransomware attack.
In the documented cases, the operator relied heavily on access obtained through weak, reused, or stolen credentials. The researchers found evidence of credential stuffing, use of exposed cloud secrets, and attempts to exploit existing authenticated sessions. Those methods take advantage of legitimate access mechanisms rather than depending on a new vulnerability in the target’s software.
After access was obtained, the operator sought additional account information and tools that could provide broader permissions. The exposed files included scripts for moving between systems, locating data, and preparing destructive activity. The reported techniques help explain how an initial account compromise can grow into a larger incident when additional privileges become available.
Some workflows involved deleting backups or other files while collecting data for extortion. Such activity can increase the cost of recovery, because an organisation may need to restore systems while also investigating information that might have been taken. Encryption is only one possible component of the operational disruption.
The workspace contained an AI coding-agent environment and material indicating expenditure on commercial AI services. SOCRadar linked those resources to development and adaptation of tooling. Their presence does not demonstrate that a model autonomously selected targets or conducted every step of the intrusion.
The distinction between automated assistance and autonomous attack operation is important to interpreting the recovered materials. A language model may assist with scripting, troubleshooting, or organising information while the operator continues to choose objectives and initiate commands. The underlying access routes in this case remained ordinary account and credential weaknesses.
SOCRadar also linked the operation to an extortion site used to issue public demands and name alleged victims. Criminal listings are assertions by the operators, not independent verification that each organisation was compromised or that the attacker stole the volumes of data claimed.
Researchers can corroborate some such claims through recovered files, log records, or victim disclosures, but the evidential standard varies between incidents. The reported list of 23 organisations must therefore be presented as part of the investigation rather than a tally of independently confirmed successful intrusions.
The operation’s interests included technology services, telecommunications, retail, and managed service providers. Access to an organisation administering systems for others can create opportunities for wider exposure, depending on its permissions, contractual arrangements, and network segregation.
Because stolen credentials are often accepted by legitimate authentication services, the earliest signs of abuse may concern changes in where, when, and how an account is used rather than a software exploit signature. Session records and administrative activity can therefore become important in determining the scope of a compromise.
The attacker also had to manage its own infrastructure and operational records. The public availability of the workspace gave researchers access to material that is rarely visible during an investigation focused only on one victim’s systems. That visibility provides unusual detail about attack preparation but does not by itself establish the identity or location of the individual responsible.
The findings support a technical account of credential abuse, destructive activity, and AI-assisted preparation. Broader attribution, the final number of successful compromises, and confirmed payment totals remain separate questions that cannot be resolved simply from the operator’s extortion claims.
SOCRadar’s evidence documents an attacker making extensive use of readily available access and software tools, with the recovered files providing a rare view into the preparation of a ransomware campaign.
