n0n Ransomware: Inside an AI-Assisted Extortion Operation

In September 2026, research identified an exposed staging server belonging to the n0n ransomware group, revealing a sophisticated workflow involving AI-assisted script generation. The group has rapidly scaled its operations, targeting 93 organizations across 15 sectors, including a significant wave of attacks against 38 maritime and logistics entities. The n0n group distinguishes itself through its specific branding ("n0n | no js | no mercy") and a strategy that pivots to data destruction and backup deletion if encryption is obstructed.

The technical analysis highlights a reliance on compromised credentials rather than vulnerability exploitation. Initial access is predominantly achieved via credential stuffing against FortiGate SSL-VPN devices, exposed AWS IAM keys, and weak RDP/WinRM credentials. A key finding is the operator's use of an open-source AI coding agent, 'opencode', to generate and debug hundreds of attack scripts. Infrastructure for the operation is segmented into dedicated nodes for C2, leak hosting, and data storage.

This threat poses a high risk to sectors relying on legacy remote access and cloud storage, particularly the maritime, logistics, and critical infrastructure industries. The group's practice of contacting victims' clients and unions increases the reputational and business impact beyond immediate data loss. Defenses should prioritize phishing-resistant MFA and immutable backups, as the group actively seeks to neutralize standard recovery mechanisms like shadow copies.