Extortion group targeted 23 organisations using stolen credentials and exposed accounts
An extortion group called n0n attempted attacks on 23 organisations in 14 countries, using stolen or weak credentials to gain access. Researchers found no evidence that it exploited software vulnerabilities, despite the attention given to AI’s potential role in finding them. The case shows how AI can help attackers expand conventional intrusions, while destructive actions can make recovery harder.
The group used remote-access scanning, credential stuffing and exposed cloud accounts. In an incident linked to e-commerce site Fanatics, it used an exposed AWS key to access data in 40 S3 buckets, then deleted data and credentials from 12 sensitive buckets. Researchers found a publicly accessible server containing 1,719 files, including scripts and ransomware source code; the operator had spent more than $7,216 on AI services by 22 October. The group has claimed 108 victims since emerging last month.
In short
- n0n targeted 23 organisations in 14 countries.
- Researchers found no evidence of vulnerability exploits.
- The operator spent over $7,216 on AI services.
Explained simply
Cyber criminals can gain access to an organisation’s systems by using login details that have been stolen, reused or left exposed online. Remote access tools and cloud storage services, such as Amazon Web Services’ S3, are widely used by organisations to manage systems and store data, but exposed accounts or keys can let outsiders in.
The group known as n0n is an extortion operation: attackers seek to pressure organisations, often by threatening to publish or destroy data. Researchers said the attacks relied on access credentials rather than flaws in software, and found scripts and ransomware code on a publicly accessible server. They also reported that the operator had spent money on AI services, which can help automate or expand parts of an attack.
The case matters because deleting data or access credentials can make it harder for an organisation to restore systems after an intrusion. It also illustrates why account security and recovery plans remain important as attackers adopt new tools.
Read the full article at the source →
Originally published by The Register as “Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see”.