# Extortion group targeted 23 organisations using stolen credentials and exposed accounts

- URL: https://talkfuse.com/story/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see/
- Published: 2026-10-30T19:37:12+00:00
- Updated: 2026-10-31T00:07:37+00:00
- Original publisher: The Register
- Original article: https://www.theregister.com/security/2026/10/30/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see/5306754
- Topics: AI, Technology

## Key points

- n0n targeted 23 organisations in 14 countries.
- Researchers found no evidence of vulnerability exploits.
- The operator spent over $7,216 on AI services.

## Summary

An extortion group called n0n attempted attacks on 23 organisations in 14 countries, using stolen or weak credentials to gain access. Researchers found no evidence that it exploited software vulnerabilities, despite the attention given to AI’s potential role in finding them. The case shows how AI can help attackers expand conventional intrusions, while destructive actions can make recovery harder.

The group used remote-access scanning, credential stuffing and exposed cloud accounts. In an incident linked to e-commerce site Fanatics, it used an exposed AWS key to access data in 40 S3 buckets, then deleted data and credentials from 12 sensitive buckets. Researchers found a publicly accessible server containing 1,719 files, including scripts and ransomware source code; the operator had spent more than $7,216 on AI services by 22 October. The group has claimed 108 victims since emerging last month.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.