n0n Ransomware: Inside an AI-Assisted Extortion Operation

In September 2026, the SOCRadar Threat Research Unit (STRU) discovered an exposed staging server holding the live workspace of an operator tied to the n0n ransomware group. The open directory exposed the operation’s full September workflow: breach and exfiltration tooling, original locker source code, extortion infrastructure, and an AI coding agent environment backed by more than $7,000 in paid LLM API usage. The findings implicate at least 23 organizations across 14…

Diamond Model