n0n credential extortion
n0n crew stuffs FortiGate VPNs and weak admin credentials, then encrypts or deletes data
Posted · Updated · Spectrum Delta Research Team
Summary
n0n, a destructive extortion crew active since September, enters via FortiGate SSL-VPNs and weak admin credentials, then extorts by encrypting - or exfiltrating and deleting data and backups. SOCRadar STRU (Oct 28) recovered an operator workspace mapping 23 organizations in 14 countries as separate cases, not one intrusion chain; 4 were access attempts without established outcome and scale figures are operator-claimed. No vulnerability exploitation was identified in the recovered material.
Breakdown
Adversary
n0n extortion group
Procedures (10)
FortiGate SSL-VPN stuffing
Credential stuffing against FortiGate SSL-VPN through residential proxies
- T1110.004Brute Force: Credential Stuffing
- T1133External Remote Services
Logs
FortiGate SSL-VPN events · SSL-VPN auth attempts: user, source IP, failure
Detectors
No known detector
Click to expand remaining (9) proceduresHide remaining procedures
Hidden admin account created
Hidden administrator accounts created with service-style names
- T1136.001Create Account: Local Account
Logs
Windows Security event log · Account creation 4720; scheduled-task creation 4698
Detectors
No known detector
Admin hidden via UserList
Cover accounts hidden via SpecialAccounts UserList value 0
- T1564.002Hide Artifacts: Hidden Users
Logs
Sysmon · Process creation, registry value set, file ops
Detectors
No known detector
n0n SYSTEM scheduled tasks
Locker and audit runs as SYSTEM scheduled tasks
- T1053.005Scheduled Task/Job: Scheduled Task
Logs
- Windows Security event log · Account creation 4720; scheduled-task creation 4698
- Sysmon · Process creation, registry value set, file ops
Detectors
No known detector
PowerShell hex-URL staging
Implant staging via Net.WebClient.DownloadFile to hex HTTPS URLs
- T1059.001Command and Scripting Interpreter: PowerShell
Logs
- PowerShell script-block logging · DownloadFile, cert-validation bypass patterns
Detectors
No known detector
S3 bucket census and pulls
S3 bucket census and bulk collection with per-bucket byte caps
- T1619Cloud Storage Object Discovery
- T1530Data from Cloud Storage
Logs
AWS CloudTrail · S3 data events; ssm:SendCommand; key usage
Detectors
No known detector
S3 batch delete, note drop
Destructive S3 deletion in 1000-item batches with ransom-note drop
- T1485Data Destruction
Logs
- AWS CloudTrail · S3 data events; ssm:SendCommand; key usage
Detectors
No known detector
SSM commands from new keys
SSM SendCommand executed from new or inactive keys
- T1651Cloud Administration Command
Logs
- AWS CloudTrail · S3 data events; ssm:SendCommand; key usage
Detectors
No known detector
Logs
- Sysmon · Process creation, registry value set, file ops
Detectors
- CYFIRMA Sigma hunt · Shadow-copy deletion hunt, unvalidated for n0n
Indicators of compromise
Hunt only
Campaign infrastructure and hashes are single-origin and perishable; full inventory in the thread: 7 IPs incl. 185.157.161.148 (agent box/C2), 81.161.239.10 (loot vault), 188.214.135.130 (leak backend); cover domain ntpsync.io; onion leak site; extortion sender n0n-cases.net; SHA-1 nenc.exe; 3 SHA-256 source-code files; FMC artifacts (Snort n0n-lock sid 2100001, authorized_keys root@3090-AI); locker artifacts (*.n0n, *.n0n.tmp, n0n_READ_ME* notes under C:\Users\Public\n0n\). Assessed 2026-10-28; hunt-only.
Sources
- B/3SOCRadar STRU: n0n Ransomware - Inside an AI-Assisted Extortion Operation
- B/3CYFIRMA: Non Extortion Group Targets Global Shipping (hunting rules)
- B/3Cyware daily briefing (retelling)
Grades are source reliability (A–F) and information credibility (1–6).
Questions, detections or sightings of n0n credential extortion? Bring them to the community.
Discuss in the Tradecraft Slack