Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see

A cybercriminal group called n0n conducted a series of extortion attacks against 23 organizations across 14 countries, costing the criminals over $7,216 in AI usage fees. The group primarily relied on weak or stolen credentials and exposed server configurations to gain access to its victims' IT environments. The attackers utilized AI-assisted coding tools to create and debug hundreds of scripts, which they used to steal and encrypt data, delete backups, and alter firewall policies.

In one instance, n0n exploited an exposed AWS access key to access and delete data from 40 Amazon S3 buckets. The group demanded ransoms ranging from $400,000 to $28 million, payable in Bitcoin, but did not receive any payments for 38 of their 108 affected firms. The stolen data from the affected organizations was published on n0n's leak site, including bank transaction archives and crucial information.

The group's modus operandi involved using AI for initial access, establishing persistence, and credential harvesting, followed by data theft, encryption, destruction, and network disruption, depending on the targeted organization.