SOCRadar says the operator configured OpenCode with 154 model entries—not a verified count of models used—and used the superintelligence (SI) coding agent to write and debug hundreds of scripts.
Threat intelligence firm SOCRadar said it uncovered an exposed online workspace linked to the n0n extortion group. The workspace revealed the operation’s workflow as of September 2026, The Hacker News said on 29 October.
An October 30 report by The Register described attempted intrusions against 23 organizations across 14 countries. Those figures count targets, not successful compromises. The operator had incurred more than $7,216 in SI usage costs by 22 October 2026.
In an October 13 profile, SOCRadar described n0n as primarily a data-theft and extortion operation: it stole information and threatened to publish it unless victims paid, rather than relying on traditional ransomware that locks files.
SOCRadar’s chief information security officer, Ensar Seker, said every documented compromise in the investigation relied on weak or stolen login details. Researchers found no evidence that the operator exploited software flaws to gain access in the cases examined.
The Register identified the workspace’s coding agent as OpenCode, an open-source tool. Seker said the operator used it to write and debug hundreds of attack scripts. Its 154 configured model entries do not establish how many models were actually used.
The later investigation documented more than data theft. Seker said some cases involved encrypting files—locking them so they need a key to be read—and deleting data and backups. He said those deletions create recovery problems that a decryption key alone cannot solve.
Following JAL Group’s disclosure covering about 92,000 customers, Cathay Pacific says it is investigating and will notify affected customers once details are established.
2 min
Ukraine’s October 24 announcement followed losses of drone control above about 150 km/h. Its Defence Ministry said restored links mattered for frontline drone operations, logistics and communications.
3 min
An October 28, 2026 advisory puts losses at about $3.5 million and says Ledger is reviewing the affected cases while police investigate.
3 min
Update ·
The update identifies OpenCode as the coding agent and clarifies that its configured model entries do not establish how many models were used.
