The report
SOCRadar says it recovered a working directory associated with the n0n ransomware operation, including hundreds of scripts, several encryption utilities and records of model-assisted development. The material connects AI tooling to a human-directed criminal workflow. It does not show an AI model independently choosing targets, committing intrusions or receiving ransom payments without an operator.
What the workspace contains
The technical investigation describes script collections, C++ encryptor variants and use of an OpenCode-based tool environment with multiple models. Those artifacts can support claims about how the operator built and revised tooling. They do not, on their own, establish that every script ran against a victim or that every apparent target was compromised.
SOCRadar also discusses cloud credential misuse, backups and firewall-management effects. These are operationally important because an attacker using legitimate administration APIs can change the victim's recovery options without exploiting a new cloud zero-day. The canonical Case separates recovered actor artifacts from unverified downstream impact.
Claims that require another ledger
The report mentions extortion demands, portal listings and victim organizations. A demand is not a payment, and a name on a portal is not independently verified exfiltration. Similarly, a payment wallet without observed transactions does not prove that an operator obtained no money elsewhere. Establishing losses requires victim records, blockchain or banking evidence, and timeline-matched infrastructure traces.
The specific AI-security finding is measurable assistance in an attacker toolchain, not an autonomous ransomware species. Attribution and impact should be tied to executed actions and authenticated victim-side evidence, while AI model logs identify the part of the workflow that was actually delegated.