{"id":61665,"date":"2026-10-30T19:37:12","date_gmt":"2026-10-30T19:37:12","guid":{"rendered":"https:\/\/www.theregister.com\/a\/5306754"},"modified":"2026-10-30T19:37:12","modified_gmt":"2026-10-30T19:37:12","slug":"crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see\/","title":{"rendered":"Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see"},"content":{"rendered":"
<\/div>\n

<\/p>\n

A n0n ransomware operator tried to break into 23 organizations across 14 countries, but couldn’t secure its own front door, leaving its server exposed with all of its methods on view.<\/p>\n

The criminals used a mix of new (AI) and old (stolen credentials) tooling during their data-theft spree, and in some cases not only stole and encrypted files, but also deleted data and backups, eliminating victims\u2019 ability to recover their information.<\/p>\n

And despite the fear<\/a> and hype<\/a> around the breachpocalypse<\/a>, with AI finding and developing exploits<\/a> for critical vulnerabilities<\/a> affecting most organizations across the globe<\/a>, these crooks did not exploit a single bug to gain entry into any of their victims\u2019 IT environments. <\/p>\n

\u201cIn every documented compromise<\/a> in this investigation, access relied on weak or stolen credentials,\u201d said Ensar Seker, chief information security officer of threat intelligence firm SOCRadar.<\/p>\n

\u201cWhat stands out is the combination of AI-assisted development and very conventional entry points,\u201d Seker told The Register<\/span>. \u201cWe found no evidence of vulnerability exploitation in the cases examined.\u201d<\/p>\n

The gang breaks into organizations at scale using widespread Remote Desktop Protocol (RDP) scanning and automated FortiGate SSL-VPN credential stuffing. To access US-based IT managed services provider ChiBiTek, the crew used a 15-thread residential SOCKS5 proxy pool to test credentials (ip:port:user:password) against FortiGate portals (GET \/remote\/login).<\/p>\n

The operators also gained entry using exposed cloud credentials and reused hosting portal sessions. In one case linked to e-commerce site Fanatics<\/a>, SOCRadar found that n0n used an exposed AWS access key with permissions to list, read, and delete objects in S3 buckets. The criminals then used this key to pull data from 40 S3 buckets, with up to 110 GB per bucket, and ultimately deleted data, including bank-transaction archives, and purged keys across 12 sensitive buckets. <\/p>\n

AI-assisted extortion<\/h3>\n

While the threat hunters didn\u2019t find any evidence of a fully autonomous attack system, the ransomware operator did use AI to assist with these intrusions, incurring more than $7,216 in AI usage costs by October 22.<\/p>\n

Specifically: the criminal or criminals used OpenCode, an open-source AI coding agent, configured with 154 model entries across seven providers. Models included Gemini, Mistral, Nemotron, Llama, Claude, GPT-5.x, Grok, Kimi, GLM, DeepSeek, MiniMax, Qwen, and many, many others, some with safety training removed and others marketed as \u201cuncensored\u201d models.<\/p>\n

\u201cThe operator used AI to write and debug hundreds of scripts. That shows how AI can help an attacker turn basic access into a broader, tailored operation,\u201d Seker said. <\/p>\n

\u201cThe destructive behavior is equally significant,\u201d he added. \u201cThe operator did more than steal and encrypt files: in some cases, it deleted data and backups, and in one case changed firewall policies to block traffic. That creates a recovery problem that a decryption key alone cannot solve.\u201d<\/p>\n

SOCRadar\u2019s threat hunters found the operator\u2019s workspace – a publicly accessible Python HTTP file server hosted in Sweden at 185.157.161[.]148 on port 8877 – last month, and documented the exposed directory in snapshots on September 25 and 26.<\/p>\n

\u201cAcross those snapshots, we identified 1,719 files, including attack scripts, ransomware source code, extortion infrastructure, and an AI coding agent environment,\u201d Seker said. \u201cThis gave us visibility into the operation behind the victim listings, including how the operator prepared attacks and handled stolen data.\u201d<\/p>\n

Meet n0n<\/h3>\n

It also provided a close look at n0n<\/a>, a newcomer to the data-theft and extortion game that has claimed 108 victims since it emerged last month. <\/p>\n

On October 12, the group added 38 maritime, port and logistics organizations<\/a> across 18 countries to its leak site in a single batch. Researchers<\/a> have linked at least 21 of them to customers of South Korean maritime software provider CyberLogitec, although the software provider has not confirmed an intrusion.<\/p>\n

The crooks set an October 19 deadline for the maritime firms, with ransom demands ranging from $400,000 to $28 million, payable in Bitcoin. After the deadline, however, none of the 38 listings were marked \u201csettled\u201d and none of their payment addresses showed any transaction. All affected organizations\u2019 stolen data was published.<\/p>\n

While a handful of the gang\u2019s claimed victims have been marked \u201chonored – data destroyed\u201d on n0n\u2019s leak site, indicating the victim orgs paid the ransom demand, SOCRadar hasn\u2019t validated any transactions on-chain. In its profile details, the security shop rates the gang a 10 out of 10 for “aggressiveness” and a zero out of 10 for \u201clethality.\u201d<\/p>\n

The group is believed to be based in Russia, although the server uncovered by SOCRadar, which it attributed to a single operator or small team, didn\u2019t provide any definitive geographic or national attribution.<\/p>\n

Every case that the exposed server documented followed the same lifecycle, moving from initial access to establishing persistence and credential collection via hidden admin accounts disguised as services, covert proxies, credential and session-token theft, mailboxes and emailed multi-factor authentication codes.<\/p>\n

The crooks then collected sensitive data and sent everything to the operator\u2019s central storage with the attack impact shifting between data-theft, encryption, destruction, and network disruption, depending on the targeted organization. <\/p>\n

After breaking into Transcom, a Netherlands-based financial services provider, the crims sent a secondary ransom alert directly to PayPal’s security team, even though the compromised data was only on Transcom’s network.<\/p>\n

Stupid mistakes and n0n security basics<\/h3>\n

Finally, the crims send ransom notes, post a countdown clock on the leak site, establish negotiation rooms and emails for victims – and then leak the stolen files or destroy backups when the organizations don\u2019t pay up. In some cases, and to apply increased pressure on victimized companies, n0n also broadcasts automated countdown warnings to businesses\u2019 service providers, clients, and media outlets. <\/p>\n

Despite its aggressive tactics, the operator in this case – as with other stupid criminals The Register<\/span> has gleefully<\/a> documented<\/a> in earlier stories<\/a> – still struggles<\/a> with basic security hygiene<\/a>.<\/p>\n

\u201cThere is a striking gap between operational ambition and security discipline,\u201d Seker said. \u201cThe operator invested thousands of dollars in AI services while leaving its own workspace exposed. The locker also contained hardcoded encryption keys, with evidence suggesting reuse across victims. An operation can have serious destructive capability while still making fundamental mistakes.\u201d\u00ae<\/p>\n

READ MORE HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

n0n-existent security READ MORE HERE…<\/p>\n","protected":false},"author":2,"featured_media":61666,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[63],"tags":[307],"class_list":["post-61665","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-the-register","tag-security"],"yoast_head":"\nCrim spent $7K+ on AI services in extortion attacks, then left evidence for all to see 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-30T19:37:12+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/image.theregister.com\/5306779.jpg?imageId=5306779&x=0&y=0&cropw=100&croph=100&panox=0&panoy=0&panow=100&panoh=100&width=1200&height=683\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see\",\"datePublished\":\"2026-10-30T19:37:12+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see\\\/\"},\"wordCount\":1034,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see.jpg\",\"keywords\":[\"Security\"],\"articleSection\":[\"The Register\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see\\\/\",\"name\":\"Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see.jpg\",\"datePublished\":\"2026-10-30T19:37:12+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see.jpg\",\"width\":100,\"height\":52},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Security\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/tag\\\/security\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see\/","og_locale":"en_US","og_type":"article","og_title":"Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2026-10-30T19:37:12+00:00","og_image":[{"url":"https:\/\/image.theregister.com\/5306779.jpg?imageId=5306779&x=0&y=0&cropw=100&croph=100&panox=0&panoy=0&panow=100&panoh=100&width=1200&height=683","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see","datePublished":"2026-10-30T19:37:12+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see\/"},"wordCount":1034,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2026\/10\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see.jpg","keywords":["Security"],"articleSection":["The Register"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see\/","url":"https:\/\/www.threatshub.org\/blog\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see\/","name":"Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2026\/10\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see.jpg","datePublished":"2026-10-30T19:37:12+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2026\/10\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2026\/10\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see.jpg","width":100,"height":52},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Security","item":"https:\/\/www.threatshub.org\/blog\/tag\/security\/"},{"@type":"ListItem","position":3,"name":"Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/61665","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=61665"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/61665\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/61666"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=61665"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=61665"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=61665"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}