Threat video1:00
n0n AI Extortion and Azazel MCP C2: Detection & IOCs
n0n scripts its extortion with the OpenCode AI agent, and Azazel runs C2 over MCP. Covered by 9 detection rules, 21 IOCs and a free Splunk SPL rule.
Read the full threat intel for n0n AI Extortion and Azazel MCP C2: Detection & IOCs →
Chapters
- 0:00The hookAbout 1,072 claimed victims.
- 0:04The storyN0n left its server open.
- 0:11Attack pathWeak credentials gave them a foothold.
- 0:26AttributionAttributed to n0n.
- 0:31Indicators of compromise13 indicators to hunt: 6 IPs, 1 domain and 6 file names.
- 0:37MITRE ATT&CK techniques21 ATT&CK techniques, from reconnaissance to impact.
- 0:42Remediation4 steps now: Block and hunt the network IOCs listed.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About 1,072 claimed victims.
0:05N0n left its server open.
0:07Only about 20-23 real targets.
0:12Weak credentials gave them a foothold.
0:14An AI tool carried their command channel.
0:17They harvested GitLab secrets.
0:19They demanded ransoms from 38 organisations.
0:26Attributed to n0n. Confidence: low.
0:3113 indicators to hunt: 6 IPs, 1 domain and 6 file names.
0:3821 ATT&CK techniques, from reconnaissance to impact.
0:434 steps now: Block and hunt the network IOCs listed.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.