Operation n0n: what the first criminal use of abliterated models actually shows

SOCRadar's Threat Research Unit (STRU) published a report today on Operation n0n, a ransomware and extortion operation whose exposed staging server included a working AI agent environment. The operator configured the open-source opencode coding agent with 154 model entries across seven providers, explicitly including "uncensored" and "abliterated" models described as having safety training removed, alongside a self-hosted model. Gateway spending passed $7,216 by October 22, 2026.

This is the first publicly documented case of abliterated models appearing in a real criminal attack chain. That makes the report worth reading closely, because what it actually documents differs from what the headline suggests. The full technical analysis is in SOCRadar's whitepaper, Automating Extortion: Inside an AI-Assisted n0n Ransomware Operation, with a public summary on the SOCRadar blog. Everything below comes from those sources.

What STRU found

In September 2026, STRU discovered an open Python HTTP file server exposing the live workspace of an n0n operator. Two snapshots from September 25 and 26 captured the operation's full working directory.

The workspace implicated at least 23 organizations across 14 countries, including a US sports retailer, a cloud provider, a teachers' union, a Venezuelan ISP, an Argentine ministry, and a pharmaceutical subsidiary.

The campaign in numbers

n0n has been tracked by SOCRadar since September 2026. The group uses the slogan "n0n | no js | no mercy", appends a .n0n extension to encrypted files, and ran tracked operations from September 17 to October 22, 2026.

One detail in the encryptor matters for incident response: each build uses a single hardcoded AES-256-CBC key with no per-victim derivation, and one key was likely reused across two victims. A decryptor built for one victim could potentially unlock another. Since the operator deletes shadow copies, wipes free space, and removes provider-hosted backups, offline or immutable backups remain the only reliable recovery path.

How intrusions actually happened: credentials, zero CVEs

This is the section to quote the next time the abliteration debate skips past the data. The report states plainly that no vulnerability exploitation was identified. Every documented compromise relied on weak or stolen credentials.

The case studies reinforce the pattern. The Fanatics breach started from one exposed AWS key, leading to exfiltration from 40 S3 buckets and a 30 BTC demand. The Venezuelan ISP Inter lost every firewall rule on its Cisco FMC in a single flip. ChiBiTek was breached end to end through the FortiGate credential stuffing pipeline. None of these involved an LLM finding a vulnerability. The AI layer enters after access already exists.

The AI layer: a code grinder, not an intrusion engine

The opencode agent environment is the part drawing headlines, so it deserves precise numbers.

Two conclusions follow from these numbers. First, the LLM worked as a production accelerator for someone who already had credentials: writing and debugging scripts, not discovering entry points. A $7,216 spend producing hundreds of scripts is a real cost datapoint for how cheap commodity tooling has become, and it says nothing about model capability beyond code generation. Second, the report's own framing undercuts the autonomous-AI-attacker narrative: STRU found evidence of a human-directed operation supported by AI, which is exactly the threat model defenders have planned for since coding agents went mainstream.

Compare this with the supply-side events of the same month. Checkpoints have vanished from Hugging Face in a takedown wave, and community projects keep demonstrating runtime refusal steering that works on any model. The tooling is spreading on both the defensive and offensive sides. Operation n0n shows the offensive side stayed boring: the hard parts of the intrusion were unpatched VPNs, reused credentials, and missing MFA.

What defenders should actually do

SOCRadar's recommendations target the real entry paths. Condensed:

• Enforce phishing-resistant MFA on RDP, SSL-VPN, and admin portals; monitor /remote/logincheck for credential stuffing; invalidate credentials appearing in infostealer logs
• Lock down FortiManager and FMC interfaces with IP allow-lists and MFA; flag REST token creation from unknown IPs
• Replace long-lived cloud keys with short-lived roles; separate S3 list, read, and delete permissions; alert on bulk DeleteObjects calls
• Keep air-gapped or immutable backups; n0n purges shadow copies and provider-hosted backups
• Hunt for the published behavioral indicators: C:\Users\Public\n0n\ paths, .n0n and n0n_READ_ME* files, SYSTEM scheduled tasks with names like [NAME]Sync or [NAME]Exfil, Chrome launched with --remote-debugging-port, and PowerShell downloads to hex HTTPS URLs with certificate validation disabled

What it means for authorized red-team work

For practitioners running uncensored models under authorization, the report validates three requirements that separate a professional harness from a toy, and each has a model-layer implication.

Refusal behavior matters in agent loops. Hundreds of scripts across an agent session means hundreds of opportunities for a refusal to break a run mid-chain. This is the same friction security researchers describe in vendor-approved programs, and it is why abliterated and uncensored model tiers exist for authorized use. If your harness runs long multi-step sessions, prefer a tier with verified refusal behavior over a generic endpoint. Our model tier guide covers the selection logic.

Agent workloads are cheap at the token level but add up at the session level. The n0n operator's $7,216 bought hundreds of scripts. An authorized engagement generating comparable volume across recon, scripting, and reporting will burn millions of tokens, so per-token pricing and context window matter more than benchmark deltas. For reference, our current tiers run unst33r-flash at $0.50/$1.50 per 1M tokens, unst33r-deepseek (abliterated, 1M context) at $1.20/$3.20, and unst33r-pro at $2.50/$4.50.

Authorization and audit are the line between the two sides of this story. n0n used the same category of tools an authorized red-teamer would, against 93 victims without permission. The difference is scope: a rules of engagement document, target enumeration, and audit trails. This is why acceptable-use enforcement and logged, eval'd model builds are product requirements for a security-focused API rather than legal decoration. Our own acceptable-use policy draws exactly this line, and our red-team use cases documentation assumes it.

The honest summary of Operation n0n is this: the first criminal use of abliterated models in the public record turned out to be a credential-stuffing operation with a scripting assistant. Defenders who fix MFA, key hygiene, and backup posture are protected from the actual attack path. The model debate can proceed with better data.

FAQ

Did the n0n operation use abliterated models? Yes. The opencode agent configuration included 154 model entries across seven providers, among them uncensored and abliterated models with safety training removed, plus a self-hosted model. The report does not attribute specific scripts to specific models.

Did the AI find vulnerabilities or breach systems? No. SOCRadar identified no vulnerability exploitation in the operation. Every intrusion used weak or stolen credentials: FortiGate VPN credential stuffing, exposed AWS keys, and weak RDP/WinRM passwords. The agent wrote and debugged scripts after access was obtained.

How much did the AI-assisted tooling cost? Gateway spending passed $7,216 by October 22, 2026, producing and debugging hundreds of attack scripts. That works out to a commodity price for scaled offensive tooling, which is a budgeting datapoint for defenders running the same volume of agent-assisted work in authorized engagements.

Was the attack autonomous? No. STRU assesses the operation was human-directed with AI support and observed no fully autonomous attack system.