LLMJacking: 175,000 Exposed Ollama AI Servers Targeted for Abuse — Threadlinqs Intelligence
As of 2026-05-30, LLMJacking: 175,000 Exposed Ollama AI Servers Targeted for Abuse is a high-severity campaign threat attributed to Hecker (Multiple), tracked by Threadlinqs Intelligence with 32 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 62 indicators of compromise.
Threat ID: TL-2026-0012 · Severity: HIGH · CVSS: 8.6 · Status: ACTIVE · Category: CAMPAIGN
Attribution: Hecker · Multiple · FINANCIAL
LLMjacking is a rapidly growing cybercriminal ecosystem targeting AI inference infrastructure — both cloud-hosted LLM services (AWS Bedrock, Azure OpenAI, GCP Vertex AI, Anthropic, OpenAI, Mistral,
LLMjacking represents a fundamental shift in cybercrime economics: instead of stealing data or mining cryptocurrency, attackers steal access to expensive AI inference services. The term was coined by the Sysdig Threat Research Team (TRT) in May 2024 when they discovered attackers using stolen AWS credentials (obtained via CVE-2021-3129 in Laravel) to access cloud-hosted LLM services, specifically Claude v2/v3 on AWS Bedrock.
**The Economics of LLMjacking:**
LLM inference is extraordinarily expensive. At AWS Bedrock pricing, Claude 2.x usage can cost victims over $46,000/day. With Claude 3 Opus, costs reach $100,000+/day. Sysdig observed a single ORP proxy instance accumulating $50,000 in costs in just 4.5 days, with 2.2 billion tokens consumed across multiple model types. The economic incentive is clear: attackers pay nothing while victims bear the full cost. This mirrors cryptojacking economics but with 10-100x higher daily costs per compromised account.
**Attack Vectors — Cloud LLM Services:**
(1) Stolen cloud credentials from vulnerable web applications (Laravel CVE-2021-3129, exposed .env files, GitHub credential leaks), (2) Automated credential checking tools (_AWSGetValid.py, _AWSdragoChecker.py, _AZUREdragoChecker.py, _OAIdragoChecker.py) that validate stolen keys against 10+ AI services, (3) InvokeModel API probing with max_tokens_to_sample=-1 to test access without generating billable output (ValidationException = access exists, AccessDenied = no access), (4) Logging configuration checks (GetModelInvocationLoggingConfiguration) to identify environments where prompts are logged vs. not — ORP explicitly avoids keys with logging enabled, (5) Active model enablement via PutFoundationModelEntitlement and PutUseCaseForModelAccess when target models aren't already available.
**Attack Vectors — Self-Hosted Ollama:**
Ollama is the most popular open-source AI inference server with 70K+ GitHub stars and hundreds of thousands of Docker Hub pulls. Critical security issues: (1) No authentication support — Ollama has no built-in auth mechanism, requiring a reverse proxy for any access control, (2) Default binding to 0.0.0.0 in Docker deployments (localhost on native Linux), exposing the API to the internet on port 11434, (3) CVE-2024-37032 (Probllama) — path traversal via malicious model manifest digest field → arbitrary file write → arbitrary file read → RCE via /etc/ld.so.preload poisoning. Runs as root in Docker. 4-hour patch response from Ollama team. (4) CVE-2024-39720/39719/39721/39722 — additional Ollama vulnerabilities discovered by Oligo Security. Wiz Research found over 1,000 exposed Ollama instances in their initial scan; community estimates have grown to 175,000+ exposed instances globally.
**Monetization — OAI Reverse Proxy (ORP):**
Attackers operate OAI Reverse Proxy servers (gitgud.io/khanon/oai-reverse-proxy) that centralize access to pools of stolen credentials across multiple LLM providers. ORPs provide: multi-provider support (OpenAI, Anthropic/Claude, AWS Bedrock, Azure OpenAI, Google AI, Mistral, DeepSeek), credential rotation, usage statistics, cost tracking, and user management. Access is sold via storefronts (e.g., jewishproxy.sell.app: $30/30-day token). ORPs use TryCloudflare tunnels for infrastructure obfuscation. Communities on 4chan and Discord coordinate operations.
**Rapid Model Adoption:**
LLMjackers adopt new models within days of release. DeepSeek-V3 (released Dec 26, 2024) was implemented in ORP forks within days. DeepSeek-R1 (released Jan 20, 2025) was implemented the next day. One ORP instance was found with 55 DeepSeek API keys already populated.
**Impact:**
(1) Financial — $46,000-$100,000+/day in LLM consumption costs, (2) Operational — quota exhaustion blocks legitimate AI workloads, (3) Data exposure — prompts may contain sensitive business data, (4) Compliance — unauthorized AI usage on corporate accounts may violate AI governance policies, (5) Legal — Microsoft sued LLMjackers in Jan
Weaknesses (CWE)
CWE-306, CWE-668, CWE-749
Target sectors: Technology, Cloud Service Providers, AI/ML Companies, Financial Services, Healthcare, Education, Startups, Government
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 32 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 62 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
CAMPAIGN, HIGH, threat intelligence, cybersecurity, T1595, T1588, T1190, T1078, T1203, T1059, T1574, T1068, T1562, T1562