LLMJacking: 175,000 Exposed Ollama AI Servers Targeted for Abuse

Key facts

Detection coverage

As of 2026-02-02, Threadlinqs Intelligence publishes 32 detection rule(s) for TL-2026-0012 across Splunk SPL, Microsoft KQL and Sigma, covering 62 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Exposed Ollama Instance Detection

Identifies Ollama instances accepting connections from external IP addresses

• Languages: Splunk SPL, Microsoft KQL
• Data sources: firewall, cisco_asa, network
• Severity: critical
• Confidence: high

Splunk SPL

index=network sourcetype=cisco:asa OR sourcetype=firewall
| search dest_port=11434 action=allowed
| search NOT (src_ip="10.*" OR src_ip="172.16.*" OR src_ip="192.168.*" OR src_ip="127.*")
| stats count dc(src_ip) as unique_sources values(src_ip) as external_sources by dest_ip
| where count > 0
| eval alert_severity="CRITICAL"
| eval alert_description="Ollama instance receiving connections from external IPs - potential LLMjacking target"

Microsoft KQL

// Exposed Ollama Instance Detection
// Identifies Ollama instances accepting connections from external IP addresses
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where ActionType == "ConnectionSuccess"
// Add destination filters based on threat IOCs
| project Timestamp, DeviceName, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessFileName
| summarize ConnectionCount=count(), Ports=make_set(RemotePort) by DeviceName, RemoteIP
| where ConnectionCount > 5

Known false positives:

• Intentionally public Ollama instances

Tuning notes: Ollama should never be exposed to the internet without authentication

• 🔒 AWS Bedrock Credential Validation Probe — LLMJacking Reconnaissance · unlock with TL Creds
• 🔒 AWS Bedrock Logging Configuration Check — LLMJacking Evasion · unlock with TL Creds
• 🔒 LLM API Cost Anomaly — Potential LLMJacking Resource Hijacking · unlock with TL Creds
• 🔒 Ollama API Pull Request with Path Traversal — CVE-2024-37032 Exploitation · unlock with TL Creds
• 🔒 Dynamic Linker Hijacking — /etc/ld.so.preload Modification · unlock with TL Creds
• 🔒 Ollama Model Enumeration — Unauthorized API Tags Request · unlock with TL Creds
• 🔒 Cloud Credential Testing Against Multiple AI Services — LLMJacking Keychecker · unlock with TL Creds
• 🔒 Ollama Exposed to Internet — External Access to Port 11434 · unlock with TL Creds
• 🔒 AI Infrastructure GPU Resource Hijacking — Anomalous Inference Load · unlock with TL Creds
• 🔒 Ollama API Abuse - High Volume Generation Requests · unlock with TL Creds
• 🔒 Ollama Tool-Calling Abuse Detection · unlock with TL Creds
• 🔒 LLMJacking Marketplace Communication · unlock with TL Creds
• 🔒 Ollama Reconnaissance Scanning · unlock with TL Creds
• 🔒 Ollama Server Exposed on Non-Loopback Interface — Internet-Facing AI Inference Without Authentication · unlock with TL Creds
• 🔒 Ollama Model Pull from Untrusted Registry — CVE-2024-37032 Probllama Exploitation Vector · unlock with TL Creds
• 🔒 Dynamic Linker Configuration Tampering — /etc/ld.so.preload Modification by Ollama (Probllama RCE) · unlock with TL Creds
• 🔒 AWS Bedrock InvokeModel with ValidationException — LLMjacking Credential Probe · unlock with TL Creds
• 🔒 Ollama API Access from External Network — Unauthenticated AI Compute Exposure · unlock with TL Creds
• 🔒 OAI Reverse Proxy User-Agent in HTTP Traffic — Confirmed LLMjacking Proxy Operation · unlock with TL Creds
• 🔒 Ollama API Exposed on Non-Loopback Interface — Internet-Facing AI Server · unlock with TL Creds
• 🔒 Ollama Model Pull from Untrusted Registry — CVE-2024-37032 Probllama Vector · unlock with TL Creds
• 🔒 Suspicious File Write to /etc/ld.so.preload or /etc/ld.so.conf.d/ — Ollama Probllama RCE · unlock with TL Creds
• 🔒 Rapid LLM API Invocation — Token Consumption Anomaly Indicating LLMjacking · unlock with TL Creds
• 🔒 OAI Reverse Proxy User-Agent in AI Service API Calls · unlock with TL Creds
• 🔒 Ollama API Access from External IP Without Authentication · unlock with TL Creds
• 🔒 AWS Bedrock InvokeModel Reconnaissance Probe — max_tokens_to_sample Negative Value · unlock with TL Creds
• 🔒 AWS Bedrock Logging Configuration Check — LLMjacking Evasion Indicator · unlock with TL Creds
• 🔒 AWS Bedrock Model Entitlement Activation — Unauthorized Model Enable · unlock with TL Creds
• 🔒 AWS Bedrock InvokeModel Reconnaissance — max_tokens Negative Value Probe (LLMjacking Signature) · unlock with TL Creds
• 🔒 AWS Bedrock Logging and Model Configuration Reconnaissance — LLMjacking Evasion and Activation · unlock with TL Creds
• 🔒 AWS Bedrock Volumetric Anomaly — High-Rate InvokeModel/Converse Usage Indicating LLMjacking Abuse · unlock with TL Creds

Indicators of compromise

As of 2026-02-02, Threadlinqs Intelligence tracks 62 indicators of compromise for TL-2026-0012.

Sample indicators (3 of 62)

• IP address: 83.7.139[.]184
• URL: hxxps://github[.]com/kingbased/keychecker
• IP address: 103.108.229[.]55

Defanged, TLP:CLEAR. Full set of 62 indicators: unlock with TL Creds.

Technical analysis

Over 175,000 Ollama instances are exposed on the internet without authentication (Ollama has no built-in auth), running on port 11434 with default 0.0.0.0 binding in Docker deployments. Critical vulnerabilities in Ollama include CVE-2024-37032 (Probllama — path traversal → RCE, discovered by Wiz Research) and CVE-2024-39720/39719/39721/39722 (discovered by Oligo Security). Attackers operate OpenAI Reverse Proxy (ORP) infrastructure to monetize stolen LLM access, selling access tokens for $30/30-day subscriptions. Communities on 4chan and Discord coordinate operations, share ORP instances, and distribute credential-checking tools. LLMjacking has expanded from passive credential abuse to actively enabling models (PutFoundationModelEntitlement), evading logging (checking GetModelInvocationLoggingConfiguration), and rapidly adopting new models within days of release (DeepSeek R1 implemented next-day). Microsoft filed a lawsuit against LLMjackers in January 2025 for using stolen credentials to generate abusive DALL-E content. The threat represents a new cybercrime paradigm where AI compute resources are the target — similar to cryptojacking but targeting LLM tokens instead of cryptocurrency.

LLMjacking represents a fundamental shift in cybercrime economics: instead of stealing data or mining cryptocurrency, attackers steal access to expensive AI inference services. The term was coined by the Sysdig Threat Research Team (TRT) in May 2024 when they discovered attackers using stolen AWS credentials (obtained via CVE-2021-3129 in Laravel) to access cloud-hosted LLM services, specifically Claude v2/v3 on AWS Bedrock.

**The Economics of LLMjacking:** LLM inference is extraordinarily expensive. At AWS Bedrock pricing, Claude 2.x usage can cost victims over $46,000/day. With Claude 3 Opus, costs reach $100,000+/day. Sysdig observed a single ORP proxy instance accumulating $50,000 in costs in just 4.5 days, with 2.2 billion tokens consumed across multiple model types. The economic incentive is clear: attackers pay nothing while victims bear the full cost. This mirrors cryptojacking economics but with 10-100x higher daily costs per compromised account.

**Attack Vectors — Cloud LLM Services:** (1) Stolen cloud credentials from vulnerable web applications (Laravel CVE-2021-3129, exposed .env files, GitHub credential leaks), (2) Automated credential checking tools (_AWSGetValid.py, _AWSdragoChecker.py, _AZUREdragoChecker.py, _OAIdragoChecker.py) that validate stolen keys against 10+ AI services, (3) InvokeModel API probing with max_tokens_to_sample=-1 to test access without generating billable output (ValidationException = access exists, AccessDenied = no access), (4) Logging configuration checks (GetModelInvocationLoggingConfiguration) to identify environments where prompts are logged vs. not — ORP explicitly avoids keys with logging enabled, (5) Active model enablement via PutFoundationModelEntitlement and PutUseCaseForModelAccess when target models aren't already available.

**Attack Vectors — Self-Hosted Ollama:** Ollama is the most popular open-source AI inference server with 70K+ GitHub stars and hundreds of thousands of Docker Hub pulls. Critical security issues: (1) No authentication support — Ollama has no built-in auth mechanism, requiring a reverse proxy for any access control, (2) Default binding to 0.0.0.0 in Docker deployments (localhost on native Linux), exposing the API to the internet on port 11434, (3) CVE-2024-37032 (Probllama) — path traversal via malicious model manifest digest field → arbitrary file write → arbitrary file read → RCE via /etc/ld.so.preload poisoning. Runs as root in Docker. 4-hour patch response from Ollama team. (4) CVE-2024-39720/39719/39721/39722 — additional Ollama vulnerabilities discovered by Oligo Security. Wiz Research found over 1,000 exposed Ollama instances in their initial scan; community estimates have grown to 175,000+ exposed instances globally.

**Monetization — OAI Reverse Proxy (ORP):** Attackers operate OAI Reverse Proxy servers (gitgud.io/khanon/oai-reverse-proxy) that centralize access to pools of stolen credentials across multiple LLM providers. ORPs provide: multi-provider support (OpenAI, Anthropic/Claude, AWS Bedrock, Azure OpenAI, Google AI, Mistral, DeepSeek), credential rotation, usage statistics, cost tracking, and user management. Access is sold via storefronts (e.g., jewishproxy.sell.app: $30/30-day token). ORPs use TryCloudflare tunnels for infrastructure obfuscation. Communities on 4chan and Discord coordinate operations.

**Rapid Model Adoption:** LLMjackers adopt new models within days of release. DeepSeek-V3 (released Dec 26, 2024) was implemented in ORP forks within days. DeepSeek-R1 (released Jan 20, 2025) was implemented the next day. One ORP instance was found with 55 DeepSeek API keys already populated.

**Impact:** (1) Financial — $46,000-$100,000+/day in LLM consumption costs, (2) Operational — quota exhaustion blocks legitimate AI workloads, (3) Data exposure — prompts may contain sensitive business data, (4) Compliance — unauthorized AI usage on corporate accounts may violate AI governance policies, (5) Legal — Microsoft sued LLMjackers in January 2025 for generating abusive DALL-E content with stolen credentials, (6) Sanctions evasion — Sysdig found LLMjacking being used to circumvent sanctions on entities banned from AI services.

MITRE ATT&CK techniques by tactic:

discovery

T1046 Network Service Discovery; T1087 Account Discovery; T1526 Cloud Service Discovery; T1580 Cloud Infrastructure Discovery

execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1648 Serverless Execution

privilege-escalation

T1068 Exploitation for Privilege Escalation

command-and-control

T1071 Application Layer Protocol; T1090 Proxy

defense-evasion

T1078 Valid Accounts; T1535 Unused/Unsupported Cloud Regions

initial-access

T1190 Exploit Public-Facing Application

impact

T1489 Service Stop; T1496 Resource Hijacking; T1657 Financial Theft

credential-access

T1528 Steal Application Access Token; T1552 Unsecured Credentials

collection

T1530 Data from Cloud Storage

exfiltration

T1537 Transfer Data to Cloud Account; T1567 Exfiltration Over Web Service

lateral-movement

T1550 Use Alternate Authentication Material

stealth

T1574 Hijack Execution Flow

resource-development

T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1588 Obtain Capabilities

reconnaissance

T1593 Search Open Websites/Domains; T1595 Active Scanning

defense-impairment

T1685 Disable or Modify Tools

Remediation

Patches

• Ollama v0.1.34: Fixes CVE-2024-37032 (Probllama path traversal → RCE)

Immediate actions

• Audit all Ollama deployments — if exposed on 0.0.0.0:11434, immediately restrict to localhost or deploy behind a reverse proxy with authentication
• Update Ollama to latest version (0.1.34+ minimum for CVE-2024-37032 fix)
• Rotate all cloud credentials (AWS IAM, Azure, GCP service accounts) that have Bedrock/Azure OpenAI/Vertex AI permissions
• Enable CloudTrail logging for Bedrock API calls (InvokeModel, Converse, PutFoundationModelEntitlement, GetModelInvocationLoggingConfiguration)
• Review AWS Bedrock model invocation logs for unauthorized usage — check S3 and CloudWatch for unexpected InvokeModel/Converse events

Workarounds

• For Ollama: Set OLLAMA_HOST=127.0.0.1 to bind to localhost only (default on native Linux, NOT in Docker)
• For Ollama Docker: Do not publish port 11434 without a reverse proxy. Use -p 127.0.0.1:11434:11434 instead of -p 11434:11434
• For AWS Bedrock: Set IAM policies to deny PutFoundationModelEntitlement and PutUseCaseForModelAccess for non-admin users
• Monitor CloudTrail for InvokeModel calls with max_tokens_to_sample=-1 (LLMjacking reconnaissance signature)

Longer-term hardening

• Implement least-privilege IAM policies — separate credentials for LLM access from general cloud credentials
• Enable MFA on all accounts with LLM service access
• Deploy anomaly detection on LLM API usage patterns — alert on usage spikes, new regions, new model access
• Configure Bedrock model invocation logging to S3 and CloudWatch for prompt/response audit trail
• Implement API key rotation policies for OpenAI, Anthropic, and other direct AI API services
• Deploy Ollama behind authenticated reverse proxy (nginx + OAuth/OIDC) — never expose port 11434 directly

Affected and fixed versions

• Ollama — Ollama
  Vulnerable versions: All versions when exposed without authentication
• Various — vLLM, OpenAI-compatible APIs
  Vulnerable versions: All versions when exposed without authentication

Timeline

• 2023-01-01 Ollama launches as open-source AI inference server, rapidly growing to 70K+ GitHub stars. No built-in authentication. Default Docker binding to 0.0.0.0:11434. Source: https://github.com/ollama/ollama
• 2024-05-05 Wiz Research discovers CVE-2024-37032 (Probllama) — path traversal to RCE in Ollama via malicious model registry digest fields. Responsibly disclosed to Ollama maintainers. Fix committed within 4 hours. Source: https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-2024-37032
• 2024-05-06 Sysdig TRT publishes 'LLMjacking: Stolen Cloud Credentials Used in New AI Attack' — first documentation of attackers using stolen credentials to abuse cloud-hosted LLMs. Initial access via Laravel CVE-2021-3129. Target: AWS Bedrock Claude v2/v3. Cost: $46,000/day. Source: https://sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack/
• 2024-05-06 Sysdig Threat Research Team publishes first LLMjacking report — stolen cloud credentials used to access AWS Bedrock (Claude v2/v3) via reverse proxy. Attackers verified credentials against 10 AI services. Cost impact: $46,000+/day. Source: https://sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack/
• 2024-05-08 Ollama releases v0.1.34 patching CVE-2024-37032. 3-day turnaround from report to patch. Source: https://github.com/ollama/ollama/compare/v0.1.33...v0.1.34
• 2024-05-08 Ollama releases version 0.1.34 patching CVE-2024-37032. However, Ollama still has no built-in authentication — exposure risk remains for all internet-accessible instances regardless of version.
• 2024-06-10 Wiz Research finds over 1,000 exposed Ollama instances on the internet running vulnerable versions, many hosting private AI models not in public registry. Source: https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-2024-37032
• 2024-06-24 Wiz publishes Probllama technical writeup. Documents path traversal → arbitrary file write/read → RCE chain. Emphasizes Ollama Docker runs as root on 0.0.0.0. Source: https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-2024-37032
• 2024-06-24 Wiz Research publishes full technical analysis of CVE-2024-37032. Reveals 1,000+ exposed vulnerable Ollama instances on internet scan. Exploitation chain: path traversal → arbitrary file write → /etc/ld.so.preload corruption → RCE as root in Docker. Source: https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-2024-37032
• 2024-07-11 Sysdig observes massive LLMjacking spike — 61,000 Bedrock API requests in a 3-hour window from compromised credentials. 10x increase in attack volume compared to previous months. Attackers now using LLMs to write their own exploitation scripts. Source: https://sysdig.com/blog/growing-dangers-of-llmjacking/
• 2024-09-15 Sysdig publishes 'Growing Dangers of LLMjacking' — documents 10x increase in attacks, ORP proxy ecosystem selling access, LLM-assisted script development, Converse API adoption, active model enablement via PutFoundationModelEntitlement. Cost escalation to $100K+/day with Claude 3 Opus. Source: https://sysdig.com/blog/growing-dangers-of-llmjacking/
• 2024-10-01 Sysdig TRT publishes updated LLMjacking report documenting attack evolution: new Converse API abuse, sanctions evasion use case, Claude 3 Opus targeting ($100K+/day), 85,000+ total API requests observed. Attackers selling access via OAI Reverse Proxy to sanctioned countries. Source: https://sysdig.com/blog/growing-dangers-of-llmjacking/
• 2024-12-26 DeepSeek-V3 released. LLMjackers implement support in ORP forks within days. Source: https://sysdig.com/blog/llmjacking-targets-deepseek/
• 2025-01-10 Microsoft files lawsuit against cybercriminals who stole credentials and used them to generate abusive DALL-E content via LLMjacking. Source: https://blogs.microsoft.com/on-the-issues/2025/01/10/taking-legal-action-to-protect-the-public-from-abusive-ai-generated-content/
• 2025-01-21 DeepSeek-R1 released Jan 20. ORP fork implements support the next day. One ORP instance found with 55 DeepSeek API keys. Source: https://sysdig.com/blog/llmjacking-targets-deepseek/
• 2025-02-03 Sysdig publishes 'LLMjacking targets DeepSeek' — documents ORP proxy monetization ($30/30-day tokens), 4chan/Discord communities, credential checker tooling (Drago scripts), and single proxy accumulating $50,000 in 4.5 days. Source: https://sysdig.com/blog/llmjacking-targets-deepseek/
• 2025-06-15 Internet scanning reveals 175,000+ Ollama servers exposed to the internet without authentication. Shodan and Censys scans show exposed instances on AWS, Azure, GCP, Hetzner, and residential connections globally. Many hosting private models with sensitive training data.
• 2026-02-11 Threadlinqs Intelligence documents LLMjacking as TL-2026-0012 — comprehensive threat intelligence covering cloud credential abuse, Ollama exploitation, ORP monetization ecosystem, and the AI compute theft paradigm.
• 2026-05-29 As of 2026-05-29, LLMjacking remains actively exploited and escalating: its "Operation Bizarre Bazaar" actor Hecker (aka Sakuya/LiveGamer101) and silver.inc marketplace are still online (Pillar Security, BleepingComputer Jan 2026; Sysdig logged the first AI-agent cloud intrusion May 10 2026). Exposed Ollama hosts grew to ~300,000 and the new Bleeding Llama flaw (CVE-2026-7482, CVSS 9.1) landed May 5 2026; status stays ACTIVE.

Sources cited

Showing 15 of 17 sources, primary sources first.

• NVD — CVE-2024-37032 NVD (NIST) · Advisory · 2024-06-04
• Ollama GitHub — Fix for Path Traversal (PR #4175) GitHub · Vendor report · 2024-05-05
• AWS Bedrock Runtime API Documentation docs.aws.amazon.com · Vendor report · 2024-01-01
• Ollama Patch: CVE-2024-37032 Fix (v0.1.34) GitHub · Vendor report · 2024-05-08
• Sysdig TRT — LLMjacking: Stolen Cloud Credentials Used in New AI Attack sysdig.com · Blog · 2024-05-06
• Sysdig TRT — The Growing Dangers of LLMjacking sysdig.com · Blog · 2024-10-01
• Wiz Research — Probllama: Ollama RCE CVE-2024-37032 Wiz · Blog · 2024-06-24
• Vicarius — Probllama CVE-2024-37032 Technical Analysis vicarius.io · Blog · 2024-07-15
• Sysdig TRT: LLMjacking Targets DeepSeek — Rapid Adoption of New Models sysdig.com · Blog · 2025-02-03
• CybeNari: Worst Place to Leave Your Secrets (LLMjacking credential sources) cybenari.com · Blog · 2024-08-15
• Wiz: State of AI in the Cloud Report 2024 Wiz · Blog · 2024-06-01
• Microsoft: Taking Legal Action to Protect the Public from Abusive AI-Generated Content Microsoft · News · 2025-01-10
• OAI Reverse Proxy — LLM Monetization Tool gitgud.io · Other · 2024-03-01
• Credential Checker — kingbased/keychecker (attack tool) GitHub · Other · 2024-04-01
• Ollama GitHub Repository (70K+ stars) GitHub · Other · 2024-01-01

Related threats

• Anthropic API Scanning Campaign - Targeting Self-Hosted LLM Infrastructure

Related coverage of this activity

Previous and next in campaign

• Coordinated Scanning Campaign Against Fortinet SSL VPN and Palo Alto GlobalProtect Infrastructure Detected via GreyNoise Vendor CVE / Tag Spike Signals Previous report
• ShinyHunters SSO Vishing Campaign - Cloud Data Theft via Social Engineering Next report