LLMJacking: 175,000 Exposed Ollama AI Servers Targeted for Abuse

LLMJacking: 175,000 Exposed Ollama AI Servers Targeted for (TL-2026-0012), also tracked as LLMJacking, is a high-severity campaign scored CVSS 8.6, first published 2026-02-02. It is attributed to Hecker with high confidence, affects Ollama Ollama, maps to 29 MITRE ATT&CK techniques (T1046, T1059, T1068), and is covered by 32 detection rules and 62 indicators of compromise.

Key facts for TL-2026-0012

Threat ID
TL-2026-0012
Also known as
LLMJacking, Operation Bizarre Bazaar, AI Compute Theft
Severity
HIGH
CVSS
8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H)
Status
ACTIVE
Category
CAMPAIGN
First published
2026-02-02
Last reviewed
2026-02-02
Attribution
Hecker
Attribution confidence
HIGH
Motivation
FINANCIAL
Target sectors
Technology, Cloud Service Providers, AI/ML Companies, Financial Services, Healthcare, Education, Startups, Government
Target regions
Global
Detection rules
32
Indicators of compromise
62

LLMjacking is a rapidly growing cybercriminal ecosystem targeting AI inference infrastructure — both cloud-hosted LLM services (AWS Bedrock, Azure OpenAI, GCP Vertex AI, Anthropic, OpenAI, Mistral, DeepSeek) and self-hosted inference servers like Ollama. Coined by Sysdig TRT in May 2024, LLMjacking uses stolen cloud credentials or direct exploitation of unprotected AI servers to abuse LLM resources at the victim's expense, with costs exceeding $100,000/day for premium models like Claude 3 Opus. Over 175,000 Ollama instances are exposed on the internet without authentication (Ollama has no built-in auth), running on port 11434 with default 0.0.0.0 binding in Docker deployments. Critical vulnerabilities in Ollama include CVE-2024-37032 (Probllama — path traversal → RCE, discovered by Wiz Research) and CVE-2024-39720/39719/39721/39722 (discovered by Oligo Security). Attackers operate OpenAI Reverse Proxy (ORP) infrastructure to monetize stolen LLM access, selling access tokens for $30/30-day subscriptions. Communities on 4chan and Discord coordinate operations, share ORP instances, and distribute credential-checking tools. LLMjacking has expanded from passive credential abuse to actively enabling models (PutFoundationModelEntitlement), evading logging (checking GetModelInvocationLoggingConfiguration), and rapidly adopting new models within days of release (DeepSeek R1 implemented next-day). Microsoft filed a lawsuit against LLMjackers in January 2025 for using stolen credentials to generate abusive DALL-E content. The threat represents a new cybercrime paradigm where AI compute resources are the target — similar to cryptojacking but targeting LLM tokens instead of cryptocurrency.

How LLMJacking: 175,000 Exposed Ollama AI Servers Targeted for works

LLMjacking represents a fundamental shift in cybercrime economics: instead of stealing data or mining cryptocurrency, attackers steal access to expensive AI inference services. The term was coined by the Sysdig Threat Research Team (TRT) in May 2024 when they discovered attackers using stolen AWS credentials (obtained via CVE-2021-3129 in Laravel) to access cloud-hosted LLM services, specifically Claude v2/v3 on AWS Bedrock.

**The Economics of LLMjacking:** LLM inference is extraordinarily expensive. At AWS Bedrock pricing, Claude 2.x usage can cost victims over $46,000/day. With Claude 3 Opus, costs reach $100,000+/day. Sysdig observed a single ORP proxy instance accumulating $50,000 in costs in just 4.5 days, with 2.2 billion tokens consumed across multiple model types. The economic incentive is clear: attackers pay nothing while victims bear the full cost. This mirrors cryptojacking economics but with 10-100x higher daily costs per compromised account.

**Attack Vectors — Cloud LLM Services:** (1) Stolen cloud credentials from vulnerable web applications (Laravel CVE-2021-3129, exposed .env files, GitHub credential leaks), (2) Automated credential checking tools (_AWSGetValid.py, _AWSdragoChecker.py, _AZUREdragoChecker.py, _OAIdragoChecker.py) that validate stolen keys against 10+ AI services, (3) InvokeModel API probing with max_tokens_to_sample=-1 to test access without generating billable output (ValidationException = access exists, AccessDenied = no access), (4) Logging configuration checks (GetModelInvocationLoggingConfiguration) to identify environments where prompts are logged vs. not — ORP explicitly avoids keys with logging enabled, (5) Active model enablement via PutFoundationModelEntitlement and PutUseCaseForModelAccess when target models aren't already available.

**Attack Vectors — Self-Hosted Ollama:** Ollama is the most popular open-source AI inference server with 70K+ GitHub stars and hundreds of thousands of Docker Hub pulls. Critical security issues: (1) No authentication support — Ollama has no built-in auth mechanism, requiring a reverse proxy for any access control, (2) Default binding to 0.0.0.0 in Docker deployments (localhost on native Linux), exposing the API to the internet on port 11434, (3) CVE-2024-37032 (Probllama) — path traversal via malicious model manifest digest field → arbitrary file write → arbitrary file read → RCE via /etc/ld.so.preload poisoning. Runs as root in Docker. 4-hour patch response from Ollama team. (4) CVE-2024-39720/39719/39721/39722 — additional Ollama vulnerabilities discovered by Oligo Security. Wiz Research found over 1,000 exposed Ollama instances in their initial scan; community estimates have grown to 175,000+ exposed instances globally.

**Monetization — OAI Reverse Proxy (ORP):** Attackers operate OAI Reverse Proxy servers (gitgud.io/khanon/oai-reverse-proxy) that centralize access to pools of stolen credentials across multiple LLM providers. ORPs provide: multi-provider support (OpenAI, Anthropic/Claude, AWS Bedrock, Azure OpenAI, Google AI, Mistral, DeepSeek), credential rotation, usage statistics, cost tracking, and user management. Access is sold via storefronts (e.g., jewishproxy.sell.app: $30/30-day token). ORPs use TryCloudflare tunnels for infrastructure obfuscation. Communities on 4chan and Discord coordinate operations.

**Rapid Model Adoption:** LLMjackers adopt new models within days of release. DeepSeek-V3 (released Dec 26, 2024) was implemented in ORP forks within days. DeepSeek-R1 (released Jan 20, 2025) was implemented the next day. One ORP instance was found with 55 DeepSeek API keys already populated.

**Impact:** (1) Financial — $46,000-$100,000+/day in LLM consumption costs, (2) Operational — quota exhaustion blocks legitimate AI workloads, (3) Data exposure — prompts may contain sensitive business data, (4) Compliance — unauthorized AI usage on corporate accounts may violate AI governance policies, (5) Legal — Microsoft sued LLMjackers in January 2025 for generating abusive DALL-E content with stolen credentials, (6) Sanctions evasion — Sysdig found LLMjacking being used to circumvent sanctions on entities banned from AI services.

MITRE ATT&CK techniques used in TL-2026-0012

discovery

T1046 Network Service Discovery; T1087 Account Discovery; T1526 Cloud Service Discovery; T1580 Cloud Infrastructure Discovery

execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1648 Serverless Execution

privilege-escalation

T1068 Exploitation for Privilege Escalation

command-and-control

T1071 Application Layer Protocol; T1090 Proxy

defense-evasion

T1078 Valid Accounts; T1535 Unused/Unsupported Cloud Regions

initial-access

T1190 Exploit Public-Facing Application

impact

T1489 Service Stop; T1496 Resource Hijacking; T1657 Financial Theft

credential-access

T1528 Steal Application Access Token; T1552 Unsecured Credentials

collection

T1530 Data from Cloud Storage

exfiltration

T1537 Transfer Data to Cloud Account; T1567 Exfiltration Over Web Service

lateral-movement

T1550 Use Alternate Authentication Material

stealth

T1574 Hijack Execution Flow

resource-development

T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1588 Obtain Capabilities

reconnaissance

T1593 Search Open Websites/Domains; T1595 Active Scanning

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in LLMJacking: 175,000 Exposed Ollama AI Servers Targeted for

  • Ollama — Ollama
    Vulnerable versions: All versions when exposed without authentication
  • Various — vLLM, OpenAI-compatible APIs
    Vulnerable versions: All versions when exposed without authentication

Remediation for LLMJacking: 175,000 Exposed Ollama AI Servers Targeted for

Patches

  • Ollama v0.1.34: Fixes CVE-2024-37032 (Probllama path traversal → RCE)

Immediate actions

  • Audit all Ollama deployments — if exposed on 0.0.0.0:11434, immediately restrict to localhost or deploy behind a reverse proxy with authentication
  • Update Ollama to latest version (0.1.34+ minimum for CVE-2024-37032 fix)
  • Rotate all cloud credentials (AWS IAM, Azure, GCP service accounts) that have Bedrock/Azure OpenAI/Vertex AI permissions
  • Enable CloudTrail logging for Bedrock API calls (InvokeModel, Converse, PutFoundationModelEntitlement, GetModelInvocationLoggingConfiguration)
  • Review AWS Bedrock model invocation logs for unauthorized usage — check S3 and CloudWatch for unexpected InvokeModel/Converse events

Workarounds

  • For Ollama: Set OLLAMA_HOST=127.0.0.1 to bind to localhost only (default on native Linux, NOT in Docker)
  • For Ollama Docker: Do not publish port 11434 without a reverse proxy. Use -p 127.0.0.1:11434:11434 instead of -p 11434:11434
  • For AWS Bedrock: Set IAM policies to deny PutFoundationModelEntitlement and PutUseCaseForModelAccess for non-admin users
  • Monitor CloudTrail for InvokeModel calls with max_tokens_to_sample=-1 (LLMjacking reconnaissance signature)

Longer-term hardening

  • Implement least-privilege IAM policies — separate credentials for LLM access from general cloud credentials
  • Enable MFA on all accounts with LLM service access
  • Deploy anomaly detection on LLM API usage patterns — alert on usage spikes, new regions, new model access
  • Configure Bedrock model invocation logging to S3 and CloudWatch for prompt/response audit trail
  • Implement API key rotation policies for OpenAI, Anthropic, and other direct AI API services
  • Deploy Ollama behind authenticated reverse proxy (nginx + OAuth/OIDC) — never expose port 11434 directly

Weaknesses (CWE) in LLMJacking: 175,000 Exposed Ollama AI Servers Targeted for

CWE-306, CWE-668, CWE-749

Timeline of LLMJacking: 175,000 Exposed Ollama AI Servers Targeted for

  • Ollama launches as open-source AI inference server, rapidly growing to 70K+ GitHub stars. No built-in authentication. Default Docker binding to 0.0.0.0:11434. Source: https://github.com/ollama/ollama
  • Wiz Research discovers CVE-2024-37032 (Probllama) — path traversal to RCE in Ollama via malicious model registry digest fields. Responsibly disclosed to Ollama maintainers. Fix committed within 4 hours. Source: https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-2024-37032
  • Sysdig TRT publishes 'LLMjacking: Stolen Cloud Credentials Used in New AI Attack' — first documentation of attackers using stolen credentials to abuse cloud-hosted LLMs. Initial access via Laravel CVE-2021-3129. Target: AWS Bedrock Claude v2/v3. Cost: $46,000/day. Source: https://sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack/
  • Sysdig Threat Research Team publishes first LLMjacking report — stolen cloud credentials used to access AWS Bedrock (Claude v2/v3) via reverse proxy. Attackers verified credentials against 10 AI services. Cost impact: $46,000+/day. Source: https://sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack/
  • Ollama releases v0.1.34 patching CVE-2024-37032. 3-day turnaround from report to patch. Source: https://github.com/ollama/ollama/compare/v0.1.33...v0.1.34
  • Ollama releases version 0.1.34 patching CVE-2024-37032. However, Ollama still has no built-in authentication — exposure risk remains for all internet-accessible instances regardless of version.
  • Wiz Research finds over 1,000 exposed Ollama instances on the internet running vulnerable versions, many hosting private AI models not in public registry. Source: https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-2024-37032
  • Wiz publishes Probllama technical writeup. Documents path traversal → arbitrary file write/read → RCE chain. Emphasizes Ollama Docker runs as root on 0.0.0.0. Source: https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-2024-37032
  • Wiz Research publishes full technical analysis of CVE-2024-37032. Reveals 1,000+ exposed vulnerable Ollama instances on internet scan. Exploitation chain: path traversal → arbitrary file write → /etc/ld.so.preload corruption → RCE as root in Docker. Source: https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-2024-37032
  • Sysdig observes massive LLMjacking spike — 61,000 Bedrock API requests in a 3-hour window from compromised credentials. 10x increase in attack volume compared to previous months. Attackers now using LLMs to write their own exploitation scripts. Source: https://sysdig.com/blog/growing-dangers-of-llmjacking/
  • Sysdig publishes 'Growing Dangers of LLMjacking' — documents 10x increase in attacks, ORP proxy ecosystem selling access, LLM-assisted script development, Converse API adoption, active model enablement via PutFoundationModelEntitlement. Cost escalation to $100K+/day with Claude 3 Opus. Source: https://sysdig.com/blog/growing-dangers-of-llmjacking/
  • Sysdig TRT publishes updated LLMjacking report documenting attack evolution: new Converse API abuse, sanctions evasion use case, Claude 3 Opus targeting ($100K+/day), 85,000+ total API requests observed. Attackers selling access via OAI Reverse Proxy to sanctioned countries. Source: https://sysdig.com/blog/growing-dangers-of-llmjacking/
  • DeepSeek-V3 released. LLMjackers implement support in ORP forks within days. Source: https://sysdig.com/blog/llmjacking-targets-deepseek/
  • Microsoft files lawsuit against cybercriminals who stole credentials and used them to generate abusive DALL-E content via LLMjacking. Source: https://blogs.microsoft.com/on-the-issues/2025/01/10/taking-legal-action-to-protect-the-public-from-abusive-ai-generated-content/
  • DeepSeek-R1 released Jan 20. ORP fork implements support the next day. One ORP instance found with 55 DeepSeek API keys. Source: https://sysdig.com/blog/llmjacking-targets-deepseek/
  • Sysdig publishes 'LLMjacking targets DeepSeek' — documents ORP proxy monetization ($30/30-day tokens), 4chan/Discord communities, credential checker tooling (Drago scripts), and single proxy accumulating $50,000 in 4.5 days. Source: https://sysdig.com/blog/llmjacking-targets-deepseek/
  • Internet scanning reveals 175,000+ Ollama servers exposed to the internet without authentication. Shodan and Censys scans show exposed instances on AWS, Azure, GCP, Hetzner, and residential connections globally. Many hosting private models with sensitive training data.
  • Threadlinqs Intelligence documents LLMjacking as TL-2026-0012 — comprehensive threat intelligence covering cloud credential abuse, Ollama exploitation, ORP monetization ecosystem, and the AI compute theft paradigm.
  • As of 2026-05-29, LLMjacking remains actively exploited and escalating: its "Operation Bizarre Bazaar" actor Hecker (aka Sakuya/LiveGamer101) and silver.inc marketplace are still online (Pillar Security, BleepingComputer Jan 2026; Sysdig logged the first AI-agent cloud intrusion May 10 2026). Exposed Ollama hosts grew to ~300,000 and the new Bleeding Llama flaw (CVE-2026-7482, CVSS 9.1) landed May 5 2026; status stays ACTIVE.

Sources cited for LLMJacking: 175,000 Exposed Ollama AI Servers Targeted for

Threats related to LLMJacking: 175,000 Exposed Ollama AI Servers Targeted for

Detection coverage for TL-2026-0012

As of 2026-02-02, Threadlinqs Intelligence publishes 32 detection rule(s) for TL-2026-0012 across Splunk SPL, Microsoft KQL and Sigma, covering 62 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats