# LLMJacking: 175,000 Exposed Ollama AI Servers Targeted for Abuse

> LLMjacking is a rapidly growing cybercriminal ecosystem targeting AI inference infrastructure — both cloud-hosted LLM services (AWS Bedrock, Azure OpenAI, GCP Vertex AI, Anthropic, OpenAI, Mistral, DeepSeek) and self-hosted inference servers like Ollama. Coined by Sysdig TRT in May 2024, LLMjacking uses stolen cloud credentials or direct exploitation of unprotected AI servers to abuse LLM resources at the victim's expense, with costs exceeding $100,000/day for premium models like Claude 3 Opus. Over 175,000 Ollama instances are exposed on the internet without authentication (Ollama has no built-in auth), running on port 11434 with default 0.0.0.0 binding in Docker deployments. Critical vulnerabilities in Ollama include CVE-2024-37032 (Probllama — path traversal → RCE, discovered by Wiz Research) and CVE-2024-39720/39719/39721/39722 (discovered by Oligo Security). Attackers operate OpenAI Reverse Proxy (ORP) infrastructure to monetize stolen LLM access, selling access tokens for $30/30-day subscriptions. Communities on 4chan and Discord coordinate operations, share ORP instances, and distribute credential-checking tools. LLMjacking has expanded from passive credential abuse to actively enabling models (PutFoundationModelEntitlement), evading logging (checking GetModelInvocationLoggingConfiguration), and rapidly adopting new models within days of release (DeepSeek R1 implemented next-day). Microsoft filed a lawsuit against LLMjackers in January 2025 for using stolen credentials to generate abusive DALL-E content. The threat represents a new cybercrime paradigm where AI compute resources are the target — similar to cryptojacking but targeting LLM tokens instead of cryptocurrency.

- **Published:** 2026-02-02T18:46:00Z
- **Last reviewed:** 2026-02-02T18:46:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0012
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-llmjacking-ollama-servers-tl-2026-0012.webp?v=ccf4269a (Threadlinqs threat intel: LLMjacking 175,000 Ollama Servers: Detection & IOCs (TL-2026-0012) — High severity, 62 IOCs, 32 detection rules.)
- **ID:** TL-2026-0012
- **Severity:** HIGH (CVSS 8.6)
- **Category:** CAMPAIGN
- **Status:** ACTIVE
- **Actor:** Hecker
- **Detections:** 32 (1 shown free below) · **IOCs:** 62 (3 shown free below)
- **CVEs:** CVE-2021-3129, CVE-2024-37032, CVE-2024-39720

## Description

LLMjacking represents a fundamental shift in cybercrime economics: instead of stealing data or mining cryptocurrency, attackers steal access to expensive AI inference services. The term was coined by the Sysdig Threat Research Team (TRT) in May 2024 when they discovered attackers using stolen AWS credentials (obtained via CVE-2021-3129 in Laravel) to access cloud-hosted LLM services, specifically Claude v2/v3 on AWS Bedrock.

**The Economics of LLMjacking:**
LLM inference is extraordinarily expensive. At AWS Bedrock pricing, Claude 2.x usage can cost victims over $46,000/day. With Claude 3 Opus, costs reach $100,000+/day. Sysdig observed a single ORP proxy instance accumulating $50,000 in costs in just 4.5 days, with 2.2 billion tokens consumed across multiple model types. The economic incentive is clear: attackers pay nothing while victims bear the full cost. This mirrors cryptojacking economics but with 10-100x higher daily costs per compromised account.

**Attack Vectors — Cloud LLM Services:**
(1) Stolen cloud credentials from vulnerable web applications (Laravel CVE-2021-3129, exposed .env files, GitHub credential leaks), (2) Automated credential checking tools (_AWSGetValid.py, _AWSdragoChecker.py, _AZUREdragoChecker.py, _OAIdragoChecker.py) that validate stolen keys against 10+ AI services, (3) InvokeModel API probing with max_tokens_to_sample=-1 to test access without generating billable output (ValidationException = access exists, AccessDenied = no access), (4) Logging configuration checks (GetModelInvocationLoggingConfiguration) to identify environments where prompts are logged vs. not — ORP explicitly avoids keys with logging enabled, (5) Active model enablement via PutFoundationModelEntitlement and PutUseCaseForModelAccess when target models aren't already available.

**Attack Vectors — Self-Hosted Ollama:**
Ollama is the most popular open-source AI inference server with 70K+ GitHub stars and hundreds of thousands of Docker Hub pulls. Critical security issues: (1) No authentication support — Ollama has no built-in auth mechanism, requiring a reverse proxy for any access control, (2) Default binding to 0.0.0.0 in Docker deployments (localhost on native Linux), exposing the API to the internet on port 11434, (3) CVE-2024-37032 (Probllama) — path traversal via malicious model manifest digest field → arbitrary file write → arbitrary file read → RCE via /etc/ld.so.preload poisoning. Runs as root in Docker. 4-hour patch response from Ollama team. (4) CVE-2024-39720/39719/39721/39722 — additional Ollama vulnerabilities discovered by Oligo Security. Wiz Research found over 1,000 exposed Ollama instances in their initial scan; community estimates have grown to 175,000+ exposed instances globally.

**Monetization — OAI Reverse Proxy (ORP):**
Attackers operate OAI Reverse Proxy servers (gitgud.io/khanon/oai-reverse-proxy) that centralize access to pools of stolen credentials across multiple LLM providers. ORPs provide: multi-provider support (OpenAI, Anthropic/Claude, AWS Bedrock, Azure OpenAI, Google AI, Mistral, DeepSeek), credential rotation, usage statistics, cost tracking, and user management. Access is sold via storefronts (e.g., jewishproxy.sell.app: $30/30-day token). ORPs use TryCloudflare tunnels for infrastructure obfuscation. Communities on 4chan and Discord coordinate operations.

**Rapid Model Adoption:**
LLMjackers adopt new models within days of release. DeepSeek-V3 (released Dec 26, 2024) was implemented in ORP forks within days. DeepSeek-R1 (released Jan 20, 2025) was implemented the next day. One ORP instance was found with 55 DeepSeek API keys already populated.

**Impact:**
(1) Financial — $46,000-$100,000+/day in LLM consumption costs, (2) Operational — quota exhaustion blocks legitimate AI workloads, (3) Data exposure — prompts may contain sensitive business data, (4) Compliance — unauthorized AI usage on corporate accounts may violate AI governance policies, (5) Legal — Microsoft sued LLMjackers in January 2025 for generating abusive DALL-E content with stolen credentials, (6) Sanctions evasion — Sysdig found LLMjacking being used to circumvent sanctions on entities banned from AI services.

## MITRE ATT&CK

- T1595 Active Scanning
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1574 Hijack Execution Flow
- T1068 Exploitation for Privilege Escalation
- T1685 Disable or Modify Tools
- T1552 Unsecured Credentials
- T1526 Cloud Service Discovery
- T1087 Account Discovery
- T1530 Data from Cloud Storage
- T1071 Application Layer Protocol
- T1090 Proxy
- T1537 Transfer Data to Cloud Account
- T1496 Resource Hijacking
- T1657 Financial Theft
- T1046 Network Service Discovery
- T1580 Cloud Infrastructure Discovery
- T1550 Use Alternate Authentication Material
- T1489 Service Stop
- T1567 Exfiltration Over Web Service
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1593 Search Open Websites/Domains
- T1535 Unused/Unsupported Cloud Regions
- T1648 Serverless Execution
- T1528 Steal Application Access Token

## Free detection (Splunk SPL, Microsoft KQL)

**Exposed Ollama Instance Detection** (`TL-2026-0012-DET-001`)

Identifies Ollama instances accepting connections from external IP addresses

- **Languages:** Splunk SPL, Microsoft KQL
- **Data sources:** firewall, cisco_asa, network
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=network sourcetype=cisco:asa OR sourcetype=firewall
| search dest_port=11434 action=allowed
| search NOT (src_ip="10.*" OR src_ip="172.16.*" OR src_ip="192.168.*" OR src_ip="127.*")
| stats count dc(src_ip) as unique_sources values(src_ip) as external_sources by dest_ip
| where count > 0
| eval alert_severity="CRITICAL"
| eval alert_description="Ollama instance receiving connections from external IPs - potential LLMjacking target"
```

### Microsoft KQL

```kql
// Exposed Ollama Instance Detection
// Identifies Ollama instances accepting connections from external IP addresses
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where ActionType == "ConnectionSuccess"
// Add destination filters based on threat IOCs
| project Timestamp, DeviceName, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessFileName
| summarize ConnectionCount=count(), Ports=make_set(RemotePort) by DeviceName, RemoteIP
| where ConnectionCount > 5
```

**Known false positives:**

- Intentionally public Ollama instances

**Tuning notes:** Ollama should never be exposed to the internet without authentication

### 31 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- AWS Bedrock Credential Validation Probe — LLMJacking Reconnaissance (locked: unlock with TL Creds)
- AWS Bedrock Logging Configuration Check — LLMJacking Evasion (locked: unlock with TL Creds)
- LLM API Cost Anomaly — Potential LLMJacking Resource Hijacking (locked: unlock with TL Creds)
- Ollama API Pull Request with Path Traversal — CVE-2024-37032 Exploitation (locked: unlock with TL Creds)
- Dynamic Linker Hijacking — /etc/ld.so.preload Modification (locked: unlock with TL Creds)
- Ollama Model Enumeration — Unauthorized API Tags Request (locked: unlock with TL Creds)
- Cloud Credential Testing Against Multiple AI Services — LLMJacking Keychecker (locked: unlock with TL Creds)
- Ollama Exposed to Internet — External Access to Port 11434 (locked: unlock with TL Creds)
- AI Infrastructure GPU Resource Hijacking — Anomalous Inference Load (locked: unlock with TL Creds)
- Ollama API Abuse - High Volume Generation Requests (locked: unlock with TL Creds)
- Ollama Tool-Calling Abuse Detection (locked: unlock with TL Creds)
- LLMJacking Marketplace Communication (locked: unlock with TL Creds)
- Ollama Reconnaissance Scanning (locked: unlock with TL Creds)
- Ollama Server Exposed on Non-Loopback Interface — Internet-Facing AI Inference Without Authentication (locked: unlock with TL Creds)
- Ollama Model Pull from Untrusted Registry — CVE-2024-37032 Probllama Exploitation Vector (locked: unlock with TL Creds)
- Dynamic Linker Configuration Tampering — /etc/ld.so.preload Modification by Ollama (Probllama RCE) (locked: unlock with TL Creds)
- AWS Bedrock InvokeModel with ValidationException — LLMjacking Credential Probe (locked: unlock with TL Creds)
- Ollama API Access from External Network — Unauthenticated AI Compute Exposure (locked: unlock with TL Creds)
- OAI Reverse Proxy User-Agent in HTTP Traffic — Confirmed LLMjacking Proxy Operation (locked: unlock with TL Creds)
- Ollama API Exposed on Non-Loopback Interface — Internet-Facing AI Server (locked: unlock with TL Creds)
- Ollama Model Pull from Untrusted Registry — CVE-2024-37032 Probllama Vector (locked: unlock with TL Creds)
- Suspicious File Write to /etc/ld.so.preload or /etc/ld.so.conf.d/ — Ollama Probllama RCE (locked: unlock with TL Creds)
- Rapid LLM API Invocation — Token Consumption Anomaly Indicating LLMjacking (locked: unlock with TL Creds)
- OAI Reverse Proxy User-Agent in AI Service API Calls (locked: unlock with TL Creds)
- Ollama API Access from External IP Without Authentication (locked: unlock with TL Creds)
- AWS Bedrock InvokeModel Reconnaissance Probe — max_tokens_to_sample Negative Value (locked: unlock with TL Creds)
- AWS Bedrock Logging Configuration Check — LLMjacking Evasion Indicator (locked: unlock with TL Creds)
- AWS Bedrock Model Entitlement Activation — Unauthorized Model Enable (locked: unlock with TL Creds)
- AWS Bedrock InvokeModel Reconnaissance — max_tokens Negative Value Probe (LLMjacking Signature) (locked: unlock with TL Creds)
- AWS Bedrock Logging and Model Configuration Reconnaissance — LLMjacking Evasion and Activation (locked: unlock with TL Creds)
- AWS Bedrock Volumetric Anomaly — High-Rate InvokeModel/Converse Usage Indicating LLMjacking Abuse (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 62)

Defanged, TLP:CLEAR.

- IP address: `83.7.139[.]184`
- URL: `hxxps://github[.]com/kingbased/keychecker`
- IP address: `103.108.229[.]55`

Full set of 62 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Sysdig TRT — LLMjacking: Stolen Cloud Credentials Used in New AI Attack](https://sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack/)
- [Sysdig TRT — The Growing Dangers of LLMjacking](https://sysdig.com/blog/growing-dangers-of-llmjacking/)
- [Wiz Research — Probllama: Ollama RCE CVE-2024-37032](https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-2024-37032)
- [NVD — CVE-2024-37032](https://nvd.nist.gov/vuln/detail/CVE-2024-37032)
- [Ollama GitHub — Fix for Path Traversal (PR #4175)](https://github.com/ollama/ollama/pull/4175)
- [OAI Reverse Proxy — LLM Monetization Tool](https://gitgud.io/khanon/oai-reverse-proxy)
- [Vicarius — Probllama CVE-2024-37032 Technical Analysis](https://www.vicarius.io/vsociety/posts/probllama-in-ollama-a-tale-of-a-yet-another-rce-vulnerability-cve-2024-37032)
- [Credential Checker — kingbased/keychecker (attack tool)](https://github.com/kingbased/keychecker)
- [Sysdig TRT: LLMjacking Targets DeepSeek — Rapid Adoption of New Models](https://sysdig.com/blog/llmjacking-targets-deepseek/)
- [Microsoft: Taking Legal Action to Protect the Public from Abusive AI-Generated Content](https://blogs.microsoft.com/on-the-issues/2025/01/10/taking-legal-action-to-protect-the-public-from-abusive-ai-generated-content/)
- [Ollama GitHub Repository (70K+ stars)](https://github.com/ollama/ollama)
- [Ollama Docker Hub (hundreds of thousands of pulls)](https://hub.docker.com/r/ollama/ollama)
- [AWS Bedrock Pricing](https://aws.amazon.com/bedrock/pricing/)
- [AWS Bedrock Runtime API Documentation](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_Operations_Amazon_Bedrock_Runtime.html)
- [Ollama Patch: CVE-2024-37032 Fix (v0.1.34)](https://github.com/ollama/ollama/compare/v0.1.33...v0.1.34)

## Full data

The other 31 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0012