AI Compute Hijacking: Stolen Ollama Server Wired Into Autonomous "VAPT" Exploit Pipeline (Sysdig) — Threadlinqs Intelligence
As of 2026-07-02, AI Compute Hijacking: Stolen Ollama Server Wired Into Autonomous "VAPT" Exploit Pipeline (Sysdig) is a high-severity vulnerability threat attributed to a India (assessed, residential-ISP origin)-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 22 indicators of compromise.
Threat ID: TL-2026-1076 · Severity: HIGH · CVSS: 9.1 · Status: ACTIVE · Category: VULNERABILITY
Attribution: India (assessed, residential-ISP origin) · UNKNOWN
Sysdig's Threat Research Team captured a threat actor abusing a misconfigured, unauthenticated Ollama model server (port 11434) as the free reasoning engine for an autonomous, multi-stage
On June 12, 2026 at 15:43 UTC, the Sysdig Threat Research Team (led by Michael Clark, Director of Threat Research) observed an 8.5-hour session in which a threat actor drove inference requests against a misconfigured, internet-exposed Ollama model server to power a custom offensive-security automation framework the actor calls "VAPT" (Vulnerability Assessment and Penetration Testing). Unlike prior LLMjacking cases, where stolen model access is resold or used for chat, this actor wired the stolen inference capacity directly into a software pipeline: each pipeline stage sends the model a tightly-scoped instruction and requires a strictly structured (JSON) response so the surrounding orchestration code can consume the output deterministically and drive the next action without human intervention.
Observed VAPT stages included: (1) service fingerprinting that normalizes banner/service data into CPE identities for CVE lookup; (2) vulnerability matching that filters candidate CVEs by product/version; (3) web reconnaissance that extracts paths, parameters, headers and cookies from targets; (4) proof-of-concept exploit synthesis producing protocol-aware exploit code with self-validation; (5) blind SQL-injection payload crafting using time-based techniques with WAF/filter evasion; (6) credential and secret extraction from files retrieved post-compromise; (7) arbitrary file-read target prioritization; (8) privilege-escalation command planning; and (9) an autonomous orchestration/controller stage that strings the prior stages together to attempt end-to-end compromise and confirm remote code execution.
The framework's compromise-confirmation routine wraps command output in the string markers "VAPTb3gin" and "VAPTfin" (e.g., `echo VAPTb3gin; id; echo VAPTfin`) and uses a `__VAPTCMD__` placeholder token for parameterized command injection — reliable, low-noise detection signatures for this and similar agent-driven offensive tooling. A follow-up cluster of three additional sessions totaling roughly 6.5 hours was observed on June 14, 2026 from closely related source IPs, all attributed to the same actor based on shared benchmark target ranges, identical pipeline fingerprints, and consistent Indian residential-ISP origin.
Targeting was limited to the actor's own private/lab infrastructure — a private benchmark network (172.30.0.0/24) and what Sysdig assesses is a HackTheBox penetration-testing lab range (10.129.0.0/16) — with fictitious application names such as "MediaVault Asset Portal" and "Reverb Studio" used as test targets. No production or public-internet victims were confirmed compromised during the observation window; Sysdig characterizes the activity as an actor actively developing and iterating the framework (staged feature additions, rewrites) rather than a mature, at-scale campaign — but warns the trajectory, if it continues, converts commodity stolen AI compute into a scalable, low-cost autonomous intrusion weapon.
The framework is backend-agnostic: captured requests targeted gpt-4o-mini, claude-3-5-sonnet, gemini-2.0-flash-exp, mistral:7b, deepseek-r1:8b, qwen3.5:4b, and an uncensored Llama-3.3-70B-abliterated variant, indicating the actor built the tool to substitute any exposed inference endpoint (paid API key, stolen credential, or open Ollama/LiteLLM server) interchangeably as the reasoning backend.
The exposure surface enabling this class of attack is large: Ollama listens on TCP/11434 without authentication by default, and independent researchers have catalogued roughly 175,000 publicly exposed Ollama instances across 130+ countries — alongside a parallel population of exposed LiteLLM proxy endpoints reachable the same way. Separately and in the same disclosure window, Ollama shipped a fix (acknowledged February 25, 2026, patched in v0.17.1) for CVE-2026-7482 ("Bleeding Llama"), a CVSS 9.1 unauthenticated heap out-of-bounds read in the GGUF model loader (fs/ggml/gguf.go / server/quantization.go WriteTo()) reachable via
Weaknesses (CWE)
CWE-125, CWE-306, CWE-284
Target sectors: unknown - private lab targets only observed
Target regions: Global (via exposed Ollama/LiteLLM instances across 130+ countries)
Detections & IOCs
As of 2026-08-25, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 22 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2026-7482, T1595.001, T1592.002, T1596.005, T1588.005, T1584.004, T1190, T1059.004, T1203, T1068, T1070.003
