Sysdig TRT observed a threat actor using an exposed Ollama server on port 11434 as the reasoning engine for VAPT, an automated offensive framework that fingerprints services, matches vulnerabilities, synthesizes exploits, and confirms command execution with marker-based checks. The campaign showed LLMjacking evolving into autonomous exploitation against private lab targets, with the same actor iterating the tool across multiple sessions from residential IPs in India. #Ollama #VAPT #LLMjacking
Keypoints
- The Sysdig Threat Research Team captured a threat actor abusing a publicly exposed Ollama server as free inference capacity for an autonomous offensive tool.
- The framework, called VAPT, runs multi-stage workflows including service fingerprinting, vulnerability matching, web reconnaissance, proof-of-concept generation, SQL injection crafting, secret extraction, and privilege escalation.
- The tool sends strict structured prompts to the model and uses fixed output contracts, markers like VAPTb3gin/VAPTfin, and a placeholder VAPTCMD to convert one exploit into a reusable command-execution recipe.
- The actor used multiple residential IPs in Hyderabad, India, and another Indian residential IP across several sessions, suggesting one operator rotating egress rather than multiple actors.
- The targets were private benchmark environments, including RFC 1918 ranges and HackTheBox lab space, not public victim systems.
- The campaign evolved over time: new stages were added, existing prompts were rewritten, and the full set was incorporated before the June 14 return session.
- Sysdig frames this as the convergence of LLMjacking and autonomous offensive tooling, highlighting the risk posed by internet-exposed, unauthenticated self-hosted model servers.
MITRE Techniques
- [T1190 ] Exploit Public-Facing Application – The actor targeted an exposed Ollama server reachable on the internet with no authentication and used it as the engine for the offensive pipeline. [‘an Ollama server bound to a public interface with no authentication’]
- [T1046 ] Network Service Scanning – The framework begins by identifying and normalizing network service banners for CVE lookup and service fingerprinting. [‘Normalize a network service banner into a precise software identity for vulnerability lookup’]
- [T1595 ] Active Scanning – The tool runs reconnaissance and scanning stages, including web reconnaissance and sweeps for internal services and gadget sets. [‘ssrf_scan, object_injection_scan so the agent enumerates an internal port range or a gadget set in a single call’]
- [T1068 ] Exploitation for Privilege Escalation – The pipeline explicitly includes privilege escalation as a stage after gaining initial access or code execution. [‘Privilege escalation: Decide the next escalation command’]
- [T1059.004 ] Command and Scripting Interpreter: Unix Shell – The RCE verification uses a shell command to execute id and confirm code execution. [‘echo VAPTb3gin; id; echo VAPTfin’]
- [T1005 ] Data from Local System – The credential extractor is designed to parse looted files for credentials, secrets, and other reusable data. [‘Extract EVERY usable credential and secret present’]
- [T1110 ] Brute Force – The framework includes blind SQL injection payload crafting and filter evasion logic to gain access through login parameters. [‘crafting a BLIND TIME-BASED SQL-injection payload’]
- [T1195 ] Supply Chain Compromise – The report describes abuse of self-hosted AI infrastructure and model-serving software as part of the offensive chain, creating an AI-supply-chain exposure. [‘an AI-supply-chain exposure rather than merely a billing risk’]
Indicators of Compromise
- [Source IP ] threat actor egress observed in June 12 and June 14 sessions – 122.183.48.82, 122.183.48.35, and other 1 IP
- [Source IP ] additional residential egress from a second ISP during June 14 activity – 47.15.69.15
- [String markers ] RCE confirmation sentinels used by the framework – VAPTb3gin, VAPTfin
- [String marker ] placeholder left in confirmed exploit recipes for replay – __VAPTCMD__
- [Command ] exact command used to verify remote code execution – echo VAPTb3gin; id; echo VAPTfin
- [Application names ] fictitious practice targets embedded in payloads – MediaVault Asset Portal, Reverb Studio
- [Network range ] private benchmark range targeted by the actor – 172.30.0.0/24
- [Network range ] additional private lab range seen on June 14 – 10.129.0.0/16
- [Port ] exposed model-server port associated with Ollama – 11434