Skip to content

Back to the catalog

LLMjacking evolved: Attackers are using stolen AI compute to build offensive agentic tools | Sysdig
sysdig.comwriteup

LLMjacking evolved: Attackers are using stolen AI compute to build offensive agentic tools | Sysdig

Sysdig's Threat Research Team captured the full architecture of "VAPT," an autonomous multi-stage exploitation framework that a threat actor powered using a misconfigured, internet-exposed Ollama server (port 11434, no auth) instead of paid LLM APIs. The tool chains service fingerprinting, CVE matching, PoC/blind-SQLi generation, credential extraction, privilege escalation, and an autonomous orchestrator that confirms RCE via a VAPTb3gin/VAPTfin marker wrapped around `id` output, and was observed being actively developed against private HackTheBox-style practice ranges before any real-world targeting. It represents the convergence of LLMjacking (stolen inference compute) with fully agentic offensive tooling, and the piece includes captured system prompts, IOCs, and hardening guidance for self-hosted model servers.

TL;DR Sysdig TRT caught a threat actor building an autonomous LLM-driven exploitation framework ("VAPT") on stolen, unauthenticated Ollama inference compute.
Open original ↗
Document

What it is

On June 12, 2026, the Sysdig Threat Research Team captured a live offensive tool — which they call VAPT (after the VAPTb3gin/VAPTfin markers in its compromise-confirmation routine) — driving a misconfigured, internet-exposed Ollama server as its reasoning engine. This is the concrete "evolved LLMjacking" case behind the summary: the abused compute is not a stolen cloud API key (AWS Bedrock etc.) but a self-hosted model server left open. Because VAPT resends its full instructions to the model on every request, Sysdig captured its entire architecture.

How it works

VAPT is a staged VAPT (vulnerability assessment / penetration testing) pipeline that calls the model hundreds of times per attack, forcing strictly structured output at each stage so surrounding code can consume it deterministically. Observed stages:

  • Service fingerprinting — normalize a service banner into a precise software identity.
  • Vulnerability matching / applicability triage — match product+version to candidate vulns, filter to applicable ones.
  • Web reconnaissance — ingest page text, headers, cookies, form fields, discovered paths; emit candidate paths/parameters for exploitation.
  • Proof-of-concept exploit generation (text truncated here).

The model makes the decision at every step; the pipeline chains scan → match → write PoC → intrude.

Preconditions / Affected

  • An Ollama server bound to a public interface on port 11434 with no authentication (Ollama's default is no credentials). Any reachable server answers anyone.
  • No CVE is involved — this is pure configuration exposure. Sysdig cites ~175,000 publicly exposed Ollama instances across 130+ countries (corroborated by Cisco's Shodan survey). The appeal: self-hosted capacity is unmetered and unattributed, so a tool making hundreds of calls incurs no quota or invoice.

What to do

The page's core defensive point: do not expose Ollama's port 11434 to the internet without authentication. Bind it to localhost or a private interface, put it behind auth/a proxy, and firewall the port. For detection, VAPT self-identifies — its traffic echoes the literal strings VAPTb3gin (before a probe) and VAPTfin (after), which defenders with visibility into model-server requests can alert on. (Full mitigation guidance sits past the truncation point.)

Attribution (as stated)

Four sessions on June 12 and 14, 2026 (~8.5h then ~6.5h), from residential IPs 122.183.48.82, 122.183.48.35, 122.183.48.195 (Hyderabad, India provider) and 47.15.69.15, attributed to one actor by shared pipeline, private benchmark targets, and origin — IP rotation being ordinary residential churn.

Caveats

The captured VAPT logic is only visible because the model ran on a server Sysdig could observe; Sysdig notes a May 2026 case where the same idea ran off-platform and only actions, not reasoning, were seen. The fetched excerpt is truncated mid-"Proof-of-concept" stage, so later stages and the full remediation list are not reproduced here.

Organisations named here

  • HackTheBox
  • Sysdig Threat Research Team

Technologies named here

  • Ollama
  • Falco Feeds
  • gpt-4o-mini
  • claude-3-5-sonnet
  • VAPT framework
  • oracles.py
  • gemini-2.0-flash-exp
  • mistral:7b
  • deepseek-r1:8b
  • Qwen3.5-4B
  • Llama 3.3 70B
  • LLM
  • LLaMa
  • DeepSeek
  • Qwen

Techniques named here

  • LLMjacking
  • Autonomous LLM-driven offensive orchestration
  • RCE confirmation via marker bracketing
  • Service fingerprinting for CVE lookup
  • Vulnerability matching and applicability triage
  • Web reconnaissance for exploit path/parameter discovery
  • Protocol-aware proof-of-concept synthesis
  • Blind time-based SQL injection crafting with filter evasion
  • Credential and secret extraction
  • Arbitrary file-read planning
  • Privilege escalation decisioning
  • Prompt injection defense via untrusted-data framing
  • Propose-only / verifier-gated execution architecture
  • Authorized-pentester prompt framing

Threat actors named here

  • VAPT

Related in Threat Intel