Financially Motivated Hackers Turn Legitimate IT Tools Into Remote Access Payloads

A novel evolution of LLMjacking: a threat actor leveraging a publicly exposed Ollama model server as the reasoning engine for an automated, multi-stage offensive framework.

Rather than using the model for chat or resale, the attacker integrated unauthenticated model inference into a VAPT-style pipeline that scans targets, maps vulnerabilities, synthesizes proof-of-concept exploits, and attempts command execution with the model making deterministic decisions at each step.

Because the actor sent full-stage instructions on every call, Sysdig captured the framework’s architecture and working prompt-engineered logic.

The tool, which the researchers labeled VAPT, drove the model through strict, name-bound stages: service fingerprinting into CPE identifiers; vulnerability matching and applicability triage; web reconnaissance that parsed pages and headers.

Proof-of-concept synthesis (including protocol-aware payloads and backdoored service triggers); blind time-based SQL injection crafting with filter-evasion.

Each stage demanded machine-parseable JSON outputs and was wrapped in “authorized pentester” framing to keep the model cooperative.

Operational telemetry and code signatures revealed a mature engineering approach. The orchestrator exposed a limited tool surface (request(…), payload builders, and one-shot sweep primitives) and used a reusable confirmation marker: the RCE check ran echo VAPTb3gin; id; echo VAPTfin and searched responses for the marker pair and uid output.

On June 12, 2026, the Sysdig Threat Research Team (TRT) observed a threat actor using a misconfigured Ollama model server as the reasoning engine for an automated, multi-stage offensive security tool.

That marker, along with stage-naming conventions (VAPTb3gin/VAPTfin), serves as a reliable detection indicator for similar agent-driven tooling.

The framework’s design also included a “PROPOSE-ONLY” mode where the model suggested payloads and a deterministic verifier (oracles.py) validated results, demonstrating maintained software practices rather than ad-hoc scripting.

IT Tools Into Remote Access Payloads

Crucially, the attacker did not target external victims during the capture window. All probe targets were private practice ranges and lab networks (RFC 1918 and HackTheBox spaces), indicating the actor was iterating and tuning the tool against self-hosted benchmarks while abusing stolen, unauthenticated inference.

Sessions originated from residential IPs in Hyderabad, India, across multiple days, consistent with a single operator iterating a maturing tool.

This operation marks a convergence of two trends Sysdig tracked since 2024: the theft of model capacity (LLMjacking) and autonomous offensive AI agents.

The economics are plain self-hosted model servers like Ollama listen on port 11434 without authentication by default, and researchers estimate roughly 175,000 publicly exposed instances.

An exposed server offers unmetered, unattributed compute ideal for attacker tools that make hundreds of inference calls per attack, replacing paid APIs such as OpenAI, Anthropic, or Google in existing pipelines.

Defenders must treat self-hosted LLM endpoints as first-class attack surfaces. Practical controls include ensuring model servers are not bound to public interfaces, enforcing strong authentication and network restrictions, logging and alerting on unusual inference patterns, and monitoring for telltale markers such as VAPTb3gin/VAPTfin strings.

Network scanning for exposed ports (11434 for Ollama) and correlation of outbound inference traffic with known exploitation patterns can detect early misuse. Finally, red-team exercises should incorporate AI-capacity theft scenarios to validate detection and containment.

Together, these sources underline that unguarded self-hosted AI infrastructure is now both a free compute resource for criminals and an operational enabler for autonomous offensive tooling.

Indicators of compromise

Indicator	Type	Notes
122.183.48.82	Source IP	Threat Actor, Hyderabad, India. June 12 session
122.183.48.35, 122.183.48.195	Source IPs	Threat Actor, Hyderabad (same /24 as above). June 14 sessions
47.15.69.15	Source IP	Threat Actor, India. June 14 session from a second residential ISP
VAPTb3gin, VAPTfin	String markers	Compromise-confirmation sentinels emitted by the VAPT framework
__VAPTCMD__	String marker	Placeholder the orchestrator leaves in a confirmed RCE recipe so the command can be swapped and replayed
echo VAPTb3gin; id; echo VAPTfin	Command	Exact remote-code-execution confirmation probe
MediaVault Asset Portal, Reverb Studio	Strings	Fictitious target application names in the framework’s payloads
172.30.0.0/24	Network range	The actor’s private benchmark range, present as the target in payloads
10.129.0.0/16	Network range	Additional private target range in June 14 payloads, consistent with the HackTheBox lab VPN

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.