Attackers Exploit RMM Software for Persistent Access and Evasion

Key Takeaways

• Threat actors are now leveraging misconfigured, publicly exposed AI model servers, particularly Ollama instances, to power automated hacking pipelines without incurring costs.
• This new method, an evolution of “LLMjacking,” allows attackers to autonomously scan targets, identify vulnerabilities, craft exploits, and attempt system breaches.
• Researchers at Sysdig observed an attacker using an exposed Ollama server as the “brain” for a multi-stage offensive tool, dubbed “VAPT,” capable of full-cycle hacking.
• Approximately 175,000 Ollama instances are publicly accessible across 130+ countries, often without default authentication, making them prime targets for abuse.
• While current attacks appear to be in a testing phase against private networks, the convergence of AI compute theft and autonomous offensive tooling presents a significant future threat.

A disturbing new trend reveals that cybercriminals are exploiting artificial intelligence tools for their malicious operations, entirely bypassing the need to fund these activities themselves. Instead of expending their own resources, threat actors are now actively hijacking exposed AI model servers and integrating them directly into automated hacking frameworks.

This development results in a self-sufficient attack mechanism capable of scanning targets, identifying weaknesses, generating exploits, and attempting system intrusions autonomously.

This emerging threat builds upon a pattern first identified in 2024, when attackers began pilfering cloud credentials to misuse paid AI services, a technique researchers termed “LLMjacking.” By 2025, the criminal ecosystem surrounding this activity had matured into a black market, utilizing reverse-proxy networks to broker billions of stolen tokens globally. Financial damages from such compute theft were estimated to reach up to $46,000 per day.

According to a report by Sysdig researchers, shared with Cyber Security News (CSN), their Threat Research Team detected an attacker on June 12, 2026, leveraging a misconfigured Ollama model server. This server was functioning as the central intelligence for a sophisticated, multi-stage offensive tool. Unlike previous LLMjacking incidents, the actor was not reselling access or merely interacting with the model; instead, they had integrated it into a software pipeline designed for end-to-end automated hacking.

The extent of this exposure is concerning. Researchers have cataloged roughly 175,000 publicly accessible Ollama instances spanning over 130 countries. By default, Ollama listens on port 11434 without requiring authentication, effectively turning any internet-facing server into a free AI compute resource for anyone who discovers it.

Since the attacker’s tool transmitted complete instructions to the model with each request, Sysdig’s team was able to capture the full operational details of the framework. This provided researchers with an invaluable early insight into how threat actors are combining stolen AI infrastructure with autonomous hacking capabilities within a single operation. It marks the convergence of two previously distinct trends: compute theft and AI-powered offensive tooling.

Autonomous Hacking Framework Utilizes Stolen AI

The attacker’s tool, identified by researchers as “VAPT” based on embedded code markers, orchestrates the AI model through a precisely defined sequence of actions. Each step is designed for a specific task, requiring the model to produce structured output that the surrounding software can automatically process. This design ensures the pipeline operates quickly and reliably without human intervention at every stage.

Observed stages included service identification on a target, mapping these services to known vulnerabilities, building proof-of-concept exploits, crafting blind SQL injection payloads to bypass input filters, and extracting credentials from compromised files. A privilege escalation stage was also implemented to deepen access once initial entry was achieved. Credential extraction alone was executed more than a hundred times throughout the campaign.

A key feature of this framework is its autonomous orchestrator, a controller that manages the entire attack chain until command execution is achieved on the target. To confirm a successful compromise, the tool executes a specific command and searches for unique code markers bracketing the output. Once these markers appear, the confirmed exploit is saved as a reusable template for subsequent commands.

During the campaign, the tool requested at least seven different AI models, including commercial offerings such as GPT-4o-mini, Claude-3-5-Sonnet, and Gemini-2.0-Flash-Exp, alongside open-source local builds. The presence of these commercial models suggests the tool was initially developed for paid APIs and was subsequently redirected to the compromised Ollama server as a cost-free alternative.

Targets, Development, and Defense

All targets observed during the capture were located on private, non-routable networks. The actor tested against fictitious applications named “MediaVault Asset Portal” and “Reverb Studio,” and later against a network range associated with HackTheBox lab environments. No genuine public hosts were targeted, indicating that the tool is likely still under refinement before being deployed against actual victims.

What You Should Do

• Never Expose Model Servers: Absolutely avoid exposing Ollama or similar AI model servers to the public internet.
• Implement Authentication: Since many AI model servers lack built-in authentication, implement robust authentication at the proxy or network layer for any exposed endpoints.
• Monitor Inference Endpoints: Actively monitor AI inference endpoints for unusual request volumes or patterns that could indicate abuse.
• Audit Internet-Facing Assets: Regularly audit all internet-facing assets to identify and secure any inadvertently exposed AI model servers.
• Prioritize Exposed AI Endpoints: Treat any exposed AI inference endpoint with the same critical urgency as an exposed database or administrative panel.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.