Threat Actors Abuse Remote Monitoring Tools to Bypass Signature-Based Detection

A significant evolution in the exploitation of artificial intelligence. Threat actors are no longer simply stealing cloud compute resources; they are weaponizing misconfigured AI infrastructure to power automated, multi-stage offensive security tools.

Specifically, researchers observed an attacker abusing an exposed Ollama model server to serve as the reasoning engine for an autonomous penetration-testing framework.

This incident marks a critical shift in a threat pattern known as LLMjacking. Originally identified in 2024 as the theft of cloud credentials to access paid AI services, LLMjacking has since matured rapidly.

With researchers cataloging roughly 175,000 unauthenticated Ollama instances exposed to the internet globally, attackers are leveraging these free, self-hosted environments.

They run offensive operations without incurring financial costs or triggering billing anomalies associated with commercial API keys.

Rather than engaging in conversational queries, the threat actor integrated the exposed AI model directly into a software pipeline that autonomously scans targets, matches them to known vulnerabilities, synthesizes proof-of-concept exploits, and attempts network breaches.

Remote Tools Bypass Detection

The captured tool, self-identified as “VAPT” in its source code, drives the hijacked AI model through a sequence of deterministic stages.

Each request carries specific instructions, requiring strictly structured output that the surrounding code parses for further execution.

The attacker deliberately designed the framework to be backend-agnostic, requesting at least 7 different models by name, including open-weight builds such as Mistral and DeepSeek.

The framework autonomously executes several distinct penetration testing phases in a sequential flow. It normalizes network service banners into precise software identities for vulnerability lookups.

It conducts web reconnaissance by analyzing observation bundles such as page text, headers, and decoded cookies. The AI agent also constructs evasion payloads, such as blind, time-based SQL injections designed to bypass input filters.

Furthermore, it extracts usable credentials or API keys and orchestrates the attack chain until remote code execution is achieved.

According to Sysdig research, this convergence of compute theft and autonomous offensive AI research requires immediate defensive adjustments.

Traditional monitoring often assumes the operator controls the server, meaning an attacker abusing an exposed, unmonitored local port will only manifest as elevated compute usage rather than a flagged intrusion attempt.

Security teams managing self-hosted AI infrastructure must treat inference endpoints with the same strict access controls as sensitive databases.

Organizations should never expose port 11434 to the public internet, ensuring model servers bind only to localhost or internal interfaces.

Additionally, administrators must enforce authentication in front of every model endpoint using a reverse proxy, as tools like Ollama lack native authentication.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.