Sysdig Finds Exposed Ollama Server Powering an Autonomous Offensive Tool
Summary
Sysdig researchers observed an actor using an exposed, unauthenticated Ollama server as inference capacity for VAPT, an evolving offensive framework. Its observed targets were private practice ranges; no public victim systems were targeted.
Key points
- Sysdig TRT observed the activity on June 12 and 14, 2026, and attributed the sessions to one actor based on the shared VAPT pipeline, private targets, and Indian residential egress IPs.
- The actor used an internet-exposed Ollama server on port 11434 without authentication as the framework’s model backend.
- VAPT used staged model prompts for service fingerprinting, vulnerability matching, reconnaissance, exploit generation, credential extraction, file-read planning, and privilege escalation.
- The framework verified command execution with the markers VAPTb3gin and VAPTfin, then could turn a confirmed request into a reusable command recipe.
- Sysdig says the tool was iteratively developed across sessions; the observed targets were private benchmark and lab ranges, not public victim systems.
- The article recommends restricting model-server exposure, adding authentication, auditing internet-facing assets, and monitoring for anomalous inference requests and command-marker patterns.
Article Details
- Attack Vectors
- The unnamed operator used an internet-exposed Ollama server with no authentication as inference capacity for the VAPT offensive framework.
- VAPT was designed to fingerprint services, match vulnerabilities, generate proof-of-concept payloads, conduct web reconnaissance and SQL injection, extract credentials, plan file reads, and pursue privilege escalation and command execution.
- The reported targets were private benchmark and lab environments; the article reports no public hosts targeted.
- Defensive Notes
- Bind Ollama and similar model servers to localhost or an internal interface; do not expose port 11434 to the internet.
- Require authentication in front of every model endpoint, such as through a firewall and an authenticating reverse proxy.
- Monitor inference endpoints for anomalous request volume, structured offensive-tool prompts, and marker-bracketed command patterns.
- Audit owned internet-facing ranges for exposed model servers and open port 11434.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 122[.]183[.]48[.]195 | Source IP attributed by Sysdig TRT to a June 14 session; residential egress, not described as durable infrastructure. |
| IPV4 | 122[.]183[.]48[.]35 | Source IP attributed by Sysdig TRT to a June 14 session; residential egress, not described as durable infrastructure. |
| IPV4 | 122[.]183[.]48[.]82 | Source IP attributed by Sysdig TRT to the operator’s June 12 session; residential egress, not described as durable infrastructure. |
| IPV4 | 47[.]15[.]69[.]15 | Source IP attributed by Sysdig TRT to a June 14 session from a second residential ISP; not described as durable infrastructure. |
MITRE ATT&CK
T1005 · Data from Local SystemA VAPT stage is designed to parse files from a compromised host for credentials, secrets, and reusable data.T1046 · Network Service DiscoveryVAPT fingerprints network service banners and normalizes them for software and vulnerability lookup.T1059.004 · Unix ShellThe framework’s RCE confirmation probe runs `echo VAPTb3gin; id; echo VAPTfin` on the target.T1068 · Exploitation for Privilege EscalationThe captured pipeline includes a privilege-escalation stage that selects a next escalation command.T1595 · Active ScanningVAPT includes web reconnaissance and sweep primitives for enumerating internal services or gadget sets.