Risk actors are systematically looking for misconfigured proxy servers that might present entry to business massive language mannequin (LLM) companies.
In an ongoing marketing campaign that began in late December, the attackers have probed greater than 73 LLM endpoints and generated over 80,000 periods.
In keeping with risk monitoring platform GreyNoise, the risk actors use low-noise prompts to question endpoints in an try to find out the accessed AI mannequin with out triggering a safety alert.
Gray-hat operation
GreyNoise says in a report that over the previous 4 months, its Ollama honeypot caught a complete of 91,403 assaults which might be a part of two distinct campaigns.
One operation began in October and continues to be lively, with a spike of 1,688 periods over 48 hours round Christmas. It exploits server-side request forgery (SSRF) vulnerabilities that permit the actor to drive a server to connect with an attacker-controlled exterior infrastructure.
In keeping with the researchers, the attacker behind this operation achieved its targets by utilizing Ollama’s mannequin pull performance to inject malicious registry URLs and Twilio SMS webhook integrations by way of the MediaURL parameter.
Nevertheless, based mostly on the instruments used, GreyNoise factors out that the exercise probably originates from safety researchers or bug bounty hunters, as they used ProjectDiscovery’s OAST (Out-of-band Utility Safety Testing) infrastructure, which is usually utilized in vulnerability assessments.
“OAST callbacks are normal vulnerability analysis methods. However the scale and Christmas timing counsel grey-hat operations pushing boundaries” – GreyNoise
Telemetry knowledge revealed that the marketing campaign originated from 62 IP addresses throughout 27 international locations that exhibit VPS-like traits slightly than indicators of botnet operation.
.jpg)
Supply: GreyNoise
Risk actor exercise
GreyNoise noticed a second marketing campaign beginning on December 28 and detected a high-volume enumeration effort to establish uncovered or misconfigured LLM endpoints.
Over 11 days, the exercise generated 80,469 periods, with two IP addresses systematically probing over 73 mannequin endpoints utilizing each OpenAI-compatible and Google Gemini API codecs.
The listing of focused fashions included these from all main suppliers, together with:
- OpenAI (GPT-4o and variants)
- Anthropic (Claude Sonnet, Opus, Haiku)
- Meta (Llama 3.x)
- DeepSeek (DeepSeek-R1)
- Google (Gemini)
- Mistral
- Alibaba (Qwen)
- xAI (Grok)
To keep away from safety alerts when testing entry to an LLM service, the attacker used innocent queries corresponding to quick greetings, empty inputs, or factual questions.
GreyNoise says that the scanning infrastructure has been beforehand related to widespread vulnerability exploitation exercise, which means that the enumeration is a part of an organized reconnaissance effort to catalog accessible LLM companies.
The GreyNoise report doesn’t declare noticed exploitation after discovery, knowledge theft, or mannequin abuse, however the exercise continues to be indicative of malicious intentions.
“Eighty thousand enumeration requests symbolize funding,” warn the researchers, including that “risk actors do not map infrastructure at this scale with out plans to make use of that map.”
To defend in opposition to this exercise, it is suggested to limit Ollama mannequin pulls to trusted registries, apply egress filtering, and block recognized OAST callback domains on the DNS degree.
Measures in opposition to enumeration embrace rate-limiting suspicious ASNs and monitoring for JA4 community fingerprints linked to automated scanning instruments.
It is price range season! Over 300 CISOs and safety leaders have shared how they’re planning, spending, and prioritizing for the 12 months forward. This report compiles their insights, permitting readers to benchmark methods, establish rising developments, and evaluate their priorities as they head into 2026.
Learn the way prime leaders are turning funding into measurable impression.
