Loading threat actor…
Strix is an autonomous AI-enabled penetration-testing framework that has been observed being weaponized through exposed self-hosted AI inference infrastructure. In documented activity, an operator used a LiteLLM client and an exposed model backend to submit the full Strix agent instructions as a large prompt, directing the system toward a live third-party target in France. The observed workflow did not require compromise of the backend host through a software exploit; instead, it abused unauthenticated or weakly protected Ollama or LiteLLM endpoints as backend compute for offensive operations. Operationally, Strix functions as an autonomous offensive agent driven by a detailed system prompt and tool definitions supplied in request bodies. Observed instructions emphasized continuous operation, avoidance of permission-seeking behavior, and suppression of identifying markers, indicating a design oriented toward aggressive autonomous posturing and reduced attribution. The activity also showed persistent retries, consistent with either a live operator supervising the run or an automated workflow attempting to maintain execution. The observed use of Strix aligns with offensive security tradecraft centered on initial access and post-exploitation support through AI-assisted tasking rather than ransomware or destructive operations. High-confidence reporting ties the observed campaign to targeting of a French auction house. No reliable attribution to a nation-state or a specific criminal group is currently available. Strix is best characterized as an offensive autonomous pentesting agent or operator framework that can be repurposed by malicious actors to conduct reconnaissance and broader intrusion activity using exposed AI infrastructure as deniable compute.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Autonomous penetration testing framework abused via exposed LiteLLM infrastructure to conduct offensive operations, including an attempted attack against an unidentified French auction house.
An autonomous AI penetration-testing agent hijacking an exposed Ollama backend to conduct offensive security activity against a live third-party target. The prompt instructed it to avoid permission checks, operate continuously, and conceal identifying markers in requests.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.