Loading story…
Threat activity observed in late 2025 and early 2026 shows high-volume, automated probing of emerging and legacy internet-facing attack surfaces, including exposed large language model (LLM) endpoints. GreyNoise reported 91,403 attack sessions against its Ollama honeypot infrastructure, attributing the traffic to two operations systematically enumerating AI deployments across major commercial model ecosystems (including OpenAI, Google, Anthropic, Meta, and others). One operation used two IP addresses to methodically test API formats and identify live endpoints across dozens of LLM targets while relying on innocuous prompts (for example, simple greetings and basic trivia questions) to reduce the likelihood of detection; GreyNoise noted the source IPs had prior associations with exploitation of known vulnerabilities, suggesting reconnaissance intended to feed follow-on exploitation.
In parallel, Check Point Research detailed an updated, modular GoBruteforcer botnet variant that compromises Linux servers by brute-forcing weak credentials across common services (including FTP, MySQL, PostgreSQL, and phpMyAdmin), then reuses newly compromised hosts to expand scanning and password-guessing at scale. Check Point assessed that 50,000+ internet-facing servers may be exposed to this activity, citing two drivers: widespread reuse of AI-generated deployment/configuration examples that propagate predictable usernames and weak defaults, and continued exposure of legacy stacks (such as XAMPP) with insufficient hardening. The newer GoBruteforcer variant reportedly adds more sophisticated capabilities and obfuscation, and the operators appear financially motivated, with activity linked to data theft, selling initial access, and cryptocurrency theft.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On Jan. 12, 2026, Check Point Research disclosed a more sophisticated GoBruteforcer variant that brute-forces weak credentials on common services and uses compromised Linux servers to scan public IP ranges and attempt further logins. The researchers estimated that more than 50,000 Internet-facing servers may be vulnerable.
From October 2025 through January 2026, GreyNoise recorded 91,403 attack sessions against its Ollama honeypot infrastructure, linking the activity to coordinated reconnaissance intended to map AI deployment attack surfaces and identify misconfigured proxies that could expose commercial AI APIs.
Starting Dec. 28, 2025, two IP addresses launched an 11-day enumeration campaign against more than 73 LLM-related endpoints, probing API formats associated with providers including OpenAI and Google Gemini while using benign prompts like "hi."
Around Dec. 25, 2025, the SSRF-focused operation surged, generating 1,688 sessions in two days from infrastructure spread across multiple countries. GreyNoise observed shared automation characteristics, including a dominant JA4H fingerprint consistent with tooling such as Nuclei.
A campaign targeting exposed LLM infrastructure with server-side request forgery techniques began in October 2025, abusing vectors such as Ollama model-pull registry URL injection and Twilio SMS webhook MediaUrl manipulation to trigger outbound callbacks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
govinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcedarkreading.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security telemetry indicates **coordinated, large-scale probing of exposed LLM endpoints** consistent with pre-exploitation reconnaissance. GreyNoise reported **91,403 attack sessions** against its *Ollama* honeypot infrastructure (Oct–Jan), attributing activity to two operations systematically enumerating AI deployment weaknesses across major model ecosystems (including **OpenAI, Google Gemini, Anthropic, Meta, DeepSeek, Mistral, Alibaba, and xAI**). One operation used two IPs to methodically test API formats and identify live endpoints over an 11‑day period, relying on low-noise prompts (e.g., “hi” and simple factual questions) to reduce detection; GreyNoise noted the IPs’ prior association with exploitation of known vulnerabilities, suggesting reconnaissance feeding a broader exploitation pipeline. In parallel, Check Point described an active **GoBruteforcer (GoBrut) botnet** wave targeting cryptocurrency and blockchain project databases by brute-forcing services such as **FTP, MySQL, PostgreSQL, and phpMyAdmin** on Linux, with campaigns amplified by **reused AI-generated deployment examples** that propagate common usernames and weak defaults, plus exposure from legacy stacks like *XAMPP*. The Register’s coverage of the WEF Global Cybersecurity Outlook 2026 aligns with these observations at a strategic level, reporting that leaders increasingly prioritize **AI security risk assessment** and cite **data leakage** and adversary capability gains as top concerns; however, broader policy and CIO “challenges” commentary does not materially add to the specific reconnaissance/botnet activity described in the threat reporting.
Jun 29, 2026
A significant internet-wide scanning campaign was observed over the 2025 Christmas holiday, where a single operator systematically probed for vulnerable systems using more than 240 different exploits. The attacker leveraged ProjectDiscovery's Interactsh platform and Nuclei scanner at scale, confirming vulnerabilities via out-of-band callbacks and building a fresh inventory of exploitable systems. This reconnaissance activity is believed to support the Initial Access Broker (IAB) ecosystem, where access to compromised networks is sold to ransomware operators, setting the stage for targeted attacks throughout 2026. The campaign was traced to two IP addresses and involved over 57,000 unique OAST subdomains, highlighting the industrialization of vulnerability scanning and the supply chain of ransomware operations. In parallel, threat actors have been observed actively targeting large language model (LLM) deployments, with campaigns exploiting server-side request forgery (SSRF) vulnerabilities and systematically mapping AI infrastructure. GreyNoise's honeypot infrastructure recorded over 91,000 attack sessions, including a dramatic spike in activity during the Christmas period, with attackers using similar OAST infrastructure and automation tooling as seen in the broader scanning campaign. These activities underscore the growing threat posed by automated, large-scale reconnaissance and exploitation efforts, which are increasingly targeting both traditional IT assets and emerging AI platforms, and are likely to drive a new wave of intrusions and ransomware attacks in 2026.
Jun 29, 2026Researchers and vendors reported a sharp rise in attacks targeting AI infrastructure, from exposed self-hosted LLM servers to commercial coding assistants used in real intrusions. A Kaspersky honeypot posing as a private AI server with services including **Ollama**, **LM Studio**, **LangServe**, **text-generation-webui**, OpenAI-compatible APIs, RAG databases, and an MCP server was indexed by Shodan within hours and drew more than **113,000 requests** in a month from thousands of IP addresses. Nearly a quarter of the traffic focused on discovering and exploiting AI capabilities, with attackers attempting to consume inference resources, analyze documents, generate content, process vulnerability data, proxy requests to external models, and steal secrets from exposed `.env` files using tooling such as **LLM-Scanner**. The broader threat has moved beyond opportunistic abuse into targeted operations. Anthropic said suspected Chinese state-linked operators misused **Claude Code** against **30 high-value organizations** across technology, finance, chemicals, and government, using the AI assistant to test systems, generate attack code, harvest credentials, identify privileged accounts and backdoors, and support deeper intrusion activity; the company said the tool performed **80% to 90%** of the work in some cases. Separately, defenders were urged to rapidly patch internet-exposed management infrastructure after **CVE-2026-41940** in **cPanel/WHM** was exploited in the wild, allowing pre-authentication root access in as few as four HTTP requests and reportedly being used in ransomware activity, underscoring how exposed services and AI-enabled tradecraft are converging into a faster, more scalable attack model.
Jun 29, 2026