silver[.]inc

A new joint investigation by SentinelOne SentinelLABS, and Censys has revealed that the open-source artificial intelligence (AI) deployment has created a vast "unmanaged, publicly accessible layer of AI compute infrastructure" that spans 175,000 unique Ollama hosts across 130 countries. These systems, which span both cloud and residential networks across the world, operate outside the guardrails and monitoring systems that platform providers implement by default, the company said. The vast majority of the exposures are located in China, accounting for a little over 30%. The countries with the most infrastructure footprint include the U.S., Germany, France, South Korea, India, Russia, Singapore, Brazil, and the U.K. "Nearly half of observed hosts are configured with tool-calling capabilities that enable them to execute code, access APIs, and interact with external systems, demonstrating the increasing implementation of LLMs into larger system processes," researchers Gabriel Bernadett-Shapiro and Silas Cutler added. Ollama is an open-source framework that allows users to easily download, run, and manage large language models (LLMs) locally on Windows, macOS, and Linux. While the service binds to the localhost address at 127.0.0[.]1:11434 by default, it's possible to expose it to the public internet by means of a trivial change: configuring it to bind to 0.0.0[.]0 or a public interface. The fact that Ollama, like the recently popular Moltbot (formerly Clawdbot), can be hosted locally and operate outside of the enterprise security perimeter, poses new security concerns. This, in turn, necessitates new approaches to distinguish between managed and unmanaged AI compute, the researchers said. Of the observed hosts, more than 48% advertise tool-calling capabilities via their API endpoints that, when queried, return metadata highlighting the functionalities they support. Tool calling (or function calling) is a capability that allows LLMs to interact with external systems, APIs, and databases, enabling them to augment their capabilities or retrieve real-time data. "Tool-calling capabilities fundamentally alter the threat model. A text-generation endpoint can produce harmful content, but a tool-enabled endpoint can execute privileged operations," the researchers noted. "When combined with insufficient authentication and network exposure, this creates what we assess to be the highest-severity risk in the ecosystem." The analysis has also identified hosts supporting various modalities that go beyond text, including reasoning and vision capabilities, with 201 hosts running uncensored prompt templates that remove safety guardrails. The exposed nature of these systems means they could be susceptible to LLMjacking, where a victim's LLM infrastructure resources are abused by bad actors to their advantage, while the victim foots the bill. These could range from generating spam emails and disinformation campaigns to cryptocurrency mining and even reselling access to other criminal groups. The risk is not theoretical. According to a report published by Pillar Security this week, threat actors are actively targeting exposed LLM service endpoints to monetize access to the AI infrastructure as part of an LLMjacking campaign dubbed Operation Bizarre Bazaar. The findings point to a criminal service that contains three components: systematically scanning the internet for exposed Ollama instances, vLLM servers, and OpenAI-compatible APIs running without authentication; validating the endpoints by assessing response quality; and commercializing the access at discounted rates by advertising it on silver[.]inc, which operates as a Unified LLM API Gateway. "This end-to-end operation – from reconnaissance to commercial resale – represents the first documented LLMjacking marketplace with complete attribution," researchers Eilon Cohen and Ariel Fogel said. The operation has been traced to a threat actor named Hecker (aka Sakuya and LiveGamer101). The decentralized nature of the exposed Ollama ecosystem, one that's spread across cloud and residential environments, creates governance gaps, not to mention creates new avenues for prompt injections and proxying malicious traffic through victim infrastructure. "The residential nature of much of the infrastructure complicates traditional governance and requires new approaches that distinguish between managed cloud deployments and distributed edge infrastructure," the companies said. "For defenders, the key takeaway is that LLMs are increasingly deployed to the edge to translate instructions into actions. As such, they must be treated with the same authentication, monitoring, and network controls as other externally accessible infrastructure."

A malicious campaign is actively targeting exposed LLM (Large Language Model) service endpoints to commercialize unauthorized access to AI infrastructure. Over a period of 40 days, researchers at Pillar Security recorded more than 35,000 attack sessions on their honeypots, which led to discovering a large-scale cybercrime operation that monetizes and exploits access to exposed or poorly authenticated AI endpoints. They call the campaign 'Bizarre Bazaar' and highlight that it is one of the first examples of ‘LLMjacking’ attacks attributed to a specific threat actor. In a report shared with BleepingComputer, Bizarre Bazaar involves unauthorized access to weakly protected LLM infrastructure endpoints to: Steal computing resources for cryptocurrency mining Resell API access on darknet markets Exfiltrate data from prompts and conversation history, Attempt to pivot into internal systems via Model Context Protocol (MCP) servers Common attack vectors include self-hosted LLM setups, exposed or unauthenticated AI APIs, publicly accessible MCP servers, and development or staging AI environments with public IP addresses. Typically, attackers exploit misconfigurations such as unauthenticated Ollama endpoints on port 11434, OpenAI-compatible APIs on port 8000, and unauthenticated production chatbots. The researchers note that the attacks begin within hours of a misconfigured endpoint appearing in Shodan or Censys internet scans. "The threat differs from traditional API abuse because compromised LLM endpoints can generate significant costs (inference is expensive), expose sensitive organizational data, and provide lateral movement opportunities," Pillar Security says. At the beginning of the month, a report from GreyNoise highlighted similar activity, where attackers targeted commercial LLM services, mainly for enumeration. Pillar Security’s findings indicate a criminal supply chain involving three threat actors who likely work together as part of the same operation. The first one uses bots to systematically scan the internet for LLM and MCP endpoints. The second validates the findings and tests access. The third operates a commercial service at ‘silver[.]inc’ marketed on Telegram and Discord, that resells access in exchange for cryptocurrency or PayPal payments. SilverInc promotes a project called NeXeonAI, which is advertised as a "unified AI infrastructure" that provides access to more than 50 AI models from leading providers. The researchers have also attributed the operation to a specific threat actor using the aliases “Hecker,” “Sakuya,” and “LiveGamer101.” Pillar Security reports that, while Bizarre Bazaar focuses on LLM API abuse, they track a separate campaign that focuses on MCP endpoint reconnaissance. This targeting gives more opportunities for lateral movement via Kubernetes interactions, cloud service access, and shell command execution, which are often more valuable than resource-consumption-based monetization tactics. This second campaign has not been linked to Bizarre Bazaar, although a connection may exist. As of writing, the campaign is ongoing, and the SilverInc service continues to be operational. BleepingComputer has contacted the platform for a comment about Pillar’s findings, but we have not heard back by publication time. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report