CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Ollama

product · product:ollama single-source

Coverage
2
first 2026-08-08 → last 2026-10-11
Latest activity
2026-10-11
Lumen: a botnet takes its C2 address from a GitHub poem and spreads through exposed AI and developer servers
Peak priority
notable
2 notable
Targets
technology
sectors: technology, public-sector, finance
Sources cited
3
3 hosts

Action items (1)

Do-now tasks recorded on the entries about Ollama, newest first. Check the date before acting on an older one.

  • Inventory Model Context Protocol endpoints in your cloud estate and confirm each one requires authentication, Wiz found unauthenticated MCP endpoints across hundreds of environments, and each is a pre-authenticated proxy already holding the backend credentials it bridges.
    2026-08-08The AI toolchain became a cloud attack surface with…

Defender insights

What each entry about Ollama tells a defender to do, newest first.

2026-10-11NOTABLELumen: a botnet takes its C2 address from a GitHub poem and spreads through exposed AI and developer servers

Exposure · detection

2026-08-08NOTABLEThe AI toolchain became a cloud attack surface with its own recurring vulnerability cadence, and the credentials it holds are non-human

Story timeline

  1. 2026-10-11PoeLLM: a cryptomining botnet that reads its C2 address out of a GitHub poem compromises exposed LiteLLM, Ollama, Gotenberg and Gitea servers and turns them into scanners
    active-threatsLumen: a botnet takes its C2 address from a GitHub poem and spreads through exposed AI and developer servers
  2. 2026-08-08Wiz Cloud Threat Highlights H1 2026: LiteLLM had four separate security events in six months, unauthenticated MCP endpoints turned up across hundreds of environments, and a new extortion actor goes after service accounts rather than people
    researchThe AI toolchain became a cloud attack surface with its own recurring vulnerability cadence, and the credentials it holds are non-human

Hunting pivots

Releases covered
Ollama ×2
Tags
ai-abusebotnetcloudcryptocrimeidentityorganized-crimesupply-chain
ATT&CK techniques (9 across 9 tactics)

9 techniques observed across 2 entries about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • ReconnaissanceActive Scanning: Vulnerability Scanning
  • Resource DevelopmentCompromise Infrastructure: Network Devices
  • Initial AccessValid Accounts: Cloud Accounts · Exploit Public-Facing Application · Supply Chain Compromise: Compromise Software Dependencies and Development Tools
  • PersistenceValid Accounts: Cloud Accounts
  • Privilege EscalationValid Accounts: Cloud Accounts
  • StealthValid Accounts: Cloud Accounts
  • Credential AccessUnsecured Credentials
  • Command and ControlWeb Service: Dead Drop Resolver · Ingress Tool Transfer
  • ImpactResource Hijacking: Compute Hijacking

Reconnaissance TA0043

T1595.002Active Scanning: Vulnerability Scanning×1

Adversaries may scan victims for vulnerabilities that can be used during targeting. Vulnerability scans typically check if the configuration of a target host/application (ex: software and version) potentially aligns with the target of a specific exploit the adversary may seek to use.

Evidence: 2026-10-11/poellm-botnet-github-poem-c2-exposed-ai-and-gitea-servers · ATT&CK page ↗

Resource Development TA0042

T1584.008Compromise Infrastructure: Network Devices×1

Adversaries may compromise third-party network devices that can be used during targeting. Network devices, such as small office/home office (SOHO) routers, may be compromised where the adversary's ultimate goal is not Initial Access to that environment, but rather to leverage these devices to support additional targeting.

Evidence: 2026-10-11/poellm-botnet-github-poem-c2-exposed-ai-and-gitea-servers · ATT&CK page ↗

Initial Access TA0001

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-08-08/wiz-cloud-threat-highlights-h1-2026-ai-toolchain-exposure · ATT&CK page ↗

T1190Exploit Public-Facing Application×2

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-11/poellm-botnet-github-poem-c2-exposed-ai-and-gitea-servers · 2026-08-08/wiz-cloud-threat-highlights-h1-2026-ai-toolchain-exposure · ATT&CK page ↗

T1195.001Supply Chain Compromise: Compromise Software Dependencies and Development Tools×1

Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications, such as pip and NPM packages, may be targeted as a means to add malicious code to users of the dependency. This may also include abandoned packages, which in some cases could be re-registered by threat actors after being removed by adversaries. Adversaries may also employ "typosquatting" or name-confusion by choosing names similar to existing popular libraries or packages in order to deceive a user.

Evidence: 2026-08-08/wiz-cloud-threat-highlights-h1-2026-ai-toolchain-exposure · ATT&CK page ↗

Persistence TA0003

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-08-08/wiz-cloud-threat-highlights-h1-2026-ai-toolchain-exposure · ATT&CK page ↗

Privilege Escalation TA0004

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-08-08/wiz-cloud-threat-highlights-h1-2026-ai-toolchain-exposure · ATT&CK page ↗

Stealth TA0005

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-08-08/wiz-cloud-threat-highlights-h1-2026-ai-toolchain-exposure · ATT&CK page ↗

Credential Access TA0006

T1552Unsecured Credentials×1

Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).

Evidence: 2026-08-08/wiz-cloud-threat-highlights-h1-2026-ai-toolchain-exposure · ATT&CK page ↗

Command and Control TA0011

T1102.001Web Service: Dead Drop Resolver×1

Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers.

Evidence: 2026-10-11/poellm-botnet-github-poem-c2-exposed-ai-and-gitea-servers · ATT&CK page ↗

T1105Ingress Tool Transfer×1

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).

Evidence: 2026-10-11/poellm-botnet-github-poem-c2-exposed-ai-and-gitea-servers · ATT&CK page ↗

Impact TA0040

T1496.001Resource Hijacking: Compute Hijacking×1

Adversaries may leverage the compute resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.

Evidence: 2026-10-11/poellm-botnet-github-poem-c2-exposed-ai-and-gitea-servers · ATT&CK page ↗

Entries about Ollama (2)

2026-10-11 · view entry permalink →

NOTABLENATOB2

PoeLLM: a cryptomining botnet that reads its C2 address out of a GitHub poem compromises exposed LiteLLM, Ollama, Gotenberg and Gitea servers and turns them into scanners

Lumen's Black Lotus Labs says PoeLLM has been active since at least April 2026, deploys XMRig and Iron cryptocurrency miners that connect to a Kryptex mining pool, and is deployed through vulnerability exploitation of publicly exposed services, mainly LiteLLM and Ollama and, in the hundreds, the Gotenberg PDF converter and Gitea, with other products such as Ivanti Sentry possibly targeted (Lumen, 2026-10-07). It counts more than 3,400 impacted servers, a figure it raised after first circulating the report (BleepingComputer, 2026-10-07), predominantly in the United States and Western Europe, and assesses that PoeLLM is associated with an Italian-speaking threat actor (Lumen, 2026-10-07).

The command channel is the unusual part: the malware derives its current C2 server from keywords in a poem hosted in a GitHub repository, so the operator rotates servers by editing the poem, which Lumen counts 11 edits of since the first commit on 2026-04-13 (Lumen, 2026-10-07). Several C2 servers were routers with exposed administration pages, which Lumen reads as the operator repurposing compromised routers (Lumen, 2026-10-07). Infected servers become scanners and exploit launchers that sweep ports 3000 and 4000, the primary ports of Gotenberg and LiteLLM, and send a crafted POST that makes the target fetch a payload from the C2; the payload is a single ELF binary that bundles a remote shell, the miners, HTTP and HTTPS scanning and exploit deployment, and beacons back to the C2 (Lumen, 2026-10-07). For LiteLLM, Lumen says the endpoint /mcp-rest/test/connection, which the CVE-2026-42271 command injection references, was likely the exploitation path (Lumen, 2026-10-07), and BleepingComputer adds that Horizon3 showed it can be chained with CVE-2026-48710 for unauthenticated remote code execution (BleepingComputer, 2026-10-07). Lumen met the infrastructure while investigating the Ivanti Sentry flaw CVE-2026-10520, when a compromised Sentry victim contacted a PoeLLM C2 and began scanning for other vulnerable devices; it states no further link between that flaw and the botnet (Lumen, 2026-10-07).

The malware derives its current C2 server from keywords in a poem hosted in a GitHub repository.

We assess that PoeLLM is associated with an Italian-speaking threat actor and is deployed through vulnerability exploitation of publicly exposed services.

Lumen Black Lotus Labs 2026-10-07

Builds on: CVE-2026-42271, BerriAI LiteLLM: low-privilege command injection to host RCE, added to CISA KEV · CVE-2026-48710 "BadHost", Starlette (FastAPI / vLLM / LiteLLM / MCP SDK): Pre-Auth Auth Bypass… · Three unrelated AI platforms, three intrusions, one pattern: gateways and orchestrators… · CVE-2026-10520 / CVE-2026-10523, Ivanti Sentry: pre-auth OS command injection to root (CVSS…

threat11 Oct 03:37Zsingle-sourceOpen finding →
Sources: Lumen Black Lotus Labs · BleepingComputer

2026-08-08 · view entry permalink →

NOTABLENATOB2

Wiz Cloud Threat Highlights H1 2026: LiteLLM had four separate security events in six months, unauthenticated MCP endpoints turned up across hundreds of environments, and a new extortion actor goes after service accounts rather than people

Wiz Research's semi-annual cloud threat report covers January to June 2026, and its value for this constituency is the named inventory rather than the trend lines: it says concretely which AI infrastructure attracted attacker and researcher attention, and what the resulting exposure looks like in a cloud estate.

The AI toolchain now has its own vulnerability cadence. LiteLLM (an AI gateway Wiz says is present in over a third of the cloud environments it monitors) "had four separate security events in six months: a supply-chain compromise, an SQL injection vulnerability exploited in the wild, a privilege escalation chain and an authentication bypass", while Dify, Langflow, n8n and Ollama "each had critical unauthenticated vulnerabilities of their own" (Wiz Research, 2026-08-06). That list is worth reading as an asset-inventory prompt: these are components teams stand up quickly, often outside the change process that governs the rest of the estate, and three of the five have already reached this pipeline's coverage through separate exploited-vulnerability events.

The exposure finding is sharper than the vulnerability one. On Model Context Protocol servers, Wiz reports: "We found unauthenticated MCP endpoints across hundreds of environments, each one a pre-authenticated proxy holding backend credentials and bridging multiple services" (Wiz Research, 2026-08-06). The reason that shape matters is that an MCP server is not a data store to be broken into; it is a component that already holds the credentials for everything behind it and exists to act on their behalf, so reaching it unauthenticated is not a step toward access, it is the access.

On the actor side, Wiz profiles JINX-0163, a cloud-native extortion group it began tracking in 2026 and that "consistently targets non-human identities - service accounts and IAM roles - rather than end users", in some cases leveraging a single over-privileged identity or an exposed state file to pivot to a full inventory (Wiz Research, 2026-08-06). An extortion group that skips human identity entirely bypasses most of the control stack organisations have spent two years building (phishing-resistant MFA, conditional access, helpdesk verification) none of which applies to a service account.

On supply chain, Wiz records that notable supply-chain attacks "went from making up about 10% of significant incidents in H2 2025 to 25% in H1 2026", with TeamPCP, North Korea and at least three independent operations running campaigns concurrently across npm, PyPI, Composer, VSCode extensions, Jenkins plugins and AUR, several of which had not been targeted this way before (Wiz Research, 2026-08-06). It also notes that malicious packages' shrinking availability window is what makes an install cooldown policy effective (declining to download packages published less than 24 hours ago) which is a specific, cheap control rather than a general recommendation.

We found unauthenticated MCP endpoints across hundreds of environments, each one a pre-authenticated proxy holding backend credentials and bridging multiple services.

They went from making up about 10% of significant incidents in H2 2025 to 25% in H1 2026.

Wiz Research 2026-08-06
annual-report08 Aug 05:22Zsingle-sourceOpen finding →
Sources: Wiz Research

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Research1
  • Threats1

Source distribution

  • bleepingcomputer.com1 (33%)
  • lumen.com1 (33%)
  • wiz.io1 (33%)
All cited sources (3)