{
  "slug": "hecker-llmjacking",
  "name": "Operation Bizarre Bazaar (Hecker LLMjacking)",
  "aliases": [
    "Hecker",
    "LiveGamer101",
    "Operation Bizarre Bazaar",
    "Sakuya"
  ],
  "status": "dormant",
  "firstSeen": "2025-10-01",
  "lastSeen": "2026-01-01",
  "lastReviewed": "2026-09-20T00:00:00Z",
  "summary": "Exposed LLM endpoints were hijacked and resold for LLM access.",
  "description": "Hecker scanned exposed Ollama and OpenAI-compatible endpoints; reporting found roughly 175,000 public Ollama hosts across 130 countries.",
  "actor": "Hecker",
  "platforms": [
    "ollama",
    "internet-exposed"
  ],
  "ttps": [
    {
      "framework": "atr",
      "id": "exposed-surface"
    }
  ],
  "timeline": [
    {
      "date": "2025-10-01",
      "branch": "exposure",
      "id": "ollama-11434",
      "note": "Exposed endpoint wave began.",
      "source": "https://thehackernews.com/2026/01/researchers-find-175000-publicly.html",
      "approximate": true
    },
    {
      "date": "2026-01-01",
      "branch": "report",
      "id": "175000-hosts",
      "note": "Public host telemetry and LLM resale were reported.",
      "source": "https://www.bleepingcomputer.com/news/security/hackers-hijack-exposed-llm-endpoints-in-bizarre-bazaar-operation/",
      "approximate": true
    },
    {
      "date": "2026-01-01",
      "branch": "report",
      "id": "silver-inc-marketplace",
      "source": "https://www.bleepingcomputer.com/news/security/hackers-hijack-exposed-llm-endpoints-in-bizarre-bazaar-operation/",
      "approximate": true,
      "note": "Source gives a month or period, not a day."
    }
  ],
  "iocs": [
    {
      "type": "domain",
      "value": "silver.inc",
      "firstSeen": "2026-01-01",
      "source": "https://thehackernews.com/2026/01/researchers-find-175000-publicly.html"
    },
    {
      "type": "domain",
      "value": "silver.inc",
      "firstSeen": "2026-01-01",
      "source": "https://www.bleepingcomputer.com/news/security/hackers-hijack-exposed-llm-endpoints-in-bizarre-bazaar-operation/"
    }
  ],
  "exposedConfigurations": [
    {
      "label": "Ollama is bound off loopback without an authentication proxy",
      "matcher": {
        "all": [
          {
            "field": "features[\"OLLAMA_HOST.set\"]",
            "op": "eq",
            "value": true
          },
          {
            "field": "surface",
            "op": "in",
            "value": [
              "public",
              "internet"
            ]
          }
        ]
      }
    }
  ],
  "advisories": [
    "ACVE-2026-0407"
  ],
  "incidents": [],
  "sources": [
    {
      "url": "https://thehackernews.com/2026/01/researchers-find-175000-publicly.html",
      "publisher": "The Hacker News",
      "date": "2026-01-01"
    },
    {
      "url": "https://www.bleepingcomputer.com/news/security/hackers-hijack-exposed-llm-endpoints-in-bizarre-bazaar-operation/",
      "publisher": "BleepingComputer",
      "date": "2026-01-01"
    }
  ],
  "dormantAfterDays": 30
}