Two Separate Campaigns Target Exposed LLM Services

Attackers focused on exposed large language model (LLM) services across two campaigns that, together, generated 91,403 attack sessions spotted by GreyNoise between October 2025 and January 2026. According to GreyNoise, the first campaign likely involved security researchers or bug bounty hunters and used SSRF-related techniques to trigger outbound connections, with 1,688 sessions in 48 hours during the Christmas period.

The second campaign began on 28 December 2025 and proved more threatening, probing “every major model family” including OpenAI, Anthropic, Meta, and Google Gemini formats to fingerprint misconfigured proxies. In total, 80,469 sessions were recorded in just 11 days for the second campaign, which targeted OpenAI-compatible API formats and Google Gemini formats.

GreyNoise notes that the scale of enumeration and the timing around Christmas suggest a deliberate effort to map infrastructure for later use, and defenders were provided with OAST callback domains and IPs to block. Defenders are advised to lock down model pulls with egress filtering, watch for rapid-fire requests to model endpoints, and monitor JA4 fingerprints to spot tooling and automation targeting their LLM infrastructure.