Loading threat actor…
Hecker is a financially motivated cybercriminal threat actor associated with an early attributed LLMjacking operation dubbed Bizarre Bazaar. The actor is also tracked under the aliases Sakuya and LiveGamer101. Activity attributed to Hecker centers on identifying exposed or weakly authenticated large language model infrastructure, including self-hosted Ollama deployments, OpenAI-compatible APIs, and publicly accessible Model Context Protocol servers, then monetizing unauthorized access. The operation has been assessed as part of a small criminal supply chain involving scanning, endpoint validation, and commercial resale of access. Reported tradecraft includes internet-wide reconnaissance and scanning for exposed AI services, validation of discovered endpoints, abuse of compromised inference infrastructure for cryptocurrency mining, resale of API access to other users, attempted exfiltration of prompt and conversation data, and attempts to pivot further into internal environments through connected MCP services. The actor’s activity demonstrates a blend of reconnaissance, initial access, post-compromise monetization, exfiltration, and lateral-movement-oriented behavior focused on AI infrastructure rather than traditional enterprise endpoints. Hecker’s operations have targeted misconfigured cloud, residential, development, staging, and production AI environments that are reachable from the public internet. The actor has been linked to a resale service and related branding used to commercialize unauthorized access to multiple AI models. Public reporting characterizes this activity as one of the first documented marketplaces built around stolen or abused LLM access. No high-confidence attribution to a nation-state or specific country of origin is currently available from the supplied facts.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Linked to scanning for misconfigured LLM servers and selling access to their compute on marketplaces ("Operation Bizarre Bazaar").
Attributed operator behind an LLMjacking monetization scheme ("Operation Bizarre Bazaar") that scans for exposed Ollama/vLLM/OpenAI-compatible LLM endpoints lacking authentication, validates access, and resells discounted access via a marketplace/gateway (silver[.]inc).
Named threat actor attributed by Pillar Security to the broader operation involving unauthorized access and monetization of exposed LLM infrastructure (including resale of access and abuse of misconfigured endpoints).
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.