Analysis of Large-Scale Attacks Targeting LocalAI Infrastructure and Exfiltration of Sensitive Data from Thai Military

Overview

Oasis Security analyzed attack tools, callback logs, and related files recovered from an attacker-controlled server. The campaign primarily targeted LocalAI instances exposed to the internet without authentication, identifying 243 unauthenticated instances worldwide and confirming command execution with root privileges on at least 23 nodes.

LocalAI is an open-source platform that runs generative AI models locally and exposes APIs compatible with external AI services such as OpenAI.

The operator selected high-value infrastructure from those LocalAI targets and compromised a desktop LocalAI workstation and a related private network. Sensitive data including personal information, GPS coordinates, banking-application screenshots, and national ID card scans was exfiltrated. Additional compromise activity included exploitation of legacy infrastructure, authentication bypass, a Crypto Sweep for wallets and API keys, and theft of AWS ECS task credentials.

The case shows that an unauthenticated, internet-exposed LocalAI instance can be used not only for remote code execution but also as initial access into an internal network.

---

Executive Summary

• Analysis of attacker infrastructure identified a large-scale campaign targeting unauthenticated LocalAI instances through unauthenticated admin API exposure and command execution inherent in MCP STDIO configuration
• Attacker artifacts indicated that 230 of 243 unauthenticated LocalAI instances were assessed as exploitable. Callback logs independently confirmed command execution with root privileges on 23 servers
• Post-compromise activity included exfiltration from a workstation associated with the Thai military and collection of 127 AWS credential records

---

Infrastructure Analysis

Server-side files were collected from infrastructure hosted at the following server:

• IP Address: 184.107.106.86
• Geolocation: Canada

Analysis of the collected files revealed multiple artifacts associated with the attacker's operation, including:

• Exploitation scripts used for mass LocalAI remote code execution
• A listener and dynamic payload server that collected callbacks
• Target lists, status files, and records of high-value nodes

The collected files indicate that the operator maintained structured tooling for target discovery, parallel exploitation, and post-compromise collection.

---

Unauthenticated LocalAI campaign

Attack Timeline and Workflow

Core activity ran for about 24 to 30 hours. The operator validated the execution path on a canary node before expanding exploitation to unauthenticated LocalAI instances in parallel, then used root access for reconnaissance, data exfiltration, and cloud-credential theft.

448

targets initially collected

243

unauthenticated LocalAI instances

230

assessed as RCE-capable

23

root callbacks confirmed

127

AWS credential records

Phase 1

Discovery

1. 01Internet-exposed LocalAI collectedobservedOSINT queries produced 448 LocalAI instances before fingerprinting.
2. 02API fingerprintingobserved/api/version, /v1/models, /api/tags, and /models/available reduced the set to 243 unauthenticated targets.
3. 03RCE vectors testedobserved`/backends/apply`, `/models/import`, and `/models/edit` were checked; 230 of 243 were assessed as exploitable.

Target inventory readyThe operator had a refined list and a preferred vector before mass exploitation.

Phase 2

Mass RCE

1. 04Canary-node verificationconfirmed2026-08-14 03:19:50 UTC — `/models/import` MCP STDIO against 15.235.***.*** returned uid=0(root).
2. 0512-thread parallel attackobserved2026-08-14 03:21:44–03:21:51 UTC — `mass_import.py` hit the 230 exploitable instances.
3. 06Root callbacks collectedconfirmed`callbacks.log` recorded root execution on 23 servers, including a workstation associated with the Thai military-related PC.

Root on 23 LocalAI nodesVerified RCE was expanded in a short automated window.

Phase 3

Thai Military

1. 07Follow-on targeting beganconfirmed2026-08-14 03:32 UTC onward — collection shifted to the workstation associated with the Thai military-related PC.
2. 08Private-network reconnaissanceobserved2026-08-14 03:45–04:28 UTC — `netrecon1~5.py` mapped internal hosts and collected hashes, tokens, and Immich access.
3. 09Sensitive data exfiltratedconfirmed2026-08-14 04:52–06:05 UTC — banking screenshots, ID scans, GPS clusters, and military-related files were sent to the listener.

Internal network reachedOne unauthenticated LocalAI instance expanded into a related private network and confirmed exfiltration.

Phase 4

Cloud Expansion

1. 10Crypto Sweep and AWS harvestobserved`analyze.py` searched wallets and miners; 127 AWS ECS/IMDS credential records were stored in `loot4`.
2. 11STS verificationconfirmed2026-08-15 02:43 UTC onward — `aws_check.py` succeeded against more than 10 AWS accounts.
3. 12Follow-on access limitedobservedLater S3 and Secrets Manager calls were mostly AccessDenied; retries on older LocalAI nodes failed.

Cloud credentials collectedSTS authenticated, but additional S3 and Secrets Manager exfiltration was not identified.

---

Large-Scale RCE Attack on Vulnerable LocalAI Instances

The operator identified 243 exposed LocalAI instances through OSINT scanning, confirmed via API fingerprinting that they were unauthenticated, and then tested three attack vectors. localaiexp.py on the server contains the platform-specific search queries used for target discovery.

Unauthenticated instances were identified through fingerprinting of /api/version, /v1/models, /api/tags, and /models/available.

The operator then used /backends/apply, /models/import, and /models/edit to test multiple LocalAI remote code execution paths. Of the three, /models/import with MCP STDIO configuration to execute shell commands was assessed as the most reliable.

targets_raw.json recorded 230 of 243 targets as exploitable, with the applicable vector and whether root privileges were available. recon.py injected an MCP STDIO shell command into /models/import on the canary node 15.235.***.***.

Analysis of callbacks.log confirmed a callback from 15.235.***.*** containing root privileges and Docker environment information. mass_import.py was then run against 230 targets with 12 threads.

callbacks.log confirmed command execution with root privileges on 23 of those servers.

---

Compromise of a Thai Military-Related Workstation and Related Private Network

Among the 23 nodes with confirmed root execution, a workstation at 49.0.***.*** was identified and assessed as associated with the Thai military. At 03:32 UTC on 14 August 2026, the operator selected it as a desktop LocalAI host with reusable plaintext credentials. Root-command responses from this node were recorded in callbacks.log.

Decoded callback data identified the system configuration and command-execution environment. According to system reconnaissance results (49.0.***.***_8889_4160e2f7.txt), the node had desktop applications including Discord, Firefox, Spotify, Steam, and immich-desktop. The operator recorded it as a personal AI and home-lab station.

Environment variables showed LocalAI-related cache paths set to /home/power/models, indicating that the AI service ran with root privileges.

After compromising the host, the operator obtained hashes for the root, power, and mysql_power accounts (atc_hashes.txt).

A subsequent callback at /x/op7/0 contained a phpMyAdmin plaintext password. That password was assessed as reused across the server.

atc_army_creds.md recorded private-network addresses and credentials. Using that material, the operator conducted further reconnaissance of related internal systems.

netrecon.py performs reconnaissance of internal systems using the private-network addresses and credentials from the initially compromised workstation, including /etc/shadow hashes, open ports, web services, and shell history.

netrecon2.py collects per-host database passwords, public secret keys, authentication tokens, and account and configuration information.

netrecon3.py collects Namecheap DNS API keys and certificates, MediaWiki user information, FileGator and Immich configurations, and Docker container information.

netrecon4.py collects Plex authentication tokens, Immich PEM private keys, FileGator directories, and Namecheap DNS API credentials.

netrecon5.py probes internal devices, searches for FileGator and TLS private keys, and deletes temporary scripts after execution.

---

Immich Database Access and Data Exfiltration

During reconnaissance with netrecon.py, the operator obtained Immich database credentials in which the same password as the server account had been reused, and wrote immich_schema.py to query the database.

Immich query results identified two users, banking-application screenshots, and personal photographs across more than 25 albums. Metadata included more than 229 location records in Thailand and camera-device information.

The operator selected four files related to Thai financial institutions and personal identification, then wrote pull_photos.py, which encoded the data in Base64, split it into 2,800-character chunks, and transmitted it to 184.107.106.86:18080.

callbacks.log recorded exfiltration of more than 1,007 data chunks.

loot/photos on the server contained exfiltrated data including transfer confirmations from Thai financial institutions such as SCB, Krungsri, and K PLUS, and scans of national ID cards.

The operator also cross-referenced EXIF GPS data from Immich against the photographs and plotted capture locations ([USERS2]_geo.md, [USERS2]_locations.kml). Classifying those locations by city and region shows identification of residence and routine activity areas as well as military-related workplaces and bases.

immich_mil.py selected locations with high military relevance, such as military supply warehouses, air force bases, and areas near the Myanmar border, and queried image information captured at those locations.

query_result.txt records the results of those image queries. The operator is assessed to have selected data for exfiltration from these results.

Through pull_milphotos.py, pull_office_orig.py, and pull_office2.py, exfiltrated images were identified in loot/military.

Among the exfiltrated photos was a military transport aircraft photographed at a Thai air force base in the Takhli area. The image was assessed as Thai military aviation-related.

In the same folder, README.md classified the images as military-related information and victim personally identifiable information.

pull_mil.py accessed the FileGator web file repository and extracted military-related research material.

The identified document is an internal report titled logsMIS Digital Transformation Strategy, assessed as Thai army logistics-related material. It presents a three-phase roadmap including data-quality improvement, introduction of digital dispatching, GPS, and fuel sensors, and AI-based predictive maintenance and big-data analysis.

The operator obtained credentials for the Nextcloud ais host (192.168.0.15) via netrecon2.py, then exfiltrated related logs (ais_audit.log, ais_context_chat.log).

The major tools used against the compromised node (49.0.***.***), and the data collected or exfiltrated with them, are summarized below.

Thai military-related workstation

Tools used on 49.0.***.***

Scripts recovered from the attacker server show internal reconnaissance, Immich image selection, and chunked exfiltration from 49.0.***.*** and related hosts.

Phase 1

Reconnaissance

1. 01Internal-host collectionobserved`netrecon1~5.py` collected hashes, tokens, TLS keys, and host roles into `atc_army_creds.md` and `atc_hashes.txt`.
2. 02Immich database enumerationobserved`immich_schema.py` and `immich_bank1~2.py` enumerated users, albums, and GPS records, writing `immich_index.txt` and `query_result.txt`.

Targets selectedCredential reuse on Immich and mapped internal hosts provided the list of files later pulled to the listener.

Phase 2

Image exfiltration

1. 03Financial and identity imagesconfirmed`pull_photos.py` exfiltrated `8453_krungsri.jpg`, `8445_scb.jpg`, `8451_kplus.jpg`, and `4149_scan.jpg`.
2. 04Military and archival photosconfirmed`pull_milphotos.py` exfiltrated `grad1.jpg`, `grad2.jpg`, `takhli1.jpg`, `takhli2.jpg`, `fang.jpg`, `buriram.jpg`, `o2008.jpg`, and `o2011.jpg`.
3. 05Office and warehouse originalsconfirmed`pull_office_orig.py` and `pull_office2.py` exfiltrated `office_full.jpg`, `off8390_full.jpg`, and `off8356_full.jpg`.

Photo archives recoveredBanking, ID, GPS-tagged personal, and military-related images were reconstructed in `loot/photos` and `loot/military`.

Phase 3

Documents and logs

1. 06logsMIS research documentconfirmed`pull_mil.py` retrieved `[REDACTED]_logsMIS_research.txt` from FileGator.
2. 07Nextcloud ais logsobservedDirect access to `192.168.0.15` collected `ais_audit.log` and `ais_context_chat.log`.

Non-image loot collectedMilitary logistics material and Nextcloud audit logs were taken in addition to Immich photographs.

Based on callbacks.log timestamps, the attack tooling, and related artifacts, the following timeline was reconstructed for 49.0.***.***.

Reconstructed from callbacks.log

Activity on 49.0.***.***

After root execution on the Thai military-related workstation, the same UTC day covered private-network mapping, Immich queries, and confirmed image exfiltration.

Phase 1

Initial access

1. 01Root execution on 49.0.***.***confirmed2026-08-14 03:21:44 UTC — `callbacks.log` recorded root command execution during the 12-thread `mass_import.py` run.

Workstation compromisedThe host was inside the mass-RCE window and became the focus of follow-on collection.

Phase 2

Internal reconnaissance

1. 02Credential reuse identifiedobserved`/etc/shadow` hashes were obtained and reused passwords were recorded in `atc_army_report.md`.
2. 03Private network mappedobserved`.bash_history`, `known_hosts`, and ARP neighbor queries identified internal hosts.
3. 04netrecon1~5.pyobservedFollow-on scripts collected hashes, tokens, keys, and service configuration from related hosts.
4. 05Immich database queriedobserved`immich_schema.py` identified users, albums, and GPS records written to `query_result.txt`.

Internal access expandedPassword reuse and Immich credentials opened image archives and adjacent services.

Phase 3

Exfiltration

1. 06Image callbacks confirmedconfirmed2026-08-14 05:24:17 UTC — `callbacks.log` recorded `/m/o2008/286` and `/m/o2008/318` image chunks.
2. 07pull_* scripts usedconfirmed`pull_photos.py`, `pull_milphotos.py`, `pull_office*.py`, and `pull_mil.py` sent selected files to the listener.
3. 08GPS mapping and classificationobservedCapture locations were plotted in `[REDACTED]_locations.kml` and classified in `README.md`.

Sensitive data exfiltratedBanking, identity, GPS, and military-related files from the workstation and related network were recovered on the attacker server.

---

Other High-Value Nodes

Root privileges were obtained on 23 nodes. The operator classified 11 as high-value in retry.json and selected 6 for in-depth review. Data exfiltration was identified on 4 of those 6.

The remaining two (213.222.***.***, 210.106.***.***) showed compromise, but no exfiltrated files were identified.

Six nodes selected for in-depth review

High-value node status

The operator ranked six LocalAI hosts for follow-on work. Four had confirmed exfiltration. Two showed compromise only. The tracks are independent targets, not one intrusion chain.

37.27.***.***

Paid AI API

1. 01che[REDACTED].devconfirmedExfiltration confirmed — bash history and service-operation information.

42.200.***.***

Image-generation AI

1. 02User API tracesconfirmedExfiltration confirmed — 1,024 user API traces.

213.222.***.***

NVIDIA inference

1. 03Compromised onlyobservedNo exfiltrated files identified. A third-party backdoor was present.

211.171.***.***

Cryptocurrency mining

1. 04bi[REDACTED].aiconfirmedExfiltration confirmed — wallet address and mining configuration.

49.0.***.***

Thai military-related workstation

1. 05Covered aboveconfirmedExfiltration confirmed — personal and military-related data.

210.106.***.***

Korean KT-band inference

1. 06Compromised onlyobservedNo exfiltrated files identified.

The Thai military-related workstation is analyzed in the previous section. The other five nodes are summarized below.

---

Paid AI API (che[REDACTED].dev)

• Target: 37.27.***.*** (Ubuntu-32)
• Role: Europe-based commercial AI API
• Exfiltration: Confirmed

Service configuration and operational information were leaked from Che[REDACTED]r (che[REDACTED].dev). The attack process is documented in readme.md under loot/che[REDACTED]r.

The server was first assessed as a high-ransom target, then re-assessed as low-to-medium. Identified assets were limited to a CPU-based LLM demo, a static website, and models in /mnt/data, with no sensitive information, database, or mail.

Exfiltrated bash_history (che[REDACTED]r_history.txt) showed site configuration, nginx proxy, certbot SSL certificates, and DNS settings.

During the intrusion, the operator found a UPX-packed ELF (/tmp/.sysinit) in the root crontab and assessed it as an implant from an unrelated third party.

---

Image-generation AI

• Target: 42.200.***.*** (67a7ca719747)
• Role: NVIDIA GPU LLM API container (916G disk, 257G RAM)
• Exfiltration: Confirmed — 1,024 user API traces

User request and response data were exfiltrated from this node.

Trace logs in /data/traces/api were exposed. traces_hits_raw.txt contained image-generation prompts, seeds, and image sizes.

---

NVIDIA inference node

• Target: 213.222.***.*** (78f69d95772e)
• Role: NVIDIA GPU inference container (438G disk, 30G RAM)
• Exfiltration: None identified
• Additional finding: Third-party backdoor

This operator collected evidence of a separate intrusion. Callback data showed runtime_settings and about 9.7G of models, including Mistral-7B, Qwen3-VL-2B, deepseek-r1, and gemma.

A third-party attacker (173.212.213.83), distinct from this operator (184.107.106.86), installed a backdoor. The payload included a Base64-encoded implant, backdoor model configurations in /models, and a JSON-RPC loop disguised as MCP STDIO.

The backdoor installed Dropbear/SSH, registered a public key in authorized_keys, and opened a reverse SSH tunnel to 152.53.120.90 with port mapping for 22000–22999.

Related samples on the attacker server include tw213_bkdoor.py, bkdoor_foreign.py, and README.md.

---

Cryptocurrency mining host (bi[REDACTED].ai)

• Target: 211.171.***.*** (bi[REDACTED]-j222)
• Role: Korean blockchain / mining bare-metal host (1.8T disk, 515G RAM)
• Exfiltration: Confirmed — inactive mining configuration

Cryptocurrency addresses and past mining configuration were exfiltrated from Bi[REDACTED] (bi[REDACTED].ai). The host was using 1,014G of disk at the time of collection.

bx211_prover_cfg.txt contained an ALEO wallet address (aleo15hg0tj6nuup…) and related mining settings. Related services were inactive at the time of analysis.

bx211_gpu.txt showed that the GPU driver was not loaded. File exfiltration was confirmed, but the scale and sensitivity of the data are assessed as relatively low compared with other nodes.

---

Korean KT-band node

• Target: 210.106.***.*** (2c7260fd695c)
• Role: AI inference container (715G of 1.1T disk, 128G RAM)
• Exfiltration: None identified

The operator obtained root privileges on this node.

No exfiltrated miner, wallet, password, or IMDS credential artifacts were identified, and the reviewed evidence did not show other file exfiltration from this node.

---

Cryptocurrency and AWS ECS Credential Theft

In dyn_server.py, a payload for discovering cryptocurrency-related information and AWS ECS credentials on compromised systems was identified. Through analyze.py, wallet.dat, keystore files, seed phrases, mining processes, and related environment variables were searched as part of a Crypto Sweep. The generic Crypto Sweep identified no additional active wallet, seed phrase, or other newly obtained cryptocurrency-related material.

The operator checked for AWS container environment variables such as AWS_CONTAINER_CREDENTIALS_RELATIVE_URI. If the value existed, the payload accessed the container-credential endpoint and collected temporary credentials.

In the server's loot4 directory, 127 newly obtained AWS credential records were identified.

The operator then verified the collected credentials using aws_check.py to determine whether AWS API calls were possible.

aws_loot.json showed successful STS authentication records for more than 10 AWS accounts. Subsequent access to S3 and Secrets Manager was mostly denied with AccessDenied, so additional exfiltration through those services has not been identified.

---

Conclusion

Files collected from the attacker server showed a large-scale campaign against unauthenticated LocalAI instances that used a pre-authentication remote code execution path based on MCP STDIO configuration.

Attacker artifacts indicated that 230 of 243 targets were exploitable, while callback logs confirmed root-level command execution on 23 servers. Post-compromise activity included exfiltration from a workstation associated with the Thai military and collection of 127 AWS credential records, with STS authentication possible in more than 10 AWS accounts.

An internet-exposed LocalAI instance without authentication can provide root-level initial access and lead to internal lateral movement, theft of cloud credentials, and exfiltration of sensitive information. Organizations operating LocalAI should apply authentication and access control, remove unnecessary external exposure, and monitor abnormal /models/import, /models/edit, and /backends/apply requests.