Hackers Abuse Legitimate RMM Tools to Maintain Persistent Access and Evade Detection

**Executive summary:** Researchers observed an attacker wiring a misconfigured Ollama model server into an autonomous offensive pipeline (VAPT) that automates discovery, vulnerability matching, exploit generation, and confirmation of remote code execution; the campaign used multiple AI models and left detailed IoCs while testing against private/lab targets, and defenders are warned to avoid exposing inference endpoints and to add authentication and monitoring.