{"id":"CMP-202611-eqkfyp","kind":"campaign","aliases":[],"related":[],"title":"LLMjacking crews (UNC6993, Jet Night) use stolen cloud keys and tokens to run up AWS Bedrock, Gemini and Azure OpenAI bills of $100K+/day and resell the access (Google GTIG)","description":null,"summary":"Google Threat Intelligence (2 Nov 2026) reports multiple LLMjacking intrusions during 2026 in North America, South America and Asia Pacific. Attackers get in with leaked GitHub PATs, AWS IAM credentials, misconfigured GCP service account keys, federation tokens, exposed Ollama endpoints, or the LiteLLM /key/regenerate flaw (CVE-2026-40217). They then turn on LLM services that were often never enabled, create new API keys, and resell the model quota through 'LLM mixer' relays (jet-night.com, newapi.pro, the new-api and gcli2api tooling). UNC6993 used a fake portal to harvest access-token JSON, which gets around passwords and MFA, and ran up more than $100,000 in charges. Jet Night made 500,000+ API calls in under 8 hours, costing one victim about $1M. Some actors also use burn-and-rotate service accounts and inject SSH keys for persistence. Victims are not named.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-03T13:16:56+00:00","products":[{"name":"AWS Bedrock","fixed":[]},{"name":"Google Vertex AI / Gemini API","fixed":[]},{"name":"Azure OpenAI / Azure AI Services","fixed":[]},{"name":"LiteLLM","fixed":[]},{"name":"Ollama","fixed":[]},{"name":"AWS IAM","fixed":[]},{"name":"Google Cloud IAM","fixed":[]}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"In cloud audit logs, look for LLM services being enabled when you never used them: GCP EnableService for aiplatform.googleapis.com; AWS PutUseCaseForModelAccess or CreateFoundationModelAgreement; Azure Microsoft.CognitiveServices/accounts/deployments/write. Look for bursts of InvokeModel, Converse or GenerateContent calls, low-volume max_tokens=1 validation sweeps, ListFoundationModels or ListPublisherModels enumeration, and changes or deletion of model invocation logging or diagnostic settings. Watch for unexpected user agents (claude-cli, aws-sdk-rust, aws-sdk-go-v2) and new service accounts, API keys or SSH keys. Look for traffic to jet-night.com or newapi.pro. Check for sudden spikes in AI spend. GTIG has not published IPs or hashes; the full IOC set is in its GTI collection.","fix":"Rotate any leaked GitHub PATs, IAM keys and service account keys, and scan your repos for secrets. Deny LLM service permissions to identities that do not need them, and alert when an LLM service is enabled. Scope AI API keys by model and environment, and set quotas and spending caps. Turn on data-access and inference audit logging (GCP inference logs are off by default; Azure needs diagnostic logs). Patch LiteLLM for CVE-2026-40217 and do not expose Ollama to the internet. Enforce phishing-resistant MFA and short token and session lifetimes.","status":"open","published_at":null,"first_seen_at":"2026-11-03T13:16:56+00:00","triaged_at":"2026-11-03T13:16:56+00:00","updated_at":"2026-11-03T13:16:56+00:00","category":"infrastructure","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-2026':110B '-202611':32A '-40217':111B '/day':24A '/key/regenerate':107B '000':168B,175B '100':167B '100k':23A '1m':186B '2':67B '2026':69B,75B '500':174B '8':180B 'access':28A,153B 'access-token':152B 'account':97B,196B 'actor':188B 'ai':45A,51A 'also':189B 'america':78B,80B 'api':47A,125B,141B,176B 'around':158B 'asia':82B 'attack':84B 'aw':15A,91B 'aws':41A,55A 'azur':19A 'azure':48A,50A 'bedrock':16A,42A 'bill':21A 'burn':192B 'burn-and-rot':191B 'call':177B 'campaign':60B 'charg':170B 'cloud':8A,58A 'cmp':31A 'cost':182B 'creat':123B 'credenti':93B 'crew':2A 'cve':109B 'd1337':39A 'd1337-kairos':38A 'earli':62B 'early-warn':61B 'enabl':122B 'endpoint':103B 'eqkfyp':33A 'expos':101B 'fake':148B 'feder':99B 'flaw':108B 'gcli2api':143B 'gcp':95B 'gemini':17A,46A 'get':85B,157B 'github':89B 'googl':29A,64B 'google':43A,57A 'gtig':30A 'harvest':151B 'hour':181B 'iam':56A,59A,92B 'inject':198B 'intellig':66B 'intrus':73B 'jet':4A,36A,171B 'jet-night.com':136B 'json':155B 'kairos':40A 'key':9A,98B,126B,200B 'leak':88B 'litellm':53A,106B 'llm':116B,133B 'llmjack':1A,72B 'llmjacking':34A 'made':173B 'mfa':161B 'misconfigur':94B 'mixer':134B 'model':130B 'multipl':71B 'name':206B 'never':121B 'new':124B,140B 'new-api':139B 'newapi.pro':137B 'night':5A,37A,172B 'north':77B 'nov':68B 'often':120B 'ollama':54A,102B 'one':183B 'openai':20A,49A 'pacif':83B 'password':159B 'pat':90B 'persist':202B 'portal':149B 'quota':131B 'ran':163B 'relay':135B 'report':70B 'resel':26A,128B 'rotat':194B 'run':13A 'servic':96B,117B,195B 'services':52A 'south':79B 'ssh':199B 'stolen':7A 'threat':65B 'token':11A,100B,154B 'tool':144B 'turn':114B 'unc6993':3A,35A,145B 'use':6A,146B,190B 'vertex':44A 'victim':184B,203B 'warn':63B","nicknames":["LLMjacking","UNC6993","Jet Night","D1337-KAIROS"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["awsbedrock","awsiam","azureopenaiazureaiservices","bedrock","cloudiam","d1337kairos","googlecloudiam","googlevertexaigeminiapi","iam","jetnight","litellm","llmjacking","ollama","openaiazureaiservices","unc6993","vertexaigeminiapi"],"ptokens":["ai","api","aws","azure","bedrock","cloud","gemini","google","iam","litellm","ollama","openai","services","vertex"],"labels":["campaign","earlywarning","high","infrastructure"],"first_public_at":"2026-10-30T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-eqkfyp","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-03T13:16:56+00:00","fetched_at":"2026-11-03T13:16:56+00:00","note":null}],"documents":[{"id":57627,"url":"https://bsky.app/profile/campuscodi.risky.biz/post/3mzfvkfusc22l","title":"@campuscodi.risky.biz: Google warns that threat actors who compromise cloud-based AI infrastructure in ","kind":"post","source":"bluesky","publisher":null,"text":"Google warns that threat actors who compromise cloud-based AI infrastructure in attacks known as LLMJacking can easily rack up costs for the compromised companies mounting up to $100,000/day\n\ncloud.google.com/blog/topics/...\nhttps://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models\n\nlikes 0 reposts 0","published_at":"2026-11-03T13:02:42+00:00","relation":"describes","confidence":null,"note":null},{"id":57639,"url":"https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models","title":"LLMjacking: monetizing compromised cloud models (Google GTIG)","kind":"blog","source":"analyst","publisher":null,"text":"GTIG overview of LLMjacking intrusions in 2026 across AWS Bedrock, Google Gemini/Vertex (aiplatform.googleapis.com) and Azure Cognitive Services. Clusters: UNC6993 (misconfigured Service Account key, fake portal harvesting access-token JSON to bypass MFA, new API keys, >$100,000 charges; new-api and gcli2api resale tooling); Jet Night operators (500,000+ API calls in <8h via jet-night.com, ~$1M cost); D1337-KAIROS persona (reverse proxies, containerized backdoor using Manus); ai-relay operators reselling quota via newapi[.]pro and lookalike domains; unnamed actors using burn-and-rotate service accounts, token-creation privilege abuse, SSH key injection, LiteLLM CVE-2026-40217 (/key/regenerate). Initial access: GitHub PATs, IAM credentials, SA keys, federation tokens, exposed Ollama /api/create. Indicators: domains jet-night.com, newapi.pro; user agents claude-cli, aws-sdk-rust, aws-sdk-go-v2; max_tokens=1 validation sweeps; AWS InvokeModel/Converse/ListFoundationModels/PutUseCaseForModelAccess/CreateFoundationModelAgreement/DeleteModelInvocationLoggingConfiguration; Azure CognitiveServices deployments/write, diagnosticSettings changes; GCP EnableService, GenerateContent, ListSinks. Full IOCs in GTI collection.","published_at":"2026-11-02T00:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":27004,"url":"https://www.wiz.io/blog/black-october-for-ai-developer-platforms","title":"“Black October” for AI Developer Platforms (Wiz Research)","kind":"blog","source":"blog","publisher":null,"text":"Wiz (Benjamin Read, Rami McCarthy), 2026-10-30. At least nine AI developer platforms disclosed incidents in October 2026: Fireworks AI (Oct 6), Andromeda (Oct 9), Zeabur (Oct 14), Lightning AI (Oct 15), OpenCode (Oct 16-17), Railway (Oct 20), Warp (Oct 23), CommandCode (Oct 28), Northflank (Oct 30). Fireworks, OpenCode, Warp report 'agent swarm' attacks; OpenCode and CommandCode attribute to distillation. Fireworks, Zeabur, Lightning: credential access root cause; Railway: privilege escalation in build infrastructure; Warp: third-party vendor dependency; OpenCode: legacy system. No single vulnerability links them. Attackers hunt stored environment variables, especially AI access keys (LLMJacking). Wiz saw downstream abuse of enterprise AWS Bedrock keys stolen from a vendor breach: first use within 30 minutes, single InvokeModel from residential IP, then low-volume Go-client validation; days later boto3 script enumerated Bedrock and EC2 quotas, then floods of ~800k and ~1.7M Bedrock calls (global.* / us.* cross-region inference profiles), mostly Claude Opus; >100k USD. Attempted PutAccountDataRetention. Resellers: 'momo' at 23.106.46.239 (llm-routing.com, momo.skin, direct.465415.xyz, artex.nhhh.de ARTEX autonomous pentest console Oct 8; named by Zeabur), and xingjiabiapi.org / s3.xingjiabiapi.org at 38.246.114.118 doing key permission checks. Alleged ~371k USD crypto theft via keys stored in Railway.","published_at":"2026-10-30T00:00:00+00:00","relation":"mentions","confidence":null,"note":null},{"id":52785,"url":"https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models/","title":"Google Threat Intelligence: The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources","kind":"blog","source":"blog","publisher":null,"text":"The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources\n\nWritten by: Christopher Romano, Codi Starks, Garrett Mahoney, John Wolfram, Josh Murchie, K Singh, Mathew Potaczek, Mike Lombardi, Rik Dolfing Introduction Mandiant responded to multiple incidents in 2026 in which threat actors hijacked enterprise access to Large Language Models (LLMs), a tactic known as \"LLMJacking.\" Spanning a variety of cloud and LLM providers, these intrusions impacted organizations in North America, South America, and Asia Pacific across the financial services, retail, technology, and transportation sectors. Unlike the gradual resource consumption associated with cryptojacking, LLMJacking can generate large spikes in fraudulent cloud charges in a matter of hours. Across individual incidents, we observed fraudulent charges associated with resource consumption exceeding $100,000 USD in a single day, with cumulative charges at some organizations reaching $1 million USD before access was revoked. Figure 1: Usage chart showing LLMJacking generating a spike in API requests Analyzing the criminal ecosystem behind these frontline compromises, and building upon previous reporting on the growing underground market for LLM credentials, Google Threat Intelligence Group (GTIG) has identified a diverse set of financially motivated threat clusters operating out of multiple regions globally. As the LLMJacking ecosystem matures, we are also tracking a division of labor between threat actors establishing initial access to compromised environments and operators managing downstream monetization infrastructure, known as “LLM Mixers”. LLM Mixers function as illicit routing gateways that proxy, aggregate, and resell unauthorized LLM access to underground subscribers. In one investigation, GTIG observed two distinct operational clusters coordinating to compromise and monetize enterprise LLM infrastructure, demonstrating the sophisticated specialization emerging in this space. In this blog post, we describe the attack lifecycle observed across recent LLMJacking investigations and provide actionable detection, hardening, and remediation guidance to help organizations secure their infrastructure. Initial Access While low-level resource theft has involved the manipulation of customer support chatbots to conduct unauthorized tasks like code generation, threat actors conducting LLMJacking bypass these front-end interfaces to target backend model resources directly. Specifically, they focus on either identifying publicly exposed LLM endpoints or obtaining valid LLM application programming interface (API) keys. An example of the latter can be seen in Figure 1, where a threat actor uses an automated script to verify exposure by calling the /api/create endpoint to independently run their own models on endpoints that unsuspecting users have left publicly accessible. Leaving these services unprotected not only expands an organization's traditional attack surface, but could also introduce a significant increase in hosting costs. Figure 2: Threat Actor tests publicly exposed Ollama endpoints and attempts to register their own models Across multiple LLMJacking investigations, however, the dominant initial access vector has been exposed or stolen cloud identity tokens—including IAM credentials, Service Account keys, GitHub Personal Access Tokens (PATs), and active session tokens—which threat actors leverage to establish an initial foothold into target organizations' infrastructure. For instance, in mid-2026 UNC6993 compromised a cloud instance through a misconfigured Service Account key and used this access to grant further access to an LLM API. UNC6993 also hosted a session hijacking page masquerading as an application portal to join a group of LLM users. This page tricks users into navigating to the legitimate LLM service website, and pasting their raw JSON payload containing an active access token, which was then posted to the backend API to bypass password and multifactor authentication (MFA) controls. In another instance, one threat actor","published_at":"2026-11-02T14:00:00+00:00","relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}