---
id: "CMP-202611-eqkfyp"
kind: "campaign"
aliases: []
title: "LLMjacking crews (UNC6993, Jet Night) use stolen cloud keys and tokens to run up AWS Bedrock, Gemini and Azure OpenAI bills of $100K+/day and resell the access (Google GTIG)"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "AWS Bedrock", "fixed": []}, {"name": "Google Vertex AI / Gemini API", "fixed": []}, {"name": "Azure OpenAI / Azure AI Services", "fixed": []}, {"name": "LiteLLM", "fixed": []}, {"name": "Ollama", "fixed": []}, {"name": "AWS IAM", "fixed": []}, {"name": "Google Cloud IAM", "fixed": []}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-03T13:16:56+00:00"
updated_at: "2026-11-03T13:16:56+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-03T13:16:56+00:00"}]
---

# LLMjacking crews (UNC6993, Jet Night) use stolen cloud keys and tokens to run up AWS Bedrock, Gemini and Azure OpenAI bills of $100K+/day and resell the access (Google GTIG)

Google Threat Intelligence (2 Nov 2026) reports multiple LLMjacking intrusions during 2026 in North America, South America and Asia Pacific. Attackers get in with leaked GitHub PATs, AWS IAM credentials, misconfigured GCP service account keys, federation tokens, exposed Ollama endpoints, or the LiteLLM /key/regenerate flaw (CVE-2026-40217). They then turn on LLM services that were often never enabled, create new API keys, and resell the model quota through 'LLM mixer' relays (jet-night.com, newapi.pro, the new-api and gcli2api tooling). UNC6993 used a fake portal to harvest access-token JSON, which gets around passwords and MFA, and ran up more than $100,000 in charges. Jet Night made 500,000+ API calls in under 8 hours, costing one victim about $1M. Some actors also use burn-and-rotate service accounts and inject SSH keys for persistence. Victims are not named.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :AWS Bedrock affected ? fixed ?
- :Google Vertex AI / Gemini API affected ? fixed ?
- :Azure OpenAI / Azure AI Services affected ? fixed ?
- :LiteLLM affected ? fixed ?
- :Ollama affected ? fixed ?
- :AWS IAM affected ? fixed ?
- :Google Cloud IAM affected ? fixed ?

## How to check

In cloud audit logs, look for LLM services being enabled when you never used them: GCP EnableService for aiplatform.googleapis.com; AWS PutUseCaseForModelAccess or CreateFoundationModelAgreement; Azure Microsoft.CognitiveServices/accounts/deployments/write. Look for bursts of InvokeModel, Converse or GenerateContent calls, low-volume max_tokens=1 validation sweeps, ListFoundationModels or ListPublisherModels enumeration, and changes or deletion of model invocation logging or diagnostic settings. Watch for unexpected user agents (claude-cli, aws-sdk-rust, aws-sdk-go-v2) and new service accounts, API keys or SSH keys. Look for traffic to jet-night.com or newapi.pro. Check for sudden spikes in AI spend. GTIG has not published IPs or hashes; the full IOC set is in its GTI collection.

## Fix

Rotate any leaked GitHub PATs, IAM keys and service account keys, and scan your repos for secrets. Deny LLM service permissions to identities that do not need them, and alert when an LLM service is enabled. Scope AI API keys by model and environment, and set quotas and spending caps. Turn on data-access and inference audit logging (GCP inference logs are off by default; Azure needs diagnostic logs). Patch LiteLLM for CVE-2026-40217 and do not expose Ollama to the internet. Enforce phishing-resistant MFA and short token and session lifetimes.

## Timeline

- 2026-11-03T13:16:56+00:00 analyst

## Documents

- [describes] @campuscodi.risky.biz: Google warns that threat actors who compromise cloud-based AI infrastructure in  https://bsky.app/profile/campuscodi.risky.biz/post/3mzfvkfusc22l
- [describes] LLMjacking: monetizing compromised cloud models (Google GTIG) https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models
- [mentions] “Black October” for AI Developer Platforms (Wiz Research) https://www.wiz.io/blog/black-october-for-ai-developer-platforms
- [mentions] Google Threat Intelligence: The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models/

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_