Mandiant Details LLMJacking Attacks Monetizing Compromised Cloud LLM Access
Summary
Mandiant and GTIG describe 2026 intrusions in which actors abused stolen cloud credentials or exposed LLM services to resell access and generate costly model usage. Their findings detail attack methods and provide detection and mitigation guidance.
Key points
- Mandiant investigated multiple 2026 intrusions affecting organizations across several regions and industries; fraudulent usage charges exceeded $100,000 in a day in some cases, with cumulative charges reaching $1 million at some organizations.
- Initial access commonly involved exposed or stolen cloud identity tokens, service account keys, personal access tokens, session tokens, or LLM API keys; actors also targeted publicly exposed model endpoints.
- Investigated actors escalated privileges and maintained access using cloud permissions, unauthorized IAM and service accounts, and injected SSH keys.
- In one case, an actor exploited a LiteLLM user ID rebind vulnerability, CVE-2026-40217, to elevate Virtual Keys to proxy administrator credentials.
- GTIG observed LLM Mixers proxying and reselling unauthorized access. One actor used stolen third-party API keys to power Jet Night; the service passed nearly $1 million in token costs to a victim, according to the report.
- Defenders are advised to monitor cloud audit logs and account or service changes, watch for anomalous low-volume API requests, enforce least privilege and key rotation, set usage limits and budgets, and patch model gateways.
Article Details
- Attack Vectors
- Threat actors gained initial access through publicly exposed LLM endpoints, exposed or stolen cloud identity tokens, IAM credentials, Service Account keys, GitHub Personal Access Tokens, active session tokens, and exposed LLM API keys.
- UNC6993 reportedly compromised a cloud instance using a misconfigured Service Account key and hosted a session-hijacking page that collected active access tokens.
- A threat actor combined a stolen Personal Access Token for private code repositories with exploitation of a suspected web application vulnerability in a package running in a containerized cloud environment.
- An actor exploited a user ID rebind vulnerability in LiteLLM's /key/regenerate endpoint (CVE-2026-40217) to elevate Virtual Keys to PROXY_ADMIN credentials.
- Actors enumerated cloud services, repositories, data stores, and access logs to find credentials, and queried cloud data warehouse metadata for credentials and sensitive information.
- Actors created unauthorized IAM or service accounts, generated additional access keys, attached administrative policies to service roles, and injected SSH keys into compute instances.
- Actors abused compromised LLM access to generate API calls and charges, provision GPU instances, and operate proxy infrastructure that routed or resold unauthorized model access.
- Defensive Notes
- Use centralized secrets management and automate detection, rotation, and removal of exposed keys and secrets from code repositories.
- Apply least privilege to users and service accounts, including explicit restrictions on access to cloud LLM services; enforce phishing-resistant MFA.
- Audit cloud configurations and restrict public exposure of LLM endpoints. Apply outbound network allow listing, API quotas, spending caps, and rate limits.
- Monitor for unauthorized changes to LLM services and accounts, anomalous low-volume validation requests such as max_tokens=1, and unusual spikes in model invocations, throttling errors, or resource usage.
- Enable and monitor native cloud audit and data-access logs, including events that create credentials or accounts, invoke models, enumerate resources, or modify logging settings.
- Patch model gateways such as LiteLLM promptly, scan application code and containerized workloads for vulnerabilities, and restrict model pulls to vetted repositories.
- Use isolated sandboxes for workloads that execute generated code or database queries, and continuously identify unauthorized or unmonitored models, tools, and infrastructure.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | jet-night[.]com | LLM Mixer domain used for a token-routing service that GTIG said was powered by stolen third-party API keys. |
| DOMAIN | newapi[.]pro | Domain for the illicit resale ecosystem that the article says received access routed through custom relay infrastructure. |
MITRE ATT&CK
T1056.003 · Web Portal CaptureUNC6993 hosted a session-hijacking page that prompted users to paste an active access token into a web form.T1078.004 · Cloud AccountsActors used compromised cloud accounts, including IAM credentials and Service Account keys, to access victim environments.T1098.001 · Additional Cloud CredentialsActors generated additional cloud access keys and temporary credentials for privileged service accounts.T1098.003 · Additional Cloud RolesAn actor attached administrative policies to service roles to escalate privileges.T1098.004 · SSH Authorized KeysActors injected unauthorized SSH public keys into compute-instance configuration or metadata.T1136.003 · Cloud AccountActors created unauthorized IAM and service accounts, including accounts with administrative rights.T1190 · Exploit Public-Facing ApplicationA threat actor reportedly exploited a suspected web application vulnerability in a package running in a containerized cloud environment; another actor exploited LiteLLM's CVE-2026-40217.T1496.001 · Compute HijackingActors hijacked cloud model and GPU resources for high-volume inference and monetization.T1526 · Cloud Service DiscoveryActors enumerated cloud services and identity policies to identify resources and additional credentials.T1528 · Steal Application Access TokenA session-hijacking page collected users' active access tokens; actors also used stolen cloud identity tokens.T1530 · Data from Cloud StorageThe article reports cloud object-storage operations associated with targeted data theft.T1552.001 · Credentials In FilesActors searched cloned code repositories for hardcoded secrets and harvested exposed API keys from public GitHub repositories.T1555.006 · Cloud Secrets Management StoresAn actor obtained infrastructure credentials, database passwords, and third-party API keys from cloud secret managers.T1580 · Cloud Infrastructure DiscoveryOne actor conducted reconnaissance across cloud regions to map available services and identity policies.T1610 · Deploy ContainerA threat actor deployed a containerized backdoor using the Manus agent framework into a compromised cloud environment.
CVE
Threat Actors
Vendors
Amazon Web ServicesAWS Account Key CreationGooglecompromises, and building upon previous reporting on the growing underground market for LLM credentials, Google Threat Intelligence Group (GTIG) has identified a diverse set of financially motivated threat clustersMicrosoftAzure: Monitor Azure Activity Logs (Control Plane) and Diagnostic Logs (Data Plane) for events associated with the Microsoft.CognitiveServices namespace.
Products
Amazon BedrockBedrock, Gemini API, etc.). Once enabled, the threat actor can use the APIs to generate massive bills to the organization in just minutes or hours.Gemini APIBedrock, Gemini API, etc.). Once enabled, the threat actor can use the APIs to generate massive bills to the organization in just minutes or hours.Google Security OperationsGoogle Security Operations customers have access to these broad category rules and more under the Cloud Threats, Mandiant Frontline Threats, Mandiant Hunting Rules rule packs.LiteLLMIn one case, after acquiring pre-validated Virtual Keys from the threat actor that established initial access, a follow-on cluster executed targeted application logic exploitation against the victim's LiteLLM gateway.OllamaFigure 2: Threat Actor tests publicly exposed Ollama endpoints and attempts to register their own models
Tools
agent-infra/sandboxthrough instructions and execute resulting commands locally, supported by SearXNG metasearch and agent-infra/sandbox execution environments.ai-relayA threat actor deployed custom proxy relay infrastructure (ai-relay) hosted on deceptive lookalike domains.gcli2apiFor example, UNC6993 used open-source tools such as new-api (a centralized model hub and gateway) and gcli2api (an API proxy tool converting command line interface (CLI) tools into standard frontier model endpoints),ManusThe actor deployed a containerized backdoor using the Manus agent framework to the compromised cloud environment, which queried an upstream LLM to reason through instructions and execute resulting commands locally,new-apiFor example, UNC6993 used open-source tools such as new-api (a centralized model hub and gateway) and gcli2api (an API proxy tool converting command line interface (CLI) tools into standard frontier model endpoints),SearXNGan upstream LLM to reason through instructions and execute resulting commands locally, supported by SearXNG metasearch and agent-infra/sandbox execution environments.
Industries
Financial Servicesintrusions impacted organizations in North America, South America, and Asia Pacific across the financial services, retail, technology, and transportation sectors.Retailimpacted organizations in North America, South America, and Asia Pacific across the financial services, retail, technology, and transportation sectors.Technologyorganizations in North America, South America, and Asia Pacific across the financial services, retail, technology, and transportation sectors.TransportationNorth America, South America, and Asia Pacific across the financial services, retail, technology, and transportation sectors.