Criminals Resell Stolen Enterprise LLM Access Through Underground Services
Summary
Google Threat Intelligence Group and Mandiant report that criminals resell stolen enterprise LLM access through underground “LLM mixers,” with victim charges topping $100,000 in a day and reaching $1 million before access was revoked.
Key points
- The report describes LLMjacking as a criminal business in which underground LLM mixers route customers’ requests through victims’ compromised enterprise accounts.
- Attackers commonly gain access through exposed LLM endpoints or exposed or stolen cloud identity tokens, including IAM credentials, service account keys, GitHub personal access tokens, and session tokens.
- Researchers observed attackers making minimal API requests to validate stolen credentials while avoiding conspicuous resource use.
- In one case, the UNC6993 cluster used a misconfigured service account key to gain access and a session-hijacking page to capture active access tokens.
- Other reported methods included a stolen personal access token combined with a suspected web application vulnerability, and compromised cloud federation tokens used to generate access keys.
- GTIG and Mandiant reported fraudulent usage charges exceeding $100,000 in a day in individual incidents and reaching $1 million at some organizations before access was revoked.
- Recommended defenses include centralized secrets management, least privilege, automated secret scanning, configuration audits, rate limiting, budget alerts, network allow listing, and MFA.
Article Details
- Event Type
- Cybercriminals are stealing cloud access to commercial large language models and reselling it through underground LLM Mixer services.
- Impact
- Victims can incur more than $100,000 in fraudulent resource-consumption charges in a single day, with cumulative charges at some organizations reaching $1 million before access is revoked. Stolen credentials and tokens can also enable unauthorized access to enterprise infrastructure and LLM APIs.
MITRE ATT&CK
T1078.004 · Cloud AccountsThe article describes attackers using stolen or exposed cloud identity tokens, service account keys, and active session tokens to access target organizations' infrastructure and LLM APIs.T1098.001 · Additional Cloud CredentialsGoogle researchers reported that an attacker used compromised cloud federation tokens to generate new access keys, enabling continued access while bypassing MFA protections.