Compromised AWS AI Gateway Used for Cryptomining, Darktrace Reports
Summary
Darktrace investigated an AWS EC2 instance supporting a LiteLLM gateway that communicated with cryptomining infrastructure. Public SSH exposure was a plausible access path, while separate suspicious IAM activity could not be definitively linked to the compromise.
Key points
- On June 12, 2026, Darktrace observed cryptomining activity on an EC2 instance named LiteLLM-Proxy, which appeared to have access to Amazon Bedrock resources.
- The instance had SSH port 22 open to all IP addresses and received many external connection attempts, but telemetry did not confirm successful SSH access.
- The host downloaded data associated with XMRig from an external endpoint, then repeatedly connected to a suspected mining pool over HTTPS.
- Darktrace detected and escalated the activity through its monitoring and managed threat detection services; the instance was subsequently shut down.
- On June 13, Darktrace observed unusual AWS CLI activity from an IAM user, including failed Bedrock commands and an attempted user creation.
- Darktrace could not establish a definitive link between the IAM activity and the compromised gateway, or confirm the initial access method.
- The case highlights the security risks of AI gateways that centralize cloud permissions, model access, and application workflows.
Article Details
- Attack Vectors
- The LiteLLM-Proxy EC2 instance was exposed to the internet over SSH with port 22 open to 0.0.0.0/0. Darktrace observed many inbound connection attempts, predominantly from 145.241.123[.]102, suggesting brute-force activity; successful authentication was not confirmed.
- The instance downloaded 3.42 MB over HTTP from 185.62.1[.]8, which appeared to host a ZIP file containing XMRig. The article could not confirm how the miner was executed or whether SSH activity enabled the download.
- The instance subsequently made repeated HTTPS connections to pool.hasvault[.]pro, consistent with communication to cryptomining infrastructure.
- A separate IAM user made unusual AWS CLI requests, including failed InvokeModel and ListFoundationModels commands and an attempted CreateUser command. These may indicate credential misuse or attempted persistence, but a link to the EC2 incident was not established.
- Defensive Notes
- Treat AI gateways and their associated cloud identities, permissions, model access, and connected systems as part of the wider cloud attack surface.
- Avoid exposing SSH broadly; investigate inbound connection attempts alongside subsequent workload activity.
- Correlate workload telemetry with cloud control-plane and identity telemetry, including unusual AWS CLI activity and use of long-term access keys.
- Use behavioral context such as destination, connection volume, and deviations from normal activity to identify suspicious encrypted traffic.
- Darktrace detected and escalated the activity through Enhanced Monitoring and Managed Threat Detection; the customer shut down the host.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | pool[.]hasvault[.]pro | Mining-pool hostname contacted repeatedly by the compromised instance. |
| IPV4 | 14[.]176[.]1[.]47 | Source IP for suspicious IAM-user activity, including an unusual GetSendQuota request; the article does not establish a link to the EC2 compromise. |
| IPV4 | 145[.]241[.]123[.]102 | Predominant external source of inbound SSH connection attempts suggesting brute-force activity. |
| IPV4 | 185[.]62[.]1[.]8 | External endpoint from which the compromised instance downloaded a ZIP file that appeared to contain XMRig. |
| SHA256 | 85de36ff66fae9f4b059cbedf6d36e017ebc26c828f99f911a96e78636f21200 | Hash of the file associated with the referenced XMRig malware sample. |
MITRE ATT&CK
T1059 · Command and Scripting InterpreterThe article maps the activity to Command and Scripting Interpreter but does not provide specific evidence of the interpreter or execution method.T1078 · Valid AccountsThe article maps the suspicious IAM activity to Valid Accounts; possible credential misuse is discussed, but compromise was not confirmed.T1133 · External Remote ServicesThe article maps the incident to External Remote Services; the instance was exposed to inbound SSH, though successful access was not confirmed.T1136 · Create AccountThe article maps the attempted CreateUser command to Create Account; the request may have been an attempt to establish persistence.T1496 · Resource HijackingThe compromised EC2 instance was used for unauthorized cryptomining and compute-resource abuse.T1526 · Cloud Service DiscoveryThe article maps the failed ListFoundationModels request to Cloud Service Discovery.
People
Angel Arribas LopezAssociate Principal Cyber Analyst credited in the article.Emma FoulgerGlobal Threat Ops credited in the article.Mark TurnerSecurity Researcher credited in the article.Nathaniel JonesField CISO/VP Threat Research credited in the article.Ryan TraillContent Manager credited as editor.
Malware
Vendors
AmazonThis blog examines how Darktrace investigated a compromised AI gateway connected to Amazon Bedrock services that was subsequently observed communicating with cryptomining infrastructure. Based on its configuration andDarktraceThis blog examines how Darktrace investigated a compromised AI gateway connected to Amazon Bedrock services that was subsequently observed communicating with cryptomining infrastructure. Based on its configuration and
Products
Amazon BedrockThis blog examines how Darktrace investigated a compromised AI gateway connected to Amazon Bedrock services that was subsequently observed communicating with cryptomining infrastructure. Based on its configuration andAWSJune 12, 2026, Darktrace observed activity consistent with active cryptomining from an Amazon Web Service (AWS) EC2 instance named LiteLLM-Proxy. The instance appeared to support LiteLLM activity and was associatedAWS EC2Cyber AI Analystwas escalated to the customer by Darktrace’s SOC. The activity was also summarized by Darktrace’s Cyber AI Analyst, which grouped the relevant events into a single investigation narrative, helping to identify theEnhanced Monitoringbefore subsequently being shut down. Darktrace detected and escalated the activity through its Enhanced Monitoring and Managed Threat Detection services.LiteLLMcloud infrastructure, identity, and AI services. Recent research has highlighted how AI gateways such as LiteLLM can become attractive targets due to their ability to centralize credentials, model access, and cloudManaged Threat Detectionshut down. Darktrace detected and escalated the activity through its Enhanced Monitoring and Managed Threat Detection services.