UNC6993

Reported Context (4)

Google reported that UNC6993 breached a cloud instance through a misconfigured Service Account key, accessed an LLM API, hosted a session-hijacking page to collect access tokens, and created additional API keys in victim cloud projects. Google Warns LLMjacking Can Drive Enterprise Cloud Charges to $1 Million
Google researchers reported that this tracked threat cluster compromised a cloud instance through a misconfigured service account key, used it to gain further access to an LLM API, and hosted a session-hijacking page targeting LLM users. Criminals Resell Stolen Enterprise LLM Access Through Underground Services
Google identified this threat cluster, which appears to use gateway tools to aggregate stolen keys and distribute requests, and likely sells access via underground forums. LLMjacking Attacks Drive Cloud AI Charges Above $1 Million, Google Says
The article reports that UNC6993 compromised a cloud instance using a misconfigured Service Account key, hosted a session-hijacking page, and attempted to generate additional API keys and enable services in victim cloud projects. Mandiant Details LLMJacking Attacks Monetizing Compromised Cloud LLM Access

CVE (1)

People (1)

MITRE ATT&CK (18)

Vendors (5)

Products (7)

Tools (6)

Industries (12)

Countries (4)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.