Google’ning Mandiant va Threat Intelligence Group (GTIG) ma’lumotlariga ko‘ra, hujumchilar korporativ katta til modellari (LLM) ga kirishni o‘g‘irlab, ulkan firibgar bulut to‘lovlarini keltirib chiqarmoqda.
Google hisobotida bir kunda 100 000 dollardan ortiq to‘lov qayd etilgan. Ba’zi tashkilotlarda kirish bekor qilinmaguncha umumiy to‘lovlar 1 million dollarga yetgan.
Mandiant 2026-yilda Shimoliy Amerika, Janubiy Amerika va Osiyo-Tinch okeani mintaqalarida bir nechta hodisalarga javob bergan. Jabrlanuvchilar orasida moliyaviy xizmatlar, chakana savdo, texnologiya va transport sohalari bor.
Asta-sekin kriptojackingdan farqli o‘laroq, LLMJacking bir necha soat ichida ulkan to‘lov o‘sishlarini keltirib chiqarishi mumkin. GTIG shuningdek, dastlabki kirish aktorlari va “LLM Mixers” — o‘g‘irlangan LLM kirishini yer osti obunachilariga proksi, birlashtirish va qayta sotish bilan shug‘ullanuvchi noqonuniy shlyuzlar o‘rtasida mehnat taqsimotini kuzatmoqda.
Hujumchilar oldingi chat-botlarni chetlab o‘tib, orqa tarafdagi model resurslarini to‘g‘ridan-to‘g‘ri nishonga oladi. Ular ochiq endpointlarni, masalan Ollama serverlarini skanerlab, /api/create orqali o‘z modellarini ro‘yxatdan o‘tkazishga urinadi. Biroq asosiy vektor — ochiq yoki o‘g‘irlangan bulut identifikatsiya tokenlari, jumladan IAM ma’lumotlari, xizmat hisob kalitlari, GitHub shaxsiy kirish tokenlari va sessiya tokenlari.
UNC6993 noto‘g‘ri sozlangan xizmat hisob kaliti orqali bulut instansiyasini buzib kirgan. Shuningdek, u foydalanuvchilarni xom JSON sessiya tokenlarini joylashtirishga aldab, parollar va MFA ni chetlab o‘tadigan soxta portalni joylashtirgan.
Boshqa bir aktor ommaviy GitHub repozitoriyalaridan LLM API kalitlarini yig‘ib, ularni max_tokens=1 so‘rovlari bilan tekshirgan — bu EDR va SIEM ogohlantirishlarini oldini olish uchun qilingan. AWS inson bo‘lmagan identifikatorlari bilan LLMjacking haqidagi oldingi tadqiqotlar bu ma’lumotlarga asoslangan naqshning yangi emasligini ko‘rsatadi.
Kirishdan so‘ng, aktorlar noqonuniy IAM va xizmat hisoblarini yaratgan, hisoblash metama’lumotlariga SSH kalitlarini kiritgan va bulut maxfiy ma’lumotlar menejerlaridan sirlarni tortib olgan. Keyingi klaster LiteLLM’ning /key/regenerate endpointidagi foydalanuvchi ID qayta bog‘lash zaifligidan (CVE-2026-40217) foydalanib, virtual kalitlarni PROXY_ADMIN darajasiga ko‘targan. Bu hujumchilarning ochiq MCP xizmatlari va LiteLLM shlyuzlarini ekspluatatsiya qilish kengroq tendensiyasiga mos keladi.
UNC6993 boshqariladigan AI xizmatlarini yoqib, qo‘shimcha API kalitlarini yaratgan va tezda 100 000 dollardan ortiq to‘lov to‘plagan. U new-api va gcli2api kabi ochiq manbali vositalardan foydalanib, o‘g‘irlangan kalitlarni birlashtirgan bo‘lishi mumkin.
Boshqa bir aktor sakkiz soatdan kam vaqt ichida 500 000 dan ortiq API chaqiruvlarini amalga oshirib, jet-night.com ni quvvatlagan va jabrlanuvchiga deyarli 1 million dollar to‘lov yuklagan. Jet Night oyiga taxminan 60 dollarga “cheksiz” reja sotgan — GTIG bu narx o‘g‘irlangan kalitlarga ishora qiladi, deb hisoblaydi. PoeLLM kampaniyasi ham hujumchilarning ochiq AI infratuzilmasini foyda uchun o‘g‘irlashini ko‘rsatadi.
Google avtomatik kalit aylanishini o‘z ichiga olgan markazlashtirilgan maxfiy ma’lumotlar boshqaruv tizimini joriy etishni tavsiya qiladi. Kirish eng kam huquq tamoyiliga asoslanishi va LLM xizmatlariga zarur bo‘lmaguncha kirish rad etilishi kerak.
Shuningdek, kod repozitoriyalarini maxfiy ma’lumotlar uchun skanerlash muhim. Tashkilotlar API kvotalarini belgilashi, sarf-xarajat cheklovlarini o‘rnatishi va byudjet ogohlantirishlarini yoqishi kerak. Barcha bulut identifikatsiya provayderlari va konsollari bo‘yicha fishingga chidamli ko‘p faktorli autentifikatsiya (MFA) dan foydalanish lozim.
Himoyachilar API kalitlarini aniq model va muhitga mos ravishda cheklashi, shu bilan birga past hajmli tekshiruv so‘rovlari (masalan, max_tokens=1) uchun jurnallarni faol kuzatishi kerak. LiteLLM kabi shlyuzlarni tezda yangilash zarur. Bedrock yoki Gemini API kabi xizmatlarning ruxsatsiz faollashtirilishi jiddiy hodisa sifatida qabul qilinishi lozim.
GTIG hujumchilar LLMJackingni kriptojackingdan afzal ko‘rishini kutmoqda. LLM mikserlari ularga tez, yuqori marjali foyda beradi, korxonalar esa yuqori darajali modellar va agentga asoslangan ish oqimlarini tobora ko‘proq joriy etmoqda.
SOC’ga hodisalarni tez to‘xtatish uchun ogohlantirish kontekstini bering. 16K SOC’dan tahdid razvedkasini integratsiya qiling.
Google’s Mandiant and Threat Intelligence Group (GTIG) say attackers are hijacking enterprise access to large language models and running up huge fraudulent cloud charges.
Google’s report documents more than $100,000 in a single day. At some organizations, cumulative charges reached $1 million before they revoked access.
Mandiant responded to multiple 2026 incidents across North America, South America, and Asia Pacific. Victims included financial services, retail, technology, and transportation.
Unlike gradual cryptojacking, LLMJacking can produce massive billing spikes within hours. GTIG also tracks a division of labor between initial access actors and “LLM Mixers,” illicit gateways that proxy, pool, and resell stolen LLM access to underground subscribers.
Attackers bypass front-end chatbots and target backend model resources directly. They scan for exposed endpoints, such as Ollama servers, and try to register their own models through /api/create. The dominant vector, however, is exposed or stolen cloud identity tokens, including IAM credentials, service account keys, GitHub personal access tokens, and session tokens.
UNC6993 compromised a cloud instance through a misconfigured service account key. It also hosted a fake portal that tricked users into pasting raw JSON session tokens, bypassing passwords and MFA.
Another actor harvested LLM API keys from public GitHub repositories and validated them with max_tokens=1 requests to avoid EDR and SIEM alerts. Earlier research on LLMjacking with stolen AWS non-human identities shows this credential-driven pattern is not new.
After entry, actors created rogue IAM and service accounts, injected SSH keys into compute metadata, and pulled secrets from cloud secret managers. A follow-on cluster abused a user ID rebind flaw in LiteLLM’s /key/regenerate endpoint (CVE-2026-40217) to elevate virtual keys to PROXY_ADMIN. This matches a wider trend of attackers exploiting exposed MCP services and LiteLLM gateways.
UNC6993 enabled managed AI services and created extra API keys, quickly accumulating over $100,000 in charges. It used open-source tools such as new-api and gcli2api, likely to pool stolen keys.
Another actor made over 500,000 API calls in under eight hours to power jet-night.com, passing nearly $1 million in costs to the victim. Jet Night sold an “unlimited” plan for about $60 a month, a price GTIG says points to stolen keys. The PoeLLM campaign likewise shows attackers hijacking exposed AI infrastructure for profit.
Google recommends implementing a centralized secrets management system that includes automatic key rotation. Access should be based on the principle of least privilege, denying access to LLM services unless necessary.
It’s also essential to scan code repositories for secrets. Organizations should also set API quotas, establish spending limits, and enable budget alerts. Use phishing-resistant multi-factor authentication (MFA) across all cloud identity providers and consoles.
Defenders should scope API keys based on the specific model and environment, while actively monitoring logs for low-volume validation requests, such as those with max_tokens=1. Patch gateways like LiteLLM promptly. Any unauthorized activation of services such as Bedrock or the Gemini API should be treated as a serious event.
The GTIG anticipates that attackers will prefer LLMJacking over cryptojacking. LLM mixers offer them quick, high-margin profits, and enterprises are increasingly incorporating higher-tier models and agent-driven workflows.
Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.