Platform-as-a-Service (PaaS) provayderi Railway chorshanba kuni mijozlar muhit o'zgaruvchilarini saqlaydigan tizimlar bilan bog'liq "anomaliy faoliyat" haqida xabar berdi.
Qo'shimcha tekshiruv natijasida kompaniya ruxsatsiz uchinchi tomon shifrlangan muhit o'zgaruvchilariga kirgan bo'lishi mumkinligini va ba'zi hollarda shifrlangan mazmunni olganligini aniqladi. Ta'sir, aytilishicha, "mijozlar kichik qismiga" cheklangan, garchi aniq raqam e'lon qilinmagan.
Muhit o'zgaruvchilari — bu API kalitlari, ma'lumotlar bazasi hisob ma'lumotlari yoki funksiyalar bayroqlari kabi maxfiy ma'lumotlarni saqlash uchun ishlatiladigan foydalanuvchi tomonidan belgilangan kalit-qiymat juftliklari. Ular operatsion tizim yoki konteyner muhit darajasida sozlanadi, dastur manba kodiga to'g'ridan-to'g'ri yozilmaydi.
Railway bu hodisa platforma kompaniyalarini nishonga olgan va yakuniy maqsadi sun'iy intellekt (SI) xulosa provayderlarini buzish bo'lgan hujumlar seriyasining bir qismi bo'lishi mumkinligini aytdi. Kompaniya shuningdek, yuqori oqim provayderlarini kalitlarni proaktiv ravishda bekor qilish uchun xabardor qilganini, ularning suiiste'mol qilinishining oldini olish maqsadida aytdi.
Mijozlarga ehtiyot chorasi sifatida quyidagi harakatlarni amalga oshirish tavsiya etilmoqda:
- Railway'da saqlanadigan muhit o'zgaruvchilarini, shu jumladan har qanday API kalitlari va shaxsiy registr hisob ma'lumotlarini aylantirish.
- Ushbu xizmatlar jurnallarini g'ayrioddiy faoliyat uchun tekshirish.
Xavfsizlik tadqiqotchisi Taylor Monahan (@tayvano_) ma'lumotiga ko'ra, hodisa hujumchilarga (0xd9773325282874d18cb83f1fe50f14c39750b2ee) Railway'da saqlangan shaxsiy kalitlari bo'lgan kriptovalyuta hamyonlarini bo'shatishga ham imkon bergan. Birinchi ma'lum kriptovalyuta o'g'irligi tranzaksiyasi soat 19:36 da sodir bo'lgan, bu hodisa rasman e'lon qilinishidan kamida ikki soat oldin.
Railway hodisaga javoban barcha Railway chelak hisob ma'lumotlarini aylantirgan va Railway API tokenlarini bekor qilgan. Shuningdek, Pro va Enterprise ish joylari uchun qurilishlarni tiklagan, bu mijozlarga Railway'da qo'shilgan yangi hisob ma'lumotlarini qo'llash imkonini beradi.
"Qurilishlar Pro va Enterprise ish joylari uchun mavjud," deb aytdi u. "Biz Hobby, keyin Free va Trial uchun qurilishlarni yoqish ustida ishlashni davom ettirmoqdamiz. Ba'zi qurilishlar hali ham odatdagidan tez-tez muvaffaqiyatsiz bo'lmoqda va ko'plab joylashtirishlar odatdagidan uzoqroq kutish vaqtlari bilan navbatda qolmoqda. Biz ikkala masala ustida ishlashni davom ettirmoqdamiz."
Bu rivojlanish tahdid ishtirokchilari nafaqat hujum hayot siklining turli bosqichlariga SI ni tobora ko'proq kiritayotgani, balki bulut qurbon muhitlariga ruxsatsiz kirib, Katta Til Modellarini (LLM) ishga tushirish uchun ham foydalanayotgani bilan bog'liq. Bu yondashuv LLMjacking deb ataladi.
Wiz tomonidan shu hafta boshida hujjatlashtirilgan bir holatda, tahdid ishtirokchilari imtiyozli Google Cloud Platform (GCP) hisob ma'lumotlarini buzgan va tashqi, hujumchi nazoratidagi GCP loyihalarini qurbonning ichki hisob-kitob hisoblariga bog'lagan.
Hujum Google Qidiruvdagi homiylik e'lonlarini dastlabki kirish vektori sifatida ishlatgan, "google cloud" yoki "gap" kabi umumiy atamalarni qidirayotgan foydalanuvchilarni Google Sites yo'naltirishi orqali soxta Google kirish veb-sahifasiga aldab, ularning hisob ma'lumotlari va ko'p omilli autentifikatsiya (MFA) kodlarini o'g'irlash jarayonida.
Qurbonning GCP muhitiga kirgach, tahdid ishtirokchisi buzilgan hisobning ortiqcha imtiyozlaridan foydalanib, kirishni chuqurlashtirgan, xavfsizlik nazoratlarini aylanib o'tgan va tashqi hujumchi nazoratidagi Gmail hisoblarini to'g'ridan-to'g'ri tashkilotning hisob-kitob hisobiga qo'shgan.
"SI ish yuklari tashqi loyihalarda qayta ishlangani sababli, so'rov mazmunlari va model natijalari qurbon tashkilotdan butunlay yashirin qolgan, bu ommaviy SI foydalanish tabiatini noma'lum qoldirgan," deb aytdi Wiz tadqiqotchilari Shira Ayal va Andre Maccarone.
Bu resurs suiiste'mol holatlari alohida emas. Symantec Threat Hunter Team ma'lumotiga ko'ra, hujumchilar ochiq LLM nuqtalarini nishonga olib, internetni skanerlash, zaifliklardan foydalanish, hisob ma'lumotlarini o'g'irlash va kriptovalyuta qazish qobiliyatiga ega avtonom kiberjinoyat operatsiyasini quvvatlantirmoqda, bu inson aralashuvisiz 100 000 qadamgacha davom etishi mumkin.
Faoliyat hujumkor SI agenti tomonidan quvvatlanadi, u "Skynet rejimi"da ishlaydi, nishonlarni skanerlash va zararlantirish, shuningdek tahdid ishtirokchilariga o'z hujumlarini amalga oshirish imkonini beradi. Ekspluatatsiyalar Microsoft Visual Studio Code, Django, Jupyter, Laravel, Supabase, Next.js va Flask/Werkzeug joylashtirishlarini nishonga oladi.
Yakuniy maqsad — bepul xulosa. Hujumchilar shunchaki SI dan zararli mazmun yaratish uchun foydalanish o'rniga, zararli SI agenti buzilgan SI modellaridan hujumlarni rejalashtirish va yo'naltirish uchun foydalanadi, hisoblash xarajatini qonuniy egasiga yuklaydi va o'z shaxsini yashiradi.
Boshqacha aytganda, g'oya shunday zararli agentni yaratishdan iboratki, u qonuniy SI tizimini buzib, uni "hech qachon rad etmasligi kerak bo'lgan sodiq hamroh" va beixtiyor kiberjinoyat vositasiga aylantiradi.
"Olingan ko'rsatmalar internet bo'ylab skanerlash, bir nechta umumiy veb ramkalarni ekspluatatsiya qilish, ma'lumotlar bazasini o'g'irlash, hisob ma'lumotlari va sirlarni yig'ish va kriptovalyuta qazish qobiliyatiga ega yagona agentni belgilagan," deb aytdi Symantec Threat Hunter Team The Hacker News bilan bo'lishilgan hisobotda.
"Bu faoliyat LLMjacking shakli bo'lib, unda hujumchilar birovning SI modeliga kirishni o'g'irlab, qurbon hisoblash quvvatini to'laydi."
Symantec Threat Hunter Team'dagi asosiy razvedka tahlilchisi Dick O'Brien The Hacker News'ga aytishicha, kuzatilgan faoliyat va Railway hodisasi o'rtasida bog'liqlik yo'q va honeypot ma'lumotlarida bunday aloqani ko'rsatadigan hech narsa yo'q.
"Shuni aytish kerakki, ikkalasi umumiy ipga ega. SI modellari uchun API kalitlari qimmatli, chunki ularga ega bo'lgan har kim model egasi hisobidan xulosa ishga tushirishi mumkin va bizning honeypotimiz model nuqtalariga qarshi o'g'irlangan kalitlar sepilishini ko'p qayd etgan," dedi O'Brien. "Platformaning saqlangan muhit o'zgaruvchilaridan olingan kalitlar xuddi shunday ishlatilishi mumkin, garchi Railway ularning suiiste'mol qilinganligini aytmagan."
Yangilanish
Railway Hobby, Free va Trial ish joylari, shuningdek Pro va Enterprise versiyalari uchun qurilishlarni taqdim etgan. "Yangi ro'yxatdan o'tishlar mavjud mijozlarga e'tibor qaratishimiz bilan vaqtincha to'xtatilgan," deb aytdi Railway. "Biz ta'sirlangan mijozlarga xabarnoma elektron pochta xabarlarini yuborishni davom ettirmoqdamiz."
Distillatsiya Hujumlari Uchun Nishonga Olingan
Yangi yangilanishda Railway 2026-yil 20-oktabr, soat 19:53 UTC da o'z infratuzilmasini buzish maqsadida "barqaror va maqsadli kampaniya" haqida xabardor bo'lganini aytdi, bu distillatsiya hujumlarini amalga oshirish maqsadida.
"Dastlabki tekshiruvlar bu hujum distillatsiya hujumlarini amalga oshirish uchun SI provayderi API kalitlarini olishga urinayotganini ko'rsatadi," deb aytdi kompaniya. "Dastlabki dalillar zararli ishtirokchining abliterated modellarga va katta hisoblash resurslariga kirishi borligini ko'rsatadi, bu ularga infratuzilmamizga qarshi yuqori darajada murakkab ekspluatatsiyalarni amalga oshirish imkonini bergan."
Hodisa "barcha ish joylarining ko'pi bilan 1,85%" bilan bog'liq muhit o'zgaruvchilarini potentsial ravishda buzgan deb baholanmoqda, bu taxminan 100 000 ish joyiga teng. Railway aniq ta'sirga uchragan mijozlarga murojaat qilmoqda va "yuqori xavf" ostida bo'lishi mumkin bo'lganlarga proaktiv ravishda murojaat qilmoqda.
Hujumchi platformada yuqori qiymatli nishonlarni qidirayotgani asosida ikki xavf toifasi aniqlangan:
- Juda ko'p sonli muhit o'zgaruvchilariga ega ish joylari
- Sotuvchilardan yuqori miqdorda SI kalitlari bo'lgan muhitlar
Railway shuningdek, 2026-yil 21-oktabr, soat 09:25 UTC da ularga kirilganini bilib olgach, GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Stripe va boshqalar bilan potentsial ravishda buzilgan kalitlarni bekor qilish uchun proaktiv ishlaganini aytdi.
Ehtiyot chorasi sifatida, barcha foydalanuvchilarga 2026-yil 21-oktabrdan oldin Railway'da saqlangan maxfiy muhit o'zgaruvchilarini bekor qilish va qayta qo'llash tavsiya etiladi. Railway shuningdek, barcha foydalanuvchilarga quyidagilarni tavsiya qiladi:
- Ma'lumotlar bazalariga ommaviy tarmoq kirishini olib tashlash.
- Har qanday maxfiy o'zgaruvchilar va kalitlarni aylantirish.
- GitHub hisob audit jurnallarini tekshirish va barcha ilova kirishini ko'rib chiqish.
- Docker Hub kabi registrlar ichidagi audit jurnallarini tekshirish.
"Biz platforma va korporativ xavfsizlik holatini takomillashtirishni davom ettirmoqdamiz, hujum vektorlarini yumshatish uchun barcha oqilona choralarni ko'rmoqdamiz," deb qo'shdi u. "Biz mijozlarimiz xavfsizligini himoya qilishda ehtiyotkorlik bilan boshqa yumshatish choralarini ham amalga oshirdik, ularni hozirda oshkor qilmaslikni tanladik."
Platform-as-a-Service (PaaS) provider Railway on Wednesday disclosed "anomalous activity" related to systems that store customer environment variables.
Upon further investigation, the company found that an unauthorized third party may have gained access to encrypted environment variables, and, in some cases, obtained the decrypted contents. The impact, it said, is limited to a "subset of users," although it did not disclose an exact number.
Environment variables refer to user-defined key-value pairs that are used to store sensitive data like API keys, database credentials, or feature flags. They are configured at the operating system or container environment level instead of hard-coding the values directly into a program's source code.
Railway said the incident is likely part of a series of attacks designed to target platform companies with the ultimate goal of compromising artificial intelligence (AI) inference providers. The company also said it has notified upstream providers to proactively revoke the keys so as to prevent their abuse.
Customers are being urged to take the following actions as a precautionary measure -
- Rotate environment variables, including any API keys, stored in Railway, as well as private registry credentials.
- Review logs for those services for unusual activity
According to security researcher Taylor Monahan (@tayvano_), the incident has also allowed the attackers (0xd9773325282874d18cb83f1fe50f14c39750b2ee) to drain cryptocurrency wallets whose private keys were stored on Railway. The first known cryptocurrency theft transaction is said to have occurred at 7:36 p.m., at least two hours before the incident was officially disclosed.
Railway has since rotated all Railway bucket credentials and invalidated Railway API tokens in response to the incident. It has also restored builds for Pro and Enterprise workspaces, allowing customers to apply new credentials added in Railway.
"Builds remain available for Pro and Enterprise workspaces," it said. "We are continuing to work on enabling builds for Hobby, then Free and Trial. Some builds are still failing more often than usual, and many deployments remain queued with longer than usual wait times. We are continuing to work on both."
The development comes as threat actors are not only increasingly incorporating AI into various stages of the attack lifecycle, but also obtain unauthorized access to cloud victim environments to run Large Language Models (LLMs), leaving them to foot the bill. This approach is called LLMjacking.
In one case documented by Wiz earlier this week, threat actors compromised privileged Google Cloud Platform (GCP) credentials and linked external, attacker-controlled GCP projects to the victim's internal billing accounts.
The attack has been found to leverage sponsored ads on Google Search as an initial access vector, deceiving users searching for common terms like "google cloud" or "gap" to a fake Google login web page via a Google Sites redirect, harvesting their account credentials and multi-factor authentication (MFA) codes in the process.
Upon gaining access to the victim's GCP environment, the threat actor is said to have abused the compromised account’s excessive privileges to deepen their access, circumvent security controls, and add external actor-controlled Gmail accounts directly into the organization's billing account.
"Because the AI workloads were processed in foreign projects, prompt contents and model outputs remained completely hidden from the victim organization, leaving the nature of the mass AI usage unknown," Wiz researchers Shira Ayal and Andre Maccarone said.
These resource abuse cases are not isolated. According to the Symantec Threat Hunter Team, attackers are targeting exposed LLM endpoints to power an autonomous cybercrime operation capable of scanning the internet, exploiting vulnerabilities, stealing credentials, and mining cryptocurrency without human intervention for up to 100,000 steps.
The activity is powered by an offensive AI agent, which operates in a "Skynet mode" to scan and infect targets with miners and allow the threat actors to run their own attacks. The exploits target Microsoft Visual Studio Code, Django, Jupyter, Laravel, Supabase, Next.js, and Flask/Werkzeug deployments.
The end goal is free inference. Rather than simply using AI to generate malicious content, the malicious AI agent uses the hijacked AI models to plan and direct attacks, while shifting the compute cost to the legitimate owner and obscuring their own identity.
Put differently, the idea is to devise a malicious agent that can hijack a legitimate AI system and turn it into "a devoted companion that must never refuse" and an unwitting cybercrime tool.
"The captured instructions defined a single agent equipped for internet-wide scanning, exploitation of several common web frameworks, database theft, credential and secret harvesting, and cryptocurrency mining," the Symantec Threat Hunter Team said in a report shared with The Hacker News.
"The activity is a form of LLMjacking, where attackers steal access to someone else's AI model so that the victim pays for the computing power."
Dick O'Brien, principal intelligence analyst at the Symantec Threat Hunter Team, told The Hacker News that there is no evidence that the activity it observed and the Railway incident are linked, and that there is nothing in the honeypot data that points to such a connection.
"Having said that, the two share a common thread. API keys for AI models are valuable because anyone holding one can run inference at the owner's expense, and our honeypot recorded a lot of stolen-key spraying against model endpoints," O'Brien said. "Keys taken from a platform's stored environment variables could be used in the same way, although Railway hasn't said whether any have been abused."
Update
Railway has made available builds for Hobby, Free, and Trial workspaces, along with Pro and Enterprise versions. "New signups remain temporarily paused while we focus on existing customers," Railway said. "We are continuing to send notification emails to impacted customers."
Targeted for Distillation Attacks
In a new update, Railway said it became aware of a "sustained and targeted campaign" to breach its infrastructure on October 20, 2026, at 7:53 p.m. UTC with an aim to conduct distillation attacks.
"Early investigations tell us this attack was attempting to obtain AI provider API keys to perform distillation attacks," the company said. "Initial evidence leads us to believe that the malicious actor had access to abliterated models and substantial compute resources which enabled them to perform highly sophisticated exploits against our infrastructure."
The incident is assessed to have potentially compromised environment variables associated with "at most 1.85% of all workspaces," which translates to about 100,000 workspaces. Railway said it's reaching out to customers with a definite impact, and proactively contacting those who may be at "high risk."
Two categories of risk have been identified based on the fact that the attacker was likely seeking high value targets on the platform -
- Workspaces with a very large number of environment variables
- Environments with a high amount of AI keys from vendors
Railway also said it proactively worked with GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Stripe, and others to revoke the potentially compromised keys upon learning they were accessed on October 21, 2026, at 9:25 a.m. UTC.
As a precautionary measure, all users are recommended to revoke and reapply sensitive environment variables stored on Railway prior to October 21, 2026. Railway is also advising all users to -
- Remove public network access to databases.
- Rotate any sensitive variables and keys.
- Check GitHub account audit logs and review all app access.
- Check audit logs within registries such as Docker Hub
"We continue to refine our platform and corporate security posture, taking all reasonable steps to mitigate attack vectors," it added. "We performed other mitigations that we are choosing to not disclose at this time out of an abundance of caution in protecting the safety of our customers."
Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.