Google LLMjacking hujumlari ba'zi korxonalarga bulut to'lovlarida 1 million dollargacha zarar yetkazayotganini ogohlantirdi

Google dushanba kuni tahdidchilar korxonalarning Katta Til Modellariga (LLM) kirishini o'g'irlab, qimmat hisoblash resurslari va sun'iy intellekt xizmatlaridan noqonuniy foydalanayotganini ogohlantirdi.

Bu taktika LLMjacking deb ataladi — LLM davriga moslashtirilgan resurs o'g'irlash shakli bo'lib, unda hujumchi fishing, manba kodining sizib chiqishi, noto'g'ri sozlangan muhitlar yoki ochiq mijoz tomonidagi kod orqali API kalitini qo'lga kiritib, tashkilotning LLM hisoblariga ruxsatsiz kirish oladi, haqiqiy egasi esa iste'mol xarajatlarini qoplaydi.

Bunday hujumlar keng geografik tarqalishga ega bo'lib, moliyaviy xizmatlar, chakana savdo, texnologiya va transport sohalarida Shimoliy Amerika, Janubiy Amerika va Osiyo-Tinch okeani mintaqalarida joylashgan tashkilotlar ta'sirlangan.

"Kriptojacking bilan bog'liq asta-sekin resurs iste'moliga qaraganda, LLMJacking bir necha soat ichida noqonuniy bulut to'lovlarida katta sakrashlarni keltirib chiqarishi mumkin", — deb aytishdi Google Threat Intelligence Group va Mandiant The Hacker News bilan bo'lishilgan hisobotda.

"Alohida hodisalar bo'yicha biz resurs iste'moli bilan bog'liq noqonuniy to'lovlar bir kunda 100 000 AQSh dollaridan oshganini, ba'zi tashkilotlarda kirish bekor qilinishidan oldin umumiy to'lovlar 1 million AQSh dollariga yetganini kuzatdik."

Spektrning bir uchida mijozlarni qo'llab-quvvatlash chatbotlarini manipulyatsiya qilish orqali kod yaratish kabi ruxsatsiz vazifalarni bajarishga qaratilgan past darajadagi resurs o'g'irlash turadi. LLMjacking esa boshqa uchida turadi, chunki ular ochiq LLM nuqtalarini aniqlash yoki haqiqiy LLM API kalitlarini qo'lga kiritish orqali orqa fon model resurslarini bevosita nishonga oladi.

Eng keng tarqalgan dastlabki kirish vektori ochiq yoki o'g'irlangan bulut identifikatsiya tokenlari, jumladan IAM ma'lumotlari, Xizmat Hisobi kalitlari, GitHub Shaxsiy Kirish Tokenlari (PAT) va faol sessiya tokenlari bo'lib, ular hujumchiga maqsadli tashkilotlar infratuzilmasiga dastlabki kirish nuqtasini o'rnatish imkonini beradi.

Bunga UNC6993 deb ataladigan tahdidchi ham kiradi, u noto'g'ri sozlangan Xizmat Hisobi kaliti orqali bulut instansiyasiga kirib, undan LLM API ga kirish olish uchun foydalangan.

"UNC6993 shuningdek, LLM foydalanuvchilari guruhiga qo'shilish uchun ilova portali niqobi ostida sessiya o'g'irlash sahifasini joylashtirgan", — dedi Google. "Bu sahifa foydalanuvchilarni haqiqiy LLM xizmati veb-saytiga o'tishga va faol kirish tokenini o'z ichiga olgan xom JSON yuklamasini joylashtirishga aldab, keyin uni orqa fon API ga yuborib, parol va ko'p omilli autentifikatsiya (MFA) nazoratlarini chetlab o'tadi."

Boshqa bir holatda, noma'lum hujumchi o'g'irlangan Shaxsiy Kirish Tokenidan foydalanib, shaxsiy kod omborlariga kirish olgan, so'ngra konteynerlangan bulut muhitida ishlaydigan paketdagi shubhali veb-ilova zaifligidan foydalanish bilan davom etgan.

Boshqa dastlabki kirish yo'llari orasida korporativ foydalanuvchilarning IAM ma'lumotlarini buzib, MFA himoyasini chetlab o'tish uchun yangi kirish kalitlarini dasturiy ravishda yaratish, shuningdek, keng loyiha ruxsatlari va GitHub ommaviy omborlaridan olingan LLM API kalitlari bilan buzilgan bulut Xizmat Hisobi kalitidan foydalanish ham bor.

Muvaffaqiyatli kirish nuqtasini qo'lga kiritgach, tahdidchilar tezda imtiyozlarni oshirish, tarmoq ichiga chuqurroq kirish, doimiy kirishni o'rnatish va maqsadlarni aniqlash hamda lateral harakat uchun qo'shimcha bulut ma'lumotlarini topish maqsadida ichki razvedka o'tkazish bilan shug'ullanadi.

Kuzatilgan ba'zi taktikalar quyidagilar:

• Nozik ma'lumotlar uchun bulut xizmatlari, kod omborlari va ma'lumotlar omborlarini tekshirish.
• Mavjud xizmatlar va identifikatsiya siyosatlarini xaritalash uchun bir nechta bulut mintaqalari bo'ylab ichki razvedka o'tkazish.
• Qattiq kodlangan sirlar, sozlash o'zgaruvchilari va ishlab chiquvchi ma'lumotlarini qidirish uchun nozik kod bazalarini klonlash.
• Ikkilamchi bulut muhitlari uchun ma'lumotlarni aniqlash maqsadida kirish jurnallarini skanerlash.
• Qo'shimcha ma'lumotlarni yig'ish uchun maqsadli ma'lumotlar bazasi so'rovlarini bajarish.
• Imtiyozlarni oshirish va doimiy kirishni saqlab qolish uchun bulut identifikatsiya ruxsatlari va virtual mashina sozlamalaridan foydalanish.
• Xizmat hisoblari bilan bog'liq token yaratish imtiyozlaridan foydalanib, yuqori imtiyozli xizmat hisoblari uchun vaqtinchalik ma'lumotlar yaratish va infratuzilma ma'lumotlari, ichki ma'lumotlar bazasi parollari va uchinchi tomon API kalitlarini bulut sir menejerlaridan o'g'irlash.
• Doimiy kirish uchun ruxsatsiz IAM va xizmat hisoblarini yaratish va hisoblash instansiyalariga SSH kalitlarini kiritish.
• Ichki hisob-kitob optimallashtirish yordamchi dasturlari niqobi ostida orqa eshik xizmat hisoblarini yaratish.
• Imtiyozlarni oshirish uchun LiteLLM dagi CVE-2026-40217 kabi LLM marshrutlash dasturiy ta'minotiga qaratilgan zaifliklardan foydalanish.

"LLMjackingning yakuniy maqsadi asosiy modellarning monetizatsiyasi va resurs o'g'irlashidir, bu esa hujumchilar token proksi qilish, avtomatlashtirilgan model oqimi va GPU apparat ta'minoti orqali erishadi", — dedi Google. "Tahdidchilar shuningdek, o'zlarining proksi nuqtalari va agentik ish yuklarini joylashtirish uchun kirishdan foydalangan."

Masalan, UNC6993 jabrlanuvchi bulut loyihalarida o'z operatsiyalarini kengaytirish uchun qo'shimcha API kalitlari yaratib, 100 000 AQSh dollaridan ortiq hisob-kitob to'lovlarini to'plagan. Ba'zi tahdidchilar tez-tez qisqa muddatli xizmat hisoblarini yaratish va o'chirish orqali "yoqish va aylantirish" strategiyasini qabul qilib, tezlik cheklovlarini chetlab o'tishga harakat qiladi.

LLMjacking ekotizimining yetuklashuvi LLM Mixers deb ataladigan yangi turdagi hujumchilar paydo bo'lishiga yo'l ochdi, bu esa dastlabki kirishni o'rnatuvchi hujumchilar va quyi oqim monetizatsiya infratuzilmasini boshqaruvchilar o'rtasidagi mehnat taqsimotini ko'rsatadi.

LLM Mixers noqonuniy marshrutlash shlyuzlari sifatida ishlaydi, ular ruxsatsiz LLM kirishini boshqa jinoiy hujumchilarga yer osti do'konlari orqali proksi qiladi, birlashtiradi va qayta sotadi. Bunday xizmatlardan biri Jet Night ("jet-night[.]com") bo'lib, u taxminan oyiga 60 dollar evaziga chegara modeliga kirish bilan cheksiz token rejasini taklif qiladi.

Noqonuniy qayta sotish bozorini kuchaytirish orqali, bu yomon niyatli shaxslarga korxona kvotalarini o'g'irlash va hisob-kitob xarajatlarini jabrlanuvchilarga yuklash imkonini beradi, bu esa buzilishlar aniqlanishidan oldin sodir bo'ladi.

Jet Night yagona token marshrutlash taklifi emas. O'tgan hafta Broadcomga tegishli Symantec va Carbon Black tomonidan chop etilgan hisobotga ko'ra, haqiqiy OpenAI Codex va Anthropic Claude Code CLI larini korxona tizimlariga o'rnatib, har bir so'rovni sotuvchilarning o'z serverlari o'rniga uchinchi tomon infratuzilmasi orqali yo'naltirish uchun qayta sozlaydigan kulrang bozor relay xizmati mavjud.

Xizmat kamida 2026-yil boshidan beri faol deb baholanadi, asosan Xitoy materikida joylashgan o'nlab tashkilotlarga, shuningdek, Janubiy Koreya, Tayvan va Malayziyada joylashgan ko'p millatli filiallarga ta'sir qiladi. Nishonga olingan sohalar orasida sanoat avtomatlashtirish, elektronika ishlab chiqarish, yarimo'tkazgichlar, farmatsevtika, yuk tashish, shina ishlab chiqarish, neft-kimyo va ma'lumotlar markazi xizmatlari bor.

"O'z mijoz dasturiy ta'minotini yaratish o'rniga, xizmat haqiqiy CLI vositalaridan foydalanadi", — dedi Symantec. "U ularni odatiy tarzda o'rnatadi, so'ngra ularning sozlamalarini o'zgartirib, Codex holatida 'danger-full-access' ga o'rnatib, qum qutisini o'chiradi va har bir so'rovni OpenAI yoki Anthropic serverlari o'rniga o'z serverlari orqali yo'naltiradi."

Xizmat asosan Anthropic va OpenAI faoliyat yuritmaydigan bozorlarga qaratilgan bo'lib, o'rnatish G'arbiy sun'iy intellekt kodlash yordamchisidan foydalanmoqchi bo'lgan xodim tomonidan ruxsatsiz qayta sotuvchiga murojaat qilish orqali amalga oshiriladi.

E'tiborga molik jihati shundaki, xizmat o'zgartirilgan yoki trojanlashtirilgan mijoz tarqatmaydi. Codex yoki Claude Code CLI npm orqali haqiqiy o'rnatilgandan so'ng, foydalanuvchilarga sozlamani bekor qilish uchun ishlatiladigan "vibe.aiok[.]me" nomli o'xshash domendan faylsiz PowerShell yoki bash sozlash skriptini olish uchun bir qatorli buyruqni bajarish ko'rsatma beriladi.

Qayta sozlash Codex uchun "~/.codex/config.toml" yoki Claude Code uchun "~/.claude/settings.json" ni nishonga oladi, CLI ning bajarish qum qutisini o'chiradi, yozish qum qutisi uchun tarmoq kirishini yoqadi, foydalanuvchining haqiqiy API ma'lumotlarini relay tomonidan berilgan tokenlar bilan almashtiradi va telemetriya hamda xato hisobotini o'chiradi.

Skript shuningdek, sozlash tugallanishidan oldin tizimning xizmat ko'rsatadigan mintaqada ishlayotganini tasdiqlash uchun Windows lokal sozlamasini tekshiradi. Xizmat operatorlari nafaqat G'arbiy sun'iy intellekt sotuvchilari tomonidan qo'yilgan mintaqaviy cheklovlarni chetlab o'tish, balki Jet Night ga o'xshash tarzda bozor narxidan pastroq narxlarda quvvatni qayta sotish bilan ham shug'ullanayotgani shubha qilinadi.

Xizmat o'z pozitsiyasidan foydalanib, xodimlar tomonidan kiritilgan so'rovlarni yig'ish yoki javoblarni soxtalashtirish yoki o'zgartirishga oid hech qanday dalil bo'lmasa-da, topilmalar bunday vositalardan foydalanish bilan bog'liq xavfsizlik xatarlarini namoyish etadi.

"Tahdidchilar an'anaviy resurs o'g'irlash, masalan kriptojackingdan ko'ra LLMjackingni tobora ustuvor deb bilishadi, bu esa paydo bo'layotgan yer osti LLM Mixers tomonidan ta'minlanadigan tez, yuqori marjinal monetizatsiya bilan bog'liq", — dedi Google.

"Korxonalar yuqori darajadagi modellar va agentik ish oqimlarini ishlab chiqarish muhitlariga integratsiya qilgan sari, kiberjinoyatchilar ochiq API tokenlarini nishonga olish va model marshrutlash o'rta dasturidagi zaifliklardan foydalanish uchun avtomatlashtirilgan razvedkani takomillashtirishlari mumkin."

Google on Monday warned that threat actors are hijacking enterprise access to Large Language Models (LLMs) to fraudulently leverage expensive computing resources and AI services.

The tactic is called LLMjacking, a form of resource hijacking adapted for the LLM era, where an attacker obtains an API key through phishing, source code leaks, misconfigured environments, or exposed client-side code to gain unauthorized access to an organization's LLM accounts, while the legitimate owner covers the consumption costs.

Such attacks have a wide geographical footprint, with impacted entities located in North America, South America, and Asia Pacific across the financial services, retail, technology, and transportation sectors.

"Unlike the gradual resource consumption associated with cryptojacking, LLMJacking can generate large spikes in fraudulent cloud charges in a matter of hours," Google Threat Intelligence Group and Mandiant said in a report shared with The Hacker News.

"Across individual incidents, we observed fraudulent charges associated with resource consumption exceeding $100,000 USD in a single day, with cumulative charges at some organizations reaching $1 million USD before access was revoked."

On one end of the spectrum are low-level resource theft that involves the manipulation of customer support chatbots to conduct unauthorized tasks like code generation. LLMjacking is on the other end, as they target the backend model resources directly by identifying publicly exposed LLM endpoints or obtaining valid LLM API keys.

The most common initial access vector has been exposed or stolen cloud identity tokens, including IAM credentials, Service Account keys, GitHub Personal Access Tokens (PATs), and active session tokens, which allow an attacker to establish an initial foothold into target organizations' infrastructure.

This includes a threat actor called UNC6993, which is said to have breached a cloud instance through a misconfigured Service Account key and used it to obtain access to an LLM API.

"UNC6993 also hosted a session hijacking page masquerading as an application portal to join a group of LLM users," Google said. "This page tricks users into navigating to the legitimate LLM service website, and pasting their raw JSON payload containing an active access token, which was then posted to the backend API to bypass password and multi-factor authentication (MFA) controls."

In another case, an unknown attacker has been observed leveraging a stolen Personal Access Token to access private code repositories, following it up with the exploitation of a suspected web application vulnerability in a package running within a containerized cloud environment.

Other initial access routes include the compromise of IAM credentials of corporate users to programmatically generate fresh access keys to bypass MFA safeguards, as well as the use of a hacked cloud Service Account key with broad project permissions and LLM API keys obtained from public GitHub repositories.

Upon successfully gaining a foothold, the threat actors waste no time escalating privileges, burrowing deeper into the network, establishing persistence, and conducting internal reconnaissance to identify targets and further cloud credentials for lateral movement.

Some of the observed tactics are listed below -

• Enumerate cloud services, code repositories, and data stores for sensitive credentials.
• Perform internal reconnaissance across multiple cloud regions to map available services and identity policies.
• Clone sensitive codebases to search for hard-coded secrets, configuration variables, and developer credentials.
• Scan access logs to identify credentials for secondary cloud environments.
• Run targeted database queries to harvest additional credentials.
• Abuse cloud identity permissions and virtual machine configurations to escalate privileges and maintain persistent access.
• Exploit token-creation privileges associated with service accounts to generate temporary credentials for high-privilege service accounts and exfiltrate infrastructure credentials, internal database passwords, and third-party API keys from cloud secret managers.
• Create unauthorized IAM and service accounts and inject SSH keys into compute instances for persistence.
• Create backdoor service accounts disguised as internal billing optimization utilities.
• Exploit vulnerabilities targeting LLM routing software, such as CVE-2026-40217 in LiteLLM, to escalate privileges.

"The ultimate objective of LLMJacking is the monetization and resource-hijacking of foundation models, which actors achieve through token proxying, automated model streaming, and GPU hardware provisioning," Google said. "Threat actors also leveraged their access to host their own proxy endpoints and agentic workloads."

UNC6993, for instance, has created additional API keys to scale their operations within victim cloud projects, racking up over $100,000 USD in billing charges. Some threat actors attempt to bypass rate limits by adopting a "burn and rotate" strategy that involves continuously creating and deleting short-lived service accounts

The maturation of the LLMjacking ecosystem has also paved the way for the emergence of a new category of actors called LLM Mixers, highlighting a division of labor between attackers who establish initial access and those who manage downstream monetization infrastructure.

LLM Mixers function as illicit routing gateways that proxy, aggregate, and resell unauthorized LLM access to other criminal actors via underground storefronts. One such service is Jet Night ("jet-night[.]com"), which offers an unlimited token plan with alleged access to a frontier model for approximately $60 per month.

By fueling an illicit resale marketplace, it permits bad actors to siphon enterprise quotas while passing the billing costs to victims before compromises are detected.

Jet Night is far from the only token routing offering. According to a report published by Broadcom-owned Symantec and Carbon Black last week, there exists a grey market relay service that installs the genuine OpenAI Codex and Anthropic Claude Code CLIs on enterprise systems, only to reconfigure them to route every request through third-party infrastructure instead of the vendors' own servers.

The service is assessed to be active since at least early 2026, primarily impacting a dozen organizations located in Mainland China, along with multi-national subsidiaries based in South Korea, Taiwan, and Malaysia. Targeted sectors include industrial automation, electronics manufacturing, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals, and data center services.

"Rather than building its own client software, the service repurposes the genuine CLI tools," Symantec said. "It installs them normally, then rewrites their configuration to switch sandboxing off, in Codex's case by setting it to 'danger-full-access,' and routes every request through its own servers instead of OpenAI's or Anthropic's."

The service appears to mainly target markets where Anthropic and OpenAI do not operate, with the installation driven by an employee attempting to try out a Western AI coding assistant by turning to an unauthorized reseller.

Notably, the service does not distribute a modified or trojanized client. Shortly after the legitimate install of the Codex or Claude Code CLI through npm, users are likely instructed to run a one-line command to fetch fileless PowerShell or bash setup script from a lookalike domain ("vibe.aiok[.]me") that's used to override the configuration.

The reconfiguration, which targets "~/.codex/config.toml" for Codex or "~/.claude/settings.json" for Claude Code, disables the CLI's execution sandbox, enables network access for the write sandbox, replaces the user's real API credentials with relay-issued tokens, and disables telemetry and error reporting.

The script also checks the Windows locale setting to confirm it's running on a system in the region it serves before the setup is completed. It's suspected that the operators behind the service are not only circumventing regional restrictions imposed by Western AI vendors, but are also reselling capacity below market rates similar to Jet Night.

Although there is no evidence to suggest that the service is abusing its position to harvest prompts entered by employees or fabricate or alter responses, the findings demonstrate the security risks associated with using such tools.

"Threat actors will increasingly prioritize LLMJacking over traditional resource theft like cryptojacking, driven by the immediate, high-margin monetization enabled by emerging underground LLM Mixers," Google said.

"As enterprises integrate higher-tier models and agentic workflows into production environments, cybercriminals will likely refine automated reconnaissance to target exposed API tokens and exploit vulnerabilities in model routing middleware."

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.