Threat Actors Use LLMJacking to Monetize Compromised Cloud Models
Mandiant documented LLMJacking intrusions where threat actors hijacked enterprise LLM access for fraudulent charges exceeding $1M cumulatively across multiple sectors.
75
Organization
financial services
- Mentions · 7d0
- Mentions · 30d1
- All mentions2
- First seenSep 24, 2026
- Last mentioned9d ago
Timeline
2 articles · newest firstBeyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments
Microsoft Threat Intelligence has observed Storm-2570, a ransomware affiliate linked to multiple ransomware payloads, using consistent tradecraft across deployments.
70
Appears with
- government agenciesvictim · 1
- Storm-2570ai model · 1
- Anubismalware · 1
- information technology (IT)victim · 1
- commercial facilitiesvictim · 1
- technologyorganization · 1
- healthcarevictim · 1
- BERTmalware · 1
- energyorganization · 1
- ransomware affiliateproduct · 1
- LLMproduct · 1
- government agenciesorganization · 1
- financial servicesvictim · 1
- consumer retailorganization · 1
- Ollamaproduct · 1
- transportationorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.