LLMJacking Emerges as Thriving Cybercriminal Enterprise
Cybercriminals resell stolen cloud access to commercial LLMs, with victims charged up to $1 million in resources before access is revoked.
Cybercriminals have turned reselling cloud access to LLMs into a lucrative business model. Attackers gain initial access using exposed or stolen cloud identity tokens such as IAM credentials, service account keys, GitHub PATs, and active session tokens. This causes massive spikes in computing resources, with fraudulent charges reaching $100,000 in a day and cumulative $1 million at some organizations. The practice, called LLMjacking, provides revenue for a diverse set of financially motivated threat clusters operating globally. A report from Google Threat Intelligence Group and Mandiant details this.
- Cybercriminals resell stolen LLM cloud access
- Victims face charges up to $1 million before access revoked
- Initial access via IAM credentials, service account keys, GitHub PATs, and session tokens
- Creates resource spikes unlike gradual cryptojacking
- Report from GTIG and Mandiant
Impact: resource consumption charges up to $1 million USD
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 7c184611bdd9df51982cc5bb2d5ba649 | vest-cloud-credentials#recipe=similar-items&sourcecontentid=7c184611bdd9df51982cc5bb2d5ba649) APT41 Delivers 'Zero-Detection' Backdoor to Harvest Cloud |
| md5 | 8f99d4e59eef3c1106085563b00071e8 | t-mythos-exploit-storm#recipe=similar-items&sourcecontentid=8f99d4e59eef3c1106085563b00071e8) CSA: CISOs Should Prepare for Post-Mythos Exploit Storm b |
| md5 | dedc2d87d0611657e649f3ccd3b03e96 | rastructure-crime-bots#recipe=similar-items&sourcecontentid=dedc2d87d0611657e649f3ccd3b03e96) TeamPCP Turns Cloud Infrastructure Into Crime Bots by Jai |
| md5 | e89675326c5a58c3d1742cab0ff9c2e8 | ts-power-offensive-ops#recipe=similar-items&sourcecontentid=e89675326c5a58c3d1742cab0ff9c2e8) Attackers Seize Exposed AI Endpoints to Power Offensive O |
From the original article
8 min read at darkreading.com
Cybercriminals have turned reselling cloud access to LLMs into a lucrative business model, with some victims paying as much as $1 million in resource consumption before access was revoked.
By Elizabeth Montalbano · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.