Loading threat actor…
momo is a threat actor associated with a public large language model resale operation advertising discounted access to frontier models and accepting USDT payments. Its associated infrastructure has supported LLM resale services since 2025, with related services advertising ChatGPT seat redemption and account-pool management in 2026. In October 2026, momo-associated infrastructure checked stolen enterprise credentials involved in two Amazon Bedrock abuse cases and attempted the PutAccountDataRetention API operation with one compromised key. The same infrastructure was identified targeting the AI developer platform Zeabur earlier that month and hosted an autonomous penetration-testing console. These observations establish access to compromised credentials but do not establish momo's responsibility for their original theft or the subsequent high-volume Bedrock abuse. No country of origin, state affiliation, or named subgroup has been established.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
4 indicators attributed to this actor. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.