UNC6993

UNC6993 is a financially motivated threat cluster associated with LLMjacking, the unauthorized use of enterprise large language model resources at victims’ expense. In activity investigated during 2026, the group compromised a cloud instance using a misconfigured service account key and leveraged that foothold to access an LLM API. It also generated additional API keys and enabled associated services within victim cloud projects, accumulating more than $100,000 in unauthorized billing charges. UNC6993 operated a fraudulent application portal masquerading as an enrollment page for an LLM user group. The portal persuaded users to submit session data containing active access tokens from a legitimate service. The group reused those tokens against a backend API, accessing resources without completing fresh password or multifactor authentication checks. Its operations combine cloud credential abuse, deceptive portals, session hijacking, and unauthorized consumption of paid AI services. Its country of origin and specific geographic or industry targeting are not established.