Loading story…
Darktrace reported that attackers compromised a publicly exposed AWS EC2 instance running LiteLLM as an AI gateway to Amazon Bedrock and used it to deploy the XMRig cryptominer. Investigators observed internet-exposed SSH on port 22, repeated short inbound connection attempts, an HTTP download from 185.62.1.8 consistent with malware delivery, and outbound HTTPS traffic to the Monero mining pool pool.hasvault.pro. The host, identified as LiteLLM-Proxy, was later shut down, and Darktrace assessed brute-force or other SSH-based access as a plausible initial intrusion path.
The incident drew attention because the compromised system was not just a compute node but an AI gateway with an instance profile tied to Bedrock resources, potentially exposing API access, IAM permissions, prompts, logs, model outputs, and downstream application workflows. Darktrace warned that such gateways can concentrate access to foundation models, proprietary data, and broader cloud resources, making them attractive targets for credential theft, abuse of AI inference services, persistence in AWS, and lateral movement. The firm recommended limiting IAM privileges, removing internet exposure from management interfaces, using short-lived credentials, segmenting AI infrastructure, and monitoring AI-specific administrative activity.
Map this exposure pattern across your cloud, code, and identities.
4 events from the most recent confirmed update back to the earliest known activity.
The compromised EC2 instance was later taken offline following the cryptomining activity. The shutdown ended activity on the exposed AI gateway connected to Amazon Bedrock.
After the compromise, the attacker downloaded and installed XMRig from 185.62.1.8 and the host made repeated outbound HTTPS connections to the mining pool pool.hasvault.pro. Darktrace classified the activity as a high-priority cryptocurrency mining incident.
Darktrace investigated an incident in which a publicly exposed AWS EC2 instance running LiteLLM and connected to Amazon Bedrock was compromised. The attacker likely gained access via SSH brute-force attempts against port 22, though Darktrace could not confirm a successful login.
The day after the EC2 cryptomining incident, Darktrace observed unusual AWS CLI activity from a Vietnam-based IP address, failed Amazon Bedrock-related commands, and an attempted CreateUser action. Darktrace said it could not conclusively link this IAM activity to the compromised instance, but noted it suggested possible credential misuse or persistence attempts.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
5 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcehackread.com
Open sourcedarkreading.com
Open sourcedarktrace.com
Open sourcedocs.litellm.ai
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
FortiGuard Labs documented an **LLMjacking** intrusion in which attackers used a leaked, long-lived AWS IAM access key with `AdministratorAccess` to create a new IAM user, subscribe to premium foundation models through AWS Marketplace, and run inference charges against the victim organization. The financial exposure can be substantial: abuse of Claude 2.x may exceed **$46,000 per day**, while Claude 3 Opus usage may exceed **$100,000 per day**. The actors may create Amazon Bedrock service-specific API keys to conceal the activity and resell stolen model access through low-cost chatbot subscriptions promoted on Telegram and Discord. Because requests are made with valid AWS credentials, the abuse can resemble legitimate usage; organizations should eliminate long-lived privileged access keys in favor of short-lived assumed-role credentials, enable organization-wide CloudTrail and Bedrock invocation logging, and investigate new Bedrock activity alongside identity, IP, enumeration, and access-denied anomalies.
Sep 3, 2026
Attackers are increasingly monetizing stolen cloud credentials through **LLMjacking**: unauthorized use of hosted large-language-model services that charges inference costs to victims. In observed AWS incidents, attackers used long-lived IAM keys with `AdministratorAccess` to create IAM users, accept Amazon Bedrock Marketplace agreements, and invoke foundation models; earlier activity used credentials exposed through a vulnerable Laravel instance affected by `CVE-2021-3129` to test access across multiple AI platforms and target Anthropic Claude through Bedrock. Adversaries have used malformed `InvokeModel` requests to validate access and checked whether invocation logging was enabled, while sustained abuse of Claude quotas across regions was estimated to cost more than $46,000 per day and exhaust legitimate customer capacity. The activity has developed into a commercial access market. Researchers report that “Operation Bizarre Bazaar” scans for exposed, unauthenticated APIs and Model Context Protocol (MCP) servers using internet-search services, validates compromised access, and resells LLM compute or API access through Telegram and Discord marketplaces for cryptocurrency and PayPal. MCP compromise may also enable access to connected internal file systems or databases, extending the risk beyond fraudulent AI consumption. Organizations should eliminate long-lived privileged keys, use short-lived role credentials and least-privilege permissions, remediate exposed services and secret leaks, and investigate new Bedrock activity—especially identity creation, unfamiliar source IPs, service enumeration, access-denied events, and missing or disabled CloudTrail and model-invocation logs.
Sep 13, 2026
Sysdig reported observing an offensive operation against an **AWS** environment in which a threat actor progressed from initial access to **administrative privileges in under 10 minutes**, with multiple indicators suggesting **large language models (LLMs)** were used to accelerate reconnaissance, code generation, and decision-making. Initial access was obtained via **valid credentials exposed in public S3 buckets**, reportedly associated with AI/RAG-related data and an IAM user used to automate *Amazon Bedrock* tasks via *AWS Lambda*. The actor then escalated privileges via **Lambda function code injection**, moved laterally across **19 AWS principals**, and abused *Amazon Bedrock* in an **LLMjacking** pattern while also provisioning **GPU-capable compute instances** for suspected model-related activity. Dark Reading’s coverage echoed Sysdig’s findings, emphasizing the speed of the compromise, the role of AI as a force multiplier, and post-compromise activity including **data collection/exfiltration** and **GPU instance provisioning**. In contrast, TechTarget’s “must-have security technologies” piece and SecuritySenses’ discussion of borrowing financial risk models for security are **general guidance/trend** articles and do not describe this specific intrusion or provide incident-specific technical details, making them non-contributory to the reported AWS compromise.
Jun 29, 2026