LLMjacking campaigns by UNC6993 and others drain $100K+ per day in fraudulent LLM token charges from victim cloud accounts
Google Mandiant and Google Threat Intelligence Group (GTIG) report that criminals are hijacking corporate LLM and cloud AI access ("LLMJacking"), generating fraudulent charges that can exceed $100,000 per day. Cumulative charges at some victims reached $1 million before access was revoked. The activity has grown steadily over two years, and Google expects actors to prioritize it over cryptojacking. The cluster tracked as UNC6993 is cited in a mid-2026 incident that cost a victim $100,000. GTIG also describes a division of labor between initial-access brokers and downstream monetization operators called "LLM Mixers".
Detalhes técnicos
- UNC6993 compromised a cloud instance via a misconfigured Service Account key, then gained access to a model API. It generated additional API keys and enabled services within the victim's cloud projects.
- The actor also ran a fake application-portal page that tricked users into pasting a raw JSON payload containing an active access token. The token was posted to a backend API, bypassing password and MFA controls.
- A separate actor subscribed victim accounts to Pay-As-You-Go agreements, selected premium foundation models and ran high-volume inference. It used a "burn and rotate" strategy, creating and deleting short-lived service accounts to bypass rate limits while monitoring the billing interface.
- Another intruder made more than 500,000 LLM API calls in under eight hours with stolen third-party API keys to power the token routing service Jet Night. Jet Night sells an unlimited plan for about $60 per month, well below market rates (typically $100-$250), which GTIG believes is only profitable with stolen keys. Its public Telegram channel admitted outages, likely caused by victims revoking keys.
- CrowdStrike's August report documented a token thief sending about 200,000 API requests in two minutes.
Remediação
- Prioritize identity and access management and supply chain security.
- Use a centralized secrets management platform and rotate keys and secrets.
- Apply least-privilege permissions to users and service accounts.
- Automate secrets scanning in codebases to find and remove API keys committed to source code.
Linha do tempo
-
LLMjacking campaigns by UNC6993 and others drain $100K+ per day in fraudulent LLM token charges from victim cloud accounts
ler a análise desta fonte ocultar
Google Mandiant and Google Threat Intelligence Group (GTIG) report that criminals are hijacking corporate LLM and cloud AI access ("LLMJacking"), generating fraudulent charges that can exceed $100,000 per day. Cumulative charges at some victims reached $1 million before access was revoked. The activity has grown steadily over two years, and Google expects actors to prioritize it over cryptojacking. The cluster tracked as UNC6993 is cited in a mid-2026 incident that cost a victim $100,000. GTIG also describes a division of labor between initial-access brokers and downstream monetization operators called "LLM Mixers".
Technical Details
- UNC6993 compromised a cloud instance via a misconfigured Service Account key, then gained access to a model API. It generated additional API keys and enabled services within the victim's cloud projects.
- The actor also ran a fake application-portal page that tricked users into pasting a raw JSON payload containing an active access token. The token was posted to a backend API, bypassing password and MFA controls.
- A separate actor subscribed victim accounts to Pay-As-You-Go agreements, selected premium foundation models and ran high-volume inference. It used a "burn and rotate" strategy, creating and deleting short-lived service accounts to bypass rate limits while monitoring the billing interface.
- Another intruder made more than 500,000 LLM API calls in under eight hours with stolen third-party API keys to power the token routing service Jet Night. Jet Night sells an unlimited plan for about $60 per month, well below market rates (typically $100-$250), which GTIG believes is only profitable with stolen keys. Its public Telegram channel admitted outages, likely caused by victims revoking keys.
- CrowdStrike's August report documented a token thief sending about 200,000 API requests in two minutes.
Remediation
- Prioritize identity and access management and supply chain security.
- Use a centralized secrets management platform and rotate keys and secrets.
- Apply least-privilege permissions to users and service accounts.
- Automate secrets scanning in codebases to find and remove API keys committed to source code.