'Black October': nine AI developer platforms breached, stolen cloud and LLM keys resold and abused on AWS Bedrock

Linha do tempo

1. wiz.io ↗ · pub. 30/10/2026 19:51 · coletado 30/10 21:00 primeiro registro

   'Black October': nine AI developer platforms breached, stolen cloud and LLM keys resold and abused on AWS Bedrock

   ler a análise desta fonte ocultar

   Wiz reports that at least nine AI developer platforms disclosed security incidents in October 2026, including Railway, Lightning AI, Zeabur, Fireworks, OpenCode, Warp, Andromeda and CommandCode. Several describe an "agent swarm" attack, and OpenCode and CommandCode attribute theirs to attempted model "distillation". The attackers hunted stored environment variables, especially those granting AI access, and Wiz observed stolen enterprise AWS keys abused downstream. Two keys traced to a vendor breach were used for roughly 800k and 1.7 million Bedrock calls, likely over $100k at list price, with the traffic resembling resold coding-agent usage. Wiz links the keys to two LLM resale operations, momo and Xingjiabi, but cannot tie them directly to the original breaches.

   Technical Details

   • Root causes (self-reported): Fireworks, Zeabur and Lightning cite credential access. Railway cites "privilege escalation in our build infrastructure". Warp points to a third-party vendor dependency, and OpenCode to a "legacy system". Lightning was earlier hit by the Mini-Shai Hulud supply chain campaign. Zeabur published a full write-up and will shut down.
   • Impact: Social media reports allege ~$371,000 in crypto theft using keys stored in Railway, and consumer bills of hundreds to thousands of dollars from stolen OpenCode access.
   • Case A and B timeline: The first unauthorized activity came within 30 minutes of the vendor-side credential access. It was a single InvokeModel from a residential IP, sweeping stolen keys across organizations. Low-volume validation from a small Go client followed, then a rotating-proxy catalog probe, then boto3 enumeration of Bedrock and EC2 quotas.
   • Case A: About 800k Bedrock calls over 30 hours, ~90% successful, routed through global.* cross-region inference profiles. About three quarters of successful calls went to Opus models.
   • Case B: The key was restricted to us.* profiles. After failed attempts from a reseller pool, the same boto3 script (identical version string) from a Level 3 address made ~1.7M calls over 13 hours, with over a million successful. Nearly all the rest were throttled by regional quotas.
   • Usage profile: Heavy prompt caching and a long tail of large uncached inputs, consistent with resold coding-agent traffic.
   • momo: Operates from 23.106.46.239, which hosts the LLM resale site llm-routing.com (USDT payments) and an "ARTEX" autonomous pentest console page (Oct 8). Zeabur publicly named this IP as targeting its infrastructure (Oct 12-14). In late October it checked the Case A and B keys and attempted PutAccountDataRetention with the Case B key.
   • Xingjiabi: 38.246.114.118 (xingjiabiapi.org) enumerated and permission-checked both keys after high-volume abuse had already begun. The site also hosted a "distillation detection" scoring page. This suggests an active resale market for the keys.
   • Wiz has no evidence directly linking these IPs to the Black October breaches.

   Remediation

   • Rotate credentials and environment variables stored on affected platforms, and prioritize AI/LLM access keys and cloud keys.
   • Restrict Bedrock IAM policies to the needed cross-region inference profiles and regions, and monitor for anomalous InvokeModel and quota enumeration calls.
   • Hunt for the listed IPs and domains in cloud logs.