Actor Profile

The LLMjacking campaign involves unknown threat actors, including a tracked cluster designated UNC6993, who hijack enterprise access to Large Language Models (LLMs) to fraudulently consume expensive cloud computing resources and AI services. These actors obtain unauthorized access through stolen API keys, cloud identity tokens, and misconfigured environments. The campaign demonstrates sophisticated cloud exploitation capabilities and operates across a wide geographical footprint spanning North America, South America, and Asia Pacific. A new category of actors called "LLM Mixers" has emerged within this ecosystem, functioning as illicit routing gateways that aggregate and resell unauthorized LLM access via underground storefronts such as Jet Night, creating a division of labor between initial access operators and monetization infrastructure managers.

TTPs (Tactics, Techniques, Procedures)

Initial access is achieved through multiple vectors: exploitation of exposed or stolen cloud identity tokens (IAM credentials, Service Account keys, GitHub Personal Access Tokens, active session tokens), phishing, source code leaks from public repositories, misconfigured cloud environments, and exposed client-side code. UNC6993 employed session hijacking via a fake application portal masquerading as an LLM service login to capture JSON payloads containing active access tokens, bypassing password and MFA controls. Post-compromise activities include privilege escalation via abuse of cloud identity permissions and token-creation privileges, exploitation of CVE-2026-40217 in LiteLLM routing software, persistence through creation of unauthorized IAM/service accounts and SSH key injection into compute instances, credential harvesting from cloud secret managers and code repositories, internal reconnaissance across multiple cloud regions, and lateral movement using exfiltrated credentials. Threat actors employ "burn and rotate" strategies to bypass rate limits by continuously creating and deleting short-lived service accounts. The ultimate objective is resource hijacking through token proxying, automated model streaming, GPU hardware provisioning, and hosting proxy endpoints for resale via LLM Mixer infrastructure.

Targets & Patterns

The campaign targets organizations across technology, cloud services, artificial intelligence, financial services, retail, and transportation sectors with a global reach spanning North America, South America, and Asia Pacific regions. Victims are selected based on their access to expensive LLM and cloud computing resources, particularly enterprises with large-scale AI/ML infrastructure and foundation model deployments. The targeting pattern suggests actors prioritize organizations with high-value cloud environments where unauthorized resource consumption can generate substantial fraudulent charges—individual incidents have exceeded $100,000 USD in a single day, with cumulative charges reaching $1 million USD at some organizations before detection. The focus on enterprises with exposed API keys, misconfigured cloud environments, and publicly accessible code repositories indicates opportunistic targeting based on security posture vulnerabilities rather than specific vertical sector preferences.

Historical Context

LLMjacking represents an evolution of traditional cryptojacking attacks, adapted for the LLM and generative AI era. Unlike cryptojacking's gradual resource consumption, LLMjacking generates large spikes in fraudulent cloud charges within hours rather than over extended periods. The emergence of LLM Mixers as specialized monetization intermediaries mirrors the maturation seen in other cybercrime ecosystems, demonstrating a division of labor between initial access brokers and downstream monetization operators. This campaign reflects the broader trend of threat actors adapting traditional cloud resource hijacking techniques to exploit the high computational costs associated with frontier AI models and enterprise LLM deployments. The tracking of UNC6993 as a distinct cluster suggests this is part of an ongoing, organized effort rather than isolated opportunistic attacks.

Defensive Recommendations

  • Implement strict API key management with rotation policies, expiration dates, and monitoring for unusual consumption patterns or geographic anomalies in LLM API usage
  • Enforce MFA on all cloud IAM accounts and monitor for programmatic access key generation that may indicate credential compromise attempts to bypass MFA
  • Scan public code repositories (GitHub, GitLab) for exposed secrets including Service Account keys, PATs, and API tokens using automated secret detection tools
  • Monitor cloud billing for sudden spikes in compute or AI service charges, establishing baseline usage patterns and alerting on anomalies exceeding $10K daily increases
  • Patch CVE-2026-40217 in LiteLLM routing software and audit permissions for service account token creation privileges to prevent privilege escalation
  • Implement network segmentation and restrict lateral movement by limiting service account permissions to least-privilege access across cloud regions
  • Deploy detection rules for unauthorized IAM/service account creation, SSH key injection into compute instances, and access to cloud secret managers from unusual sources