Mandiant links UNC6993 to costly enterprise LLM hijacking

Mandiant’s threat intelligence on enterprise LLMJacking reveals a multi‑jurisdictional campaign in 2026 where attackers hijack corporate AI access by stealing cloud credentials and API keys to run unauthorised model queries or resell access via illicit gateways. The intruders first obtained exposed service account keys, GitHub tokens and other credentials, then tested keys with minimal single‑token requests to evade volumetric alarms.

One highlighted route leverages a user ID rebind vulnerability in the LiteLLM gateway tracked as CVE-2026-40217, which investigators say can convert standard virtual keys into full administrative credentials. Other probing targeted exposed Ollama endpoints to register custom models on public ports, with Google Threat Intelligence Group noting that LLMJacking can provoke large, rapid spikes in fraudulently billed cloud consumption, unlike gradual cryptojacking.

Victims span financial services, retail, technology and transportation sectors across North America, South America and the Asia Pacific. At peak, attack traffic reached about 1,100 requests per second, with individual incidents driving fraudulent cloud bills well above £100,000 in a single day and cumulative charges surpassing £1 million before credentials were revoked.

The operation feeds an underground ecosystem, including “LLM Mixers” that proxy and resell unauthorised LLM access, and groups such as UNC6993—tracked with moderate‑to‑high attribution confidence—tacing misconfigured service accounts and credential‑theft portals. In response, the report urges strict spending quotas, monitoring of API telemetry for single‑token validation surges, repository scanning for exposed keys, patching privilege escalation flaws, and budget alerts to catch unauthorised model usage early.