Mandiant (Google) · Published 11 Nov
LLM재킹의 부상: 공격자가 보안 침해된 클라우드 및 모델 리소스로 수익을 창출하는 방법
Excerpt
로 수익을 창출하는 방법 | Google Cloud 블로그
By Google Threat Intelligence Group, Mandiant
*이 콘텐츠는 AI 번역 도구를 사용하여 번역되었습니다. 정확성을 기하기 위해 노력하고 있으나, 자동 번
역에는 오류나 누락이 포함될 수 있습니다. 정확한 정보는 영문 원본을 참고해 주시기 바랍니다.
작성자: Christopher Romano, Codi Starks, Garrett Mahoney, John Wolfram, Josh Murchie, K Singh, Mathew Potaczek, Mike Lombardi, Rik Dolfing
소개
Mandiant는 2026년에 공격자가 기업의 대규모 언어 모델(LLM) 액세스 권한을 가로챈 여러 사고에 대응한 바 있으며, 이러한 전술은 'LLM재킹(LLMJacking)'으로 알려져 있습니다. 다양한 클라우드 및 LLM 제공업 체에 걸쳐 발생한 이러한 침입은 북미, 남미, 아시아 태평양 지역의 금융 서비스, 리테일, 기술, 운송 부문 조직에 영향을 미쳤습니다.
크립토재킹과 관련된 점진적인 리소스 소비와 달리, LLM재킹은 몇 시간 만에…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Mandiant (Google) on cloud.google.com.
Mentioned in the excerpt2
More from Mandiant (Google)35
Mandiant (Google) · Web page · Published 30 Oct
ARTEX and Friends: Enter Agentic Offensive Frameworks
Written by: Aurora Blum, David Mainor, Rohit Nambiar, Omar ElAhdan, Matthew McWhirt, Will Silverstone, Bhavesh Dhake, Chris Busse Introduction Recent intrusions in which threat actors have been observed weaponizing agentic frameworks to execute…
Mandiant (Google) · Web page · Published 31 Jan
Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation
Written by: Matt Lin, Robert Wallace, John Wolfram, Dimiter Andonov, Tyler Mclellan On Jan. 12, 2024, Mandiant published a blog post detailing two high-impact zero-day vulnerabilities, CVE-2023-46805 and CVE-2024-21887, affecting Ivanti Connect Secure VPN…
Mandiant (Google) · Web page · Published 15 Oct
Investigating Ephemeral Supply Chain Tampering
Google Threat Intelligence Group (GTIG) and Mandiant investigated a software supply chain compromise campaign targeting the update infrastructure belonging to AOMEI Technology between April 2026 and July 2026. The threat actor conducted repeated, short-burst…
Mandiant (Google) · Web page · Published 15 Oct
ARMORY CASTLE Exploits BeyondTrust
Written by: Jayson Frost, Bryce Greathouse, Brian Meyer, John Palmisano, Rajesh Rajeshirke, Steve Rasch, John Wolfram Introduction On October 15, BeyondTrust disclosed a vulnerability, CVE-2026-102764, impacting BeyondTrust Remote Support (formerly Bomgar)…
On the same topics
Kaspersky · Web page · Published 11 Nov
Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand
In recent years, cyberthreats have increasingly taken a hybrid approach, combining time-tested techniques for advancing through infrastructure, modern methods of evading network filters, and automation powered by large language models. This is also the…
piyolog.hatenadiary.jp · Web page · Published 9 Nov
盗んだ情報をAIに査定させるインフォスティーラー「VOLTA」についてまとめてみた
2026年10月31日、Cisco Talosは、盗んだ情報をLLMに査定させるフェーズを持つWindows向けインフォ スティーラー「VOLTA」の解析結果を公表しました。ここでは関連する情報をまとめます。 VOLTAとは何か VOLTAは、Windows(x86-64)向けのインフォスティーラー。窃取のあとに被害者をLLMに評価させるフ ェーズが備わっている。TalosはVOLTAを「成熟したスティーラー」と評価している。バイナリから復 元された名前は「VOLTA-AUTODOXER」(出典: 1, 2)。…
Unit 42 · Web page · Published 15 Jul
TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development
We identified a previously undocumented modular internet-of-things (IoT) botnet framework named TuxBot v3 Evolution. The malware authors leveraged an LLM to assist in their code development, yielding mixed results. While the AI complied with their request to…
CrowdStrike · Web page · Added 3 Nov
VAPOR PANDA Uses AI-Driven ARTEX to Grow Global Espionage Campaign
CrowdStrike OverWatch identified a VAPOR PANDA campaign using ARTEX alongside the Chinese-developed DeepSeek large language model (LLM) and a second commercial LLM to conduct intrusions against multiple high-value targets in parallel. Beginning on October 17,…