Anthropic API Scanning Campaign - Targeting Self-Hosted LLM Infrastructure — Threadlinqs Intelligence
As of 2026-05-30, Anthropic API Scanning Campaign - Targeting Self-Hosted LLM Infrastructure is a medium-severity threat intel threat attributed to a Multiple-nexus actor, tracked by Threadlinqs Intelligence with 6 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 18 indicators of compromise.
Threat ID: TL-2026-0036 · Severity: MEDIUM · CVSS: 6.5 · Status: ACTIVE · Category: THREAT_INTEL
Attribution: Multiple · FINANCIAL
A widespread scanning and exploitation campaign targets Anthropic Claude API endpoints, AWS Bedrock, and self-hosted LLM infrastructure for credential theft and compute hijacking (LLMjacking).
The Anthropic API Scanning Campaign represents the industrialization of LLM compute theft. What began as opportunistic credential abuse has evolved into a sophisticated, multi-vector operation with dedicated tooling, monetization infrastructure, and operational security practices.
**Campaign Architecture:**
1. **Credential Acquisition**: Attackers obtain cloud credentials through multiple vectors:
- Exploiting vulnerable web applications (Laravel CVE-2021-3129 was the initial vector)
- Scanning GitHub/GitLab for leaked AWS_ACCESS_KEY_ID, ANTHROPIC_API_KEY in .env files
- SSRF attacks against cloud metadata services (169.254.169.254)
- Purchasing credential dumps from underground markets
- Phishing cloud administrators
2. **Credential Validation (keychecker)**: The kingbased/keychecker tool (GitHub) automates testing stolen credentials against 10 AI services: Anthropic, AWS Bedrock, Azure ML, GCP Vertex AI, OpenAI, ElevenLabs, Mistral, AI21 Labs, OpenRouter, and MakerSuite. For each service, it confirms:
- Whether credentials are valid
- What models are accessible
- What usage quotas exist
- Whether logging/monitoring is enabled
3. **Evasion-First Approach**: Before abusing credentials, attackers:
- Call GetModelInvocationLoggingConfiguration to check if S3/CloudWatch logging is enabled
- OAI Reverse Proxy explicitly refuses to use keys with logging enabled (for 'privacy')
- Probe with InvokeModel(max_tokens_to_sample:-1) — triggers ValidationException (confirms access) without generating usage costs
- Use the Converse/ConverseStream API (announced May 2024) which generates different CloudTrail events than InvokeModel — bypassing legacy detection rules
4. **Model Activation**: Evolved attackers now proactively enable LLM models on victim accounts:
- ListFoundationModels: Enumerate available models
- GetFoundationModelAvailability: Check which can be activated
- PutFoundationModelEntitlement: Enable foundation models
- PutUseCaseForModelAccess: Prepare models for use
This represents escalation from 'use what's available' to 'enable what you need.'
5. **Monetization (OAI Reverse Proxy)**: Stolen credentials are pooled behind the OAI Reverse Proxy (gitgud.io/khanon/oai-reverse-proxy), which:
- Aggregates multiple stolen credential sets
- Provides a unified API for buyers
- Tracks usage per key ('tookens', costs)
- Routes requests across credential pools for load balancing
- Enables resale to buyers in sanctioned countries
6. **Self-Reinforcing Cycle**: Sysdig TRT observed attackers using stolen Claude access to write improved exploitation scripts — including async Python scripts optimized for concurrent LLM abuse. The tools get better with each iteration because attackers use their stolen compute to improve them.
**Scale and Impact:**
- 85,000+ Bedrock API requests observed in single campaign
- 61,000 requests in a 3-hour window on July 11, 2024
- 10x increase in LLM request volume month-over-month (July 2024)
- 2x increase in unique attacker IPs over first half of 2024
- Cost: $46,000/day (Claude v2) to $100,000+/day (Claude 3 Opus)
- Languages in prompts: English (80%), Korean (10%), Russian, Romanian, German, Spanish, Japanese
- Content: ~95% roleplay (bypassing content policy), ~5% general abuse
**Self-Hosted LLM Targeting:**
Beyond cloud API abuse, the campaign also targets self-hosted LLM endpoints:
- Ollama servers (TCP/11434) — 175K+ exposed without authentication (see TL-2026-0012)
- vLLM, text-generation-webui, LocalAI instances exposed on public IPs
- Open-source model serving frameworks with default configurations
- Shodan/Censys scanning for LLM service fingerprints
**Connection to TL-2026-0012 (LLMjacking/Ollama):**
This threat is the Anthropic-specific and cloud-API-specific branch of the broader LLMjacking campaign documented in TL-2026-0012. TL-0012 covers the Ollama/self-hosted vector; TL-0036 covers the cloud credential theft and Anth
Weaknesses (CWE)
CWE-306, CWE-284
Target sectors: Cloud Services, Technology, AI/ML Companies, Software Development, All Organizations Using Cloud LLM Services
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 6 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 18 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
THREAT_INTEL, MEDIUM, threat intelligence, cybersecurity, T1595, T1589, T1588, T1190, T1078, T1059, T1098, T1562, T1535, T1552