Anthropic API Scanning Campaign - Targeting Self-Hosted LLM Infrastructure
Anthropic API Scanning Campaign (TL-2026-0036), also tracked as Anthropic API Scanning, is a medium-severity tracked intrusion set scored CVSS 6.5, first published 2026-02-03. It has no confirmed attribution, affects Anthropic Self-hosted Anthropic API instances, maps to 18 MITRE ATT&CK techniques (T1059, T1071, T1078), and is covered by 6 detection rules and 18 indicators of compromise.
Key facts for TL-2026-0036
- Threat ID
- TL-2026-0036
- Also known as
- Anthropic API Scanning, LLM Infrastructure Scanning, AI Endpoint Discovery
- Severity
- MEDIUM
- CVSS
- 6.5 (N/A - Scanning Activity)
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- 2026-02-03
- Last reviewed
- 2026-02-03
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- Cloud Services, Technology, AI/ML Companies, Software Development, All Organizations Using Cloud LLM Services
- Target regions
- Global
- Detection rules
- 6
- Indicators of compromise
- 18
Malware and tooling in Anthropic API Scanning Campaign
Malware and tooling: Keychecker, OAI Reverse Proxy
A widespread scanning and exploitation campaign targets Anthropic Claude API endpoints, AWS Bedrock, and self-hosted LLM infrastructure for credential theft and compute hijacking (LLMjacking). Attackers use automated tools (kingbased/keychecker) to validate stolen cloud credentials against 10 AI services (Anthropic, AWS Bedrock, Azure ML, GCP Vertex AI, OpenAI, ElevenLabs, Mistral, AI21 Labs, OpenRouter, MakerSuite), then monetize access via OAI Reverse Proxy — selling LLM compute to buyers including entities in sanctioned nations (Iran, North Korea, Russia). Sysdig TRT documented 85,000+ API requests in a single campaign with 61,000 in a 3-hour window, potential victim costs of $46,000-$100,000+/day, and attackers using stolen LLM access to write better exploitation scripts (self-reinforcing cycle). The campaign specifically targets Anthropic Claude models (v2, 3 Opus, 3 Sonnet) as the highest-value targets due to cost ($0.016-0.048/1K tokens). Initial access comes from vulnerable web applications (Laravel CVE-2021-3129), exposed cloud credentials in Git repositories, SSRF vulnerabilities, and leaked .env files. Attackers probe with InvokeModel using max_tokens_to_sample:-1 (ValidationException confirms access), check logging configs to evade detection, and have adopted the newer Converse API to bypass legacy CloudTrail monitoring.
How Anthropic API Scanning Campaign works
The Anthropic API Scanning Campaign represents the industrialization of LLM compute theft. What began as opportunistic credential abuse has evolved into a sophisticated, multi-vector operation with dedicated tooling, monetization infrastructure, and operational security practices.
**Campaign Architecture:**
1. **Credential Acquisition**: Attackers obtain cloud credentials through multiple vectors: - Exploiting vulnerable web applications (Laravel CVE-2021-3129 was the initial vector) - Scanning GitHub/GitLab for leaked AWS_ACCESS_KEY_ID, ANTHROPIC_API_KEY in .env files - SSRF attacks against cloud metadata services (169.254.169.254) - Purchasing credential dumps from underground markets - Phishing cloud administrators
2. **Credential Validation (keychecker)**: The kingbased/keychecker tool (GitHub) automates testing stolen credentials against 10 AI services: Anthropic, AWS Bedrock, Azure ML, GCP Vertex AI, OpenAI, ElevenLabs, Mistral, AI21 Labs, OpenRouter, and MakerSuite. For each service, it confirms: - Whether credentials are valid - What models are accessible - What usage quotas exist - Whether logging/monitoring is enabled
3. **Evasion-First Approach**: Before abusing credentials, attackers: - Call GetModelInvocationLoggingConfiguration to check if S3/CloudWatch logging is enabled - OAI Reverse Proxy explicitly refuses to use keys with logging enabled (for 'privacy') - Probe with InvokeModel(max_tokens_to_sample:-1) — triggers ValidationException (confirms access) without generating usage costs - Use the Converse/ConverseStream API (announced May 2024) which generates different CloudTrail events than InvokeModel — bypassing legacy detection rules
4. **Model Activation**: Evolved attackers now proactively enable LLM models on victim accounts: - ListFoundationModels: Enumerate available models - GetFoundationModelAvailability: Check which can be activated - PutFoundationModelEntitlement: Enable foundation models - PutUseCaseForModelAccess: Prepare models for use This represents escalation from 'use what's available' to 'enable what you need.'
5. **Monetization (OAI Reverse Proxy)**: Stolen credentials are pooled behind the OAI Reverse Proxy (gitgud.io/khanon/oai-reverse-proxy), which: - Aggregates multiple stolen credential sets - Provides a unified API for buyers - Tracks usage per key ('tookens', costs) - Routes requests across credential pools for load balancing - Enables resale to buyers in sanctioned countries
6. **Self-Reinforcing Cycle**: Sysdig TRT observed attackers using stolen Claude access to write improved exploitation scripts — including async Python scripts optimized for concurrent LLM abuse. The tools get better with each iteration because attackers use their stolen compute to improve them.
**Scale and Impact:** - 85,000+ Bedrock API requests observed in single campaign - 61,000 requests in a 3-hour window on July 11, 2024 - 10x increase in LLM request volume month-over-month (July 2024) - 2x increase in unique attacker IPs over first half of 2024 - Cost: $46,000/day (Claude v2) to $100,000+/day (Claude 3 Opus) - Languages in prompts: English (80%), Korean (10%), Russian, Romanian, German, Spanish, Japanese - Content: ~95% roleplay (bypassing content policy), ~5% general abuse
**Self-Hosted LLM Targeting:** Beyond cloud API abuse, the campaign also targets self-hosted LLM endpoints: - Ollama servers (TCP/11434) — 175K+ exposed without authentication (see TL-2026-0012) - vLLM, text-generation-webui, LocalAI instances exposed on public IPs - Open-source model serving frameworks with default configurations - Shodan/Censys scanning for LLM service fingerprints
**Connection to TL-2026-0012 (LLMjacking/Ollama):** This threat is the Anthropic-specific and cloud-API-specific branch of the broader LLMjacking campaign documented in TL-2026-0012. TL-0012 covers the Ollama/self-hosted vector; TL-0036 covers the cloud credential theft and Anthropic API scanning vector. Together they represent the complete LLMjacking threat landscape.
MITRE ATT&CK techniques used in TL-2026-0036
execution
T1059 Command and Scripting Interpreter
command-and-control
T1071 Application Layer Protocol; T1090 Proxy
defense-evasion
T1078 Valid Accounts; T1535 Unused/Unsupported Cloud Regions
persistence
initial-access
T1190 Exploit Public-Facing Application
impact
T1496 Resource Hijacking; T1657 Financial Theft
discovery
T1526 Cloud Service Discovery; T1538 Cloud Service Dashboard
collection
exfiltration
T1537 Transfer Data to Cloud Account
credential-access
resource-development
reconnaissance
T1589 Gather Victim Identity Information; T1595 Active Scanning
defense-impairment
Affected products and versions in Anthropic API Scanning Campaign
- Anthropic — Self-hosted Anthropic API instances
Vulnerable versions: Exposed instances without authentication
Fixed in: Properly secured instances
Remediation for Anthropic API Scanning Campaign
Immediate actions
- Audit all self-hosted LLM/AI endpoints for external exposure
- Ensure strong API key authentication is enforced
- Block inbound connections from Tor exit nodes to AI infrastructure
- Review firewall rules for ports 8000, 8080, 11434
Workarounds
- Bind AI services to localhost only if external access not needed
- Use reverse proxy with authentication for any external access
- Implement IP allowlisting for API consumers
Longer-term hardening
- Place AI infrastructure behind VPN or zero-trust access
- Implement rate limiting on all API endpoints
- Deploy API gateway with authentication and monitoring
- Regular scanning for exposed AI services
Weaknesses (CWE) in Anthropic API Scanning Campaign
CWE-306, CWE-284
Timeline of Anthropic API Scanning Campaign
- CVE-2021-3129 (Laravel Ignition RCE) disclosed — later used as initial access vector for stealing cloud credentials used in LLMjacking attacks. Allows unauthenticated RCE via Ignition debug page. Source: https://nvd.nist.gov/vuln/detail/CVE-2021-3129
- Sysdig TRT publishes discovery of LLMjacking: stolen cloud credentials used to access Anthropic Claude via AWS Bedrock. Attacker probed with InvokeModel(max_tokens_to_sample:-1), checked logging configs, used OAI Reverse Proxy for monetization. Potential cost: $46,000/day per victim. 10 AI services targeted via keychecker tool. Source: https://sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack/
- AWS announces Converse API for Bedrock. Within 30 days, attackers adopt Converse/ConverseStream to bypass legacy InvokeModel CloudTrail monitoring rules. Converse generates different CloudTrail events, requiring separate detection rules. Source: https://docs.aws.amazon.com/bedrock/latest/APIReference/API_Operations_Amazon_Bedrock_Runtime.html
- Sysdig TRT detects 61,000 Bedrock API requests in a single 3-hour window — the largest LLMjacking burst observed. Total July volume: 85,000+ requests against single credential set. 10x increase month-over-month. Attackers now enabling models via PutFoundationModelEntitlement (escalation from passive to active). Source: https://sysdig.com/blog/growing-dangers-of-llmjacking/
- Sysdig TRT publishes comprehensive LLMjacking evolution report: costs up to $100,000+/day for Claude 3 Opus, 2x unique attacker IPs, self-reinforcing cycle (attackers use stolen LLMs to write better tools), sanctions evasion motivation confirmed. Prompt content: 80% English, 10% Korean, 95% roleplay. Source: https://sysdig.com/blog/growing-dangers-of-llmjacking/
- Scanning campaign intensifies with dedicated Anthropic API endpoint discovery. Automated scanners probe internet-facing infrastructure for exposed Anthropic API keys, self-hosted LLM endpoints, and cloud metadata services. Combined with Ollama scanning (TL-0012), represents the full LLMjacking attack surface.
- As of 2026-05-29, this LLMjacking/Anthropic-API-scanning campaign remains ACTIVE and escalating: SANS ISC (Feb 2026) logged live Tor-node scanning of /anthropic/v1/models, GreyNoise saw an 80k-session enumeration burst, and Sysdig reports a 376% rise in AI credential theft into Q1 2026. With no CVE to patch and diffuse multi-operator attribution (silver.inc, OAI Reverse Proxy still active), there is no takedown or successor that closes this threat.
Sources cited for Anthropic API Scanning Campaign
- Sysdig TRT — LLMjacking: Stolen Cloud Credentials Used in New AI Attack
- Sysdig TRT — Growing Dangers of LLMjacking: Evolving Tactics
- kingbased/keychecker — Credential Validation Tool
- OAI Reverse Proxy — LLM Credential Monetization
- AWS Bedrock Pricing
- AWS Bedrock Runtime API Documentation
- CybeNari — Stolen AWS Credential Sources
- NVD — CVE-2021-3129 Laravel Ignition RCE
Threats related to Anthropic API Scanning Campaign
Detection coverage for TL-2026-0036
As of 2026-02-03, Threadlinqs Intelligence publishes 6 detection rule(s) for TL-2026-0036 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.