Anthropic API Scanning Campaign - Targeting Self-Hosted LLM Infrastructure

Key facts

Detection coverage

As of 2026-02-03, Threadlinqs Intelligence publishes 6 detection rule(s) for TL-2026-0036 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Default API Key Authentication Attempt

Detects attempts to authenticate with default or documentation API keys

• Languages: Splunk SPL, Microsoft KQL
• Data sources: web_logs, application_logs
• Severity: high
• Confidence: high

Splunk SPL

index=web sourcetype=access_combined OR sourcetype=application_logs
| where match(uri, "(?i)(/v1/|/api/|/anthropic/)")
| where match(_raw, "(?i)(x-api-key:\s*(password|test|demo|default|apikey|changeme|admin))")
| stats count values(uri) as endpoints values(src_ip) as sources by dest_ip
| where count > 0
| eval alert_severity="HIGH"
| eval alert_reason="Default API key authentication attempt - likely automated scanning or misconfiguration probe"

Microsoft KQL

// Default API Key Authentication Attempt
// Detects attempts to authenticate with default or documentation API keys
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any ("/v1/", "/api/", "/anthropic/")
// Note: In real deployment, inspect HTTP headers via web logs
| project Timestamp, DeviceName, RemoteUrl, RemoteIP
| summarize AttemptCount=count() by RemoteIP, RemoteUrl
| where AttemptCount > 5

Known false positives:

• Development/testing with intentional default keys

Tuning notes: Should never see default keys in production - alert immediately

• 🔒 Anthropic API Endpoint Scanning · unlock with TL Creds
• 🔒 Tor Exit Node Accessing AI Infrastructure · unlock with TL Creds
• 🔒 Mass API Endpoint Scanning Against AI Infrastructure · unlock with TL Creds
• 🔒 Default API Key Authentication — Credential Stuffing Against LLM APIs · unlock with TL Creds
• 🔒 Tor Exit Node Accessing AI API — Anonymous Reconnaissance · unlock with TL Creds

Indicators of compromise

As of 2026-02-03, Threadlinqs Intelligence tracks 18 indicators of compromise for TL-2026-0036.

Sample indicators (3 of 18)

• IP address: 83.7.139[.]184
• URL: hxxps://github[.]com/kingbased/keychecker
• IP address: 103.108.229[.]55

Defanged, TLP:CLEAR. Full set of 18 indicators: unlock with TL Creds.

Technical analysis

Sysdig TRT documented 85,000+ API requests in a single campaign with 61,000 in a 3-hour window, potential victim costs of $46,000-$100,000+/day, and attackers using stolen LLM access to write better exploitation scripts (self-reinforcing cycle). The campaign specifically targets Anthropic Claude models (v2, 3 Opus, 3 Sonnet) as the highest-value targets due to cost ($0.016-0.048/1K tokens). Initial access comes from vulnerable web applications (Laravel CVE-2021-3129), exposed cloud credentials in Git repositories, SSRF vulnerabilities, and leaked .env files. Attackers probe with InvokeModel using max_tokens_to_sample:-1 (ValidationException confirms access), check logging configs to evade detection, and have adopted the newer Converse API to bypass legacy CloudTrail monitoring.

The Anthropic API Scanning Campaign represents the industrialization of LLM compute theft. What began as opportunistic credential abuse has evolved into a sophisticated, multi-vector operation with dedicated tooling, monetization infrastructure, and operational security practices.

**Campaign Architecture:**

1. **Credential Acquisition**: Attackers obtain cloud credentials through multiple vectors: - Exploiting vulnerable web applications (Laravel CVE-2021-3129 was the initial vector) - Scanning GitHub/GitLab for leaked AWS_ACCESS_KEY_ID, ANTHROPIC_API_KEY in .env files - SSRF attacks against cloud metadata services (169.254.169.254) - Purchasing credential dumps from underground markets - Phishing cloud administrators

2. **Credential Validation (keychecker)**: The kingbased/keychecker tool (GitHub) automates testing stolen credentials against 10 AI services: Anthropic, AWS Bedrock, Azure ML, GCP Vertex AI, OpenAI, ElevenLabs, Mistral, AI21 Labs, OpenRouter, and MakerSuite. For each service, it confirms: - Whether credentials are valid - What models are accessible - What usage quotas exist - Whether logging/monitoring is enabled

3. **Evasion-First Approach**: Before abusing credentials, attackers: - Call GetModelInvocationLoggingConfiguration to check if S3/CloudWatch logging is enabled - OAI Reverse Proxy explicitly refuses to use keys with logging enabled (for 'privacy') - Probe with InvokeModel(max_tokens_to_sample:-1) — triggers ValidationException (confirms access) without generating usage costs - Use the Converse/ConverseStream API (announced May 2024) which generates different CloudTrail events than InvokeModel — bypassing legacy detection rules

4. **Model Activation**: Evolved attackers now proactively enable LLM models on victim accounts: - ListFoundationModels: Enumerate available models - GetFoundationModelAvailability: Check which can be activated - PutFoundationModelEntitlement: Enable foundation models - PutUseCaseForModelAccess: Prepare models for use This represents escalation from 'use what's available' to 'enable what you need.'

5. **Monetization (OAI Reverse Proxy)**: Stolen credentials are pooled behind the OAI Reverse Proxy (gitgud.io/khanon/oai-reverse-proxy), which: - Aggregates multiple stolen credential sets - Provides a unified API for buyers - Tracks usage per key ('tookens', costs) - Routes requests across credential pools for load balancing - Enables resale to buyers in sanctioned countries

6. **Self-Reinforcing Cycle**: Sysdig TRT observed attackers using stolen Claude access to write improved exploitation scripts — including async Python scripts optimized for concurrent LLM abuse. The tools get better with each iteration because attackers use their stolen compute to improve them.

**Scale and Impact:** - 85,000+ Bedrock API requests observed in single campaign - 61,000 requests in a 3-hour window on July 11, 2024 - 10x increase in LLM request volume month-over-month (July 2024) - 2x increase in unique attacker IPs over first half of 2024 - Cost: $46,000/day (Claude v2) to $100,000+/day (Claude 3 Opus) - Languages in prompts: English (80%), Korean (10%), Russian, Romanian, German, Spanish, Japanese - Content: ~95% roleplay (bypassing content policy), ~5% general abuse

**Self-Hosted LLM Targeting:** Beyond cloud API abuse, the campaign also targets self-hosted LLM endpoints: - Ollama servers (TCP/11434) — 175K+ exposed without authentication (see TL-2026-0012) - vLLM, text-generation-webui, LocalAI instances exposed on public IPs - Open-source model serving frameworks with default configurations - Shodan/Censys scanning for LLM service fingerprints

**Connection to TL-2026-0012 (LLMjacking/Ollama):** This threat is the Anthropic-specific and cloud-API-specific branch of the broader LLMjacking campaign documented in TL-2026-0012. TL-0012 covers the Ollama/self-hosted vector; TL-0036 covers the cloud credential theft and Anthropic API scanning vector. Together they represent the complete LLMjacking threat landscape.

MITRE ATT&CK techniques by tactic:

execution

T1059 Command and Scripting Interpreter

command-and-control

T1071 Application Layer Protocol; T1090 Proxy

defense-evasion

T1078 Valid Accounts; T1535 Unused/Unsupported Cloud Regions

persistence

T1098 Account Manipulation

initial-access

T1190 Exploit Public-Facing Application

impact

T1496 Resource Hijacking; T1657 Financial Theft

discovery

T1526 Cloud Service Discovery; T1538 Cloud Service Dashboard

collection

T1530 Data from Cloud Storage

exfiltration

T1537 Transfer Data to Cloud Account

credential-access

T1552 Unsecured Credentials

resource-development

T1588 Obtain Capabilities

reconnaissance

T1589 Gather Victim Identity Information; T1595 Active Scanning

defense-impairment

T1685 Disable or Modify Tools

Remediation

Immediate actions

• Audit all self-hosted LLM/AI endpoints for external exposure
• Ensure strong API key authentication is enforced
• Block inbound connections from Tor exit nodes to AI infrastructure
• Review firewall rules for ports 8000, 8080, 11434

Workarounds

• Bind AI services to localhost only if external access not needed
• Use reverse proxy with authentication for any external access
• Implement IP allowlisting for API consumers

Longer-term hardening

• Place AI infrastructure behind VPN or zero-trust access
• Implement rate limiting on all API endpoints
• Deploy API gateway with authentication and monitoring
• Regular scanning for exposed AI services

Affected and fixed versions

• Anthropic — Self-hosted Anthropic API instances
  Vulnerable versions: Exposed instances without authentication
  Fixed in: Properly secured instances

Timeline

• 2021-01-12 CVE-2021-3129 (Laravel Ignition RCE) disclosed — later used as initial access vector for stealing cloud credentials used in LLMjacking attacks. Allows unauthenticated RCE via Ignition debug page. Source: https://nvd.nist.gov/vuln/detail/CVE-2021-3129
• 2024-05-06 Sysdig TRT publishes discovery of LLMjacking: stolen cloud credentials used to access Anthropic Claude via AWS Bedrock. Attacker probed with InvokeModel(max_tokens_to_sample:-1), checked logging configs, used OAI Reverse Proxy for monetization. Potential cost: $46,000/day per victim. 10 AI services targeted via keychecker tool. Source: https://sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack/
• 2024-05-30 AWS announces Converse API for Bedrock. Within 30 days, attackers adopt Converse/ConverseStream to bypass legacy InvokeModel CloudTrail monitoring rules. Converse generates different CloudTrail events, requiring separate detection rules. Source: https://docs.aws.amazon.com/bedrock/latest/APIReference/API_Operations_Amazon_Bedrock_Runtime.html
• 2024-07-11 Sysdig TRT detects 61,000 Bedrock API requests in a single 3-hour window — the largest LLMjacking burst observed. Total July volume: 85,000+ requests against single credential set. 10x increase month-over-month. Attackers now enabling models via PutFoundationModelEntitlement (escalation from passive to active). Source: https://sysdig.com/blog/growing-dangers-of-llmjacking/
• 2024-09-18 Sysdig TRT publishes comprehensive LLMjacking evolution report: costs up to $100,000+/day for Claude 3 Opus, 2x unique attacker IPs, self-reinforcing cycle (attackers use stolen LLMs to write better tools), sanctions evasion motivation confirmed. Prompt content: 80% English, 10% Korean, 95% roleplay. Source: https://sysdig.com/blog/growing-dangers-of-llmjacking/
• 2025-06-01 Scanning campaign intensifies with dedicated Anthropic API endpoint discovery. Automated scanners probe internet-facing infrastructure for exposed Anthropic API keys, self-hosted LLM endpoints, and cloud metadata services. Combined with Ollama scanning (TL-0012), represents the full LLMjacking attack surface.
• 2026-05-29 As of 2026-05-29, this LLMjacking/Anthropic-API-scanning campaign remains ACTIVE and escalating: SANS ISC (Feb 2026) logged live Tor-node scanning of /anthropic/v1/models, GreyNoise saw an 80k-session enumeration burst, and Sysdig reports a 376% rise in AI credential theft into Q1 2026. With no CVE to patch and diffuse multi-operator attribution (silver.inc, OAI Reverse Proxy still active), there is no takedown or successor that closes this threat.

Sources cited

• NVD — CVE-2021-3129 Laravel Ignition RCE NVD (NIST) · Advisory · 2021-01-12
• AWS Bedrock Pricing aws.amazon.com · Vendor report · 2024-01-01
• AWS Bedrock Runtime API Documentation docs.aws.amazon.com · Vendor report · 2024-05-30
• Sysdig TRT — LLMjacking: Stolen Cloud Credentials Used in New AI Attack sysdig.com · Blog · 2024-05-06
• Sysdig TRT — Growing Dangers of LLMjacking: Evolving Tactics sysdig.com · Blog · 2024-09-18
• CybeNari — Stolen AWS Credential Sources cybenari.com · Blog · 2024-08-15
• kingbased/keychecker — Credential Validation Tool GitHub · Other · 2024-04-01
• OAI Reverse Proxy — LLM Credential Monetization gitgud.io · Other · 2024-01-01

Related threats

• LLMJacking: 175,000 Exposed Ollama AI Servers Targeted for Abuse
• Active Scanning for Exposed Anthropic API Endpoints

Previous and next in threat intel

• SLSH Extortion Group - Swatting and Executive Harassment Tactics Previous report
• IPIDEA Residential Proxy Botnet Disruption by Google Next report