# Anthropic API Scanning Campaign - Targeting Self-Hosted LLM Infrastructure

> A widespread scanning and exploitation campaign targets Anthropic Claude API endpoints, AWS Bedrock, and self-hosted LLM infrastructure for credential theft and compute hijacking (LLMjacking). Attackers use automated tools (kingbased/keychecker) to validate stolen cloud credentials against 10 AI services (Anthropic, AWS Bedrock, Azure ML, GCP Vertex AI, OpenAI, ElevenLabs, Mistral, AI21 Labs, OpenRouter, MakerSuite), then monetize access via OAI Reverse Proxy — selling LLM compute to buyers including entities in sanctioned nations (Iran, North Korea, Russia). Sysdig TRT documented 85,000+ API requests in a single campaign with 61,000 in a 3-hour window, potential victim costs of $46,000-$100,000+/day, and attackers using stolen LLM access to write better exploitation scripts (self-reinforcing cycle). The campaign specifically targets Anthropic Claude models (v2, 3 Opus, 3 Sonnet) as the highest-value targets due to cost ($0.016-0.048/1K tokens). Initial access comes from vulnerable web applications (Laravel CVE-2021-3129), exposed cloud credentials in Git repositories, SSRF vulnerabilities, and leaked .env files. Attackers probe with InvokeModel using max_tokens_to_sample:-1 (ValidationException confirms access), check logging configs to evade detection, and have adopted the newer Converse API to bypass legacy CloudTrail monitoring.

- **Published:** 2026-02-03T01:10:00Z
- **Last reviewed:** 2026-02-03T01:10:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0036
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-anthropic-api-llmjacking-scan-tl-2026-0036.webp?v=8c5a80cd (Threadlinqs threat intel: Anthropic Claude LLMjacking via Keychecker: Detection & IOCs (TL-2026-0036) — Medium severity, 18 IOCs, 6 detection rules.)
- **ID:** TL-2026-0036
- **Severity:** MEDIUM (CVSS 6.5)
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 6 (1 shown free below) · **IOCs:** 18 (3 shown free below)
- **CVEs:** CVE-2021-3129

## Description

The Anthropic API Scanning Campaign represents the industrialization of LLM compute theft. What began as opportunistic credential abuse has evolved into a sophisticated, multi-vector operation with dedicated tooling, monetization infrastructure, and operational security practices.

**Campaign Architecture:**

1. **Credential Acquisition**: Attackers obtain cloud credentials through multiple vectors:
   - Exploiting vulnerable web applications (Laravel CVE-2021-3129 was the initial vector)
   - Scanning GitHub/GitLab for leaked AWS_ACCESS_KEY_ID, ANTHROPIC_API_KEY in .env files
   - SSRF attacks against cloud metadata services (169.254.169.254)
   - Purchasing credential dumps from underground markets
   - Phishing cloud administrators

2. **Credential Validation (keychecker)**: The kingbased/keychecker tool (GitHub) automates testing stolen credentials against 10 AI services: Anthropic, AWS Bedrock, Azure ML, GCP Vertex AI, OpenAI, ElevenLabs, Mistral, AI21 Labs, OpenRouter, and MakerSuite. For each service, it confirms:
   - Whether credentials are valid
   - What models are accessible
   - What usage quotas exist
   - Whether logging/monitoring is enabled

3. **Evasion-First Approach**: Before abusing credentials, attackers:
   - Call GetModelInvocationLoggingConfiguration to check if S3/CloudWatch logging is enabled
   - OAI Reverse Proxy explicitly refuses to use keys with logging enabled (for 'privacy')
   - Probe with InvokeModel(max_tokens_to_sample:-1) — triggers ValidationException (confirms access) without generating usage costs
   - Use the Converse/ConverseStream API (announced May 2024) which generates different CloudTrail events than InvokeModel — bypassing legacy detection rules

4. **Model Activation**: Evolved attackers now proactively enable LLM models on victim accounts:
   - ListFoundationModels: Enumerate available models
   - GetFoundationModelAvailability: Check which can be activated
   - PutFoundationModelEntitlement: Enable foundation models
   - PutUseCaseForModelAccess: Prepare models for use
   This represents escalation from 'use what's available' to 'enable what you need.'

5. **Monetization (OAI Reverse Proxy)**: Stolen credentials are pooled behind the OAI Reverse Proxy (gitgud.io/khanon/oai-reverse-proxy), which:
   - Aggregates multiple stolen credential sets
   - Provides a unified API for buyers
   - Tracks usage per key ('tookens', costs)
   - Routes requests across credential pools for load balancing
   - Enables resale to buyers in sanctioned countries

6. **Self-Reinforcing Cycle**: Sysdig TRT observed attackers using stolen Claude access to write improved exploitation scripts — including async Python scripts optimized for concurrent LLM abuse. The tools get better with each iteration because attackers use their stolen compute to improve them.

**Scale and Impact:**
- 85,000+ Bedrock API requests observed in single campaign
- 61,000 requests in a 3-hour window on July 11, 2024
- 10x increase in LLM request volume month-over-month (July 2024)
- 2x increase in unique attacker IPs over first half of 2024
- Cost: $46,000/day (Claude v2) to $100,000+/day (Claude 3 Opus)
- Languages in prompts: English (80%), Korean (10%), Russian, Romanian, German, Spanish, Japanese
- Content: ~95% roleplay (bypassing content policy), ~5% general abuse

**Self-Hosted LLM Targeting:**
Beyond cloud API abuse, the campaign also targets self-hosted LLM endpoints:
- Ollama servers (TCP/11434) — 175K+ exposed without authentication (see TL-2026-0012)
- vLLM, text-generation-webui, LocalAI instances exposed on public IPs
- Open-source model serving frameworks with default configurations
- Shodan/Censys scanning for LLM service fingerprints

**Connection to TL-2026-0012 (LLMjacking/Ollama):**
This threat is the Anthropic-specific and cloud-API-specific branch of the broader LLMjacking campaign documented in TL-2026-0012. TL-0012 covers the Ollama/self-hosted vector; TL-0036 covers the cloud credential theft and Anthropic API scanning vector. Together they represent the complete LLMjacking threat landscape.

## MITRE ATT&CK

- T1595 Active Scanning
- T1589 Gather Victim Identity Information
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1098 Account Manipulation
- T1685 Disable or Modify Tools
- T1535 Unused/Unsupported Cloud Regions
- T1552 Unsecured Credentials
- T1526 Cloud Service Discovery
- T1538 Cloud Service Dashboard
- T1530 Data from Cloud Storage
- T1090 Proxy
- T1071 Application Layer Protocol
- T1537 Transfer Data to Cloud Account
- T1496 Resource Hijacking
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL)

**Default API Key Authentication Attempt** (`TL-2026-0036-DET-002`)

Detects attempts to authenticate with default or documentation API keys

- **Languages:** Splunk SPL, Microsoft KQL
- **Data sources:** web_logs, application_logs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=web sourcetype=access_combined OR sourcetype=application_logs
| where match(uri, "(?i)(/v1/|/api/|/anthropic/)")
| where match(_raw, "(?i)(x-api-key:\s*(password|test|demo|default|apikey|changeme|admin))")
| stats count values(uri) as endpoints values(src_ip) as sources by dest_ip
| where count > 0
| eval alert_severity="HIGH"
| eval alert_reason="Default API key authentication attempt - likely automated scanning or misconfiguration probe"
```

### Microsoft KQL

```kql
// Default API Key Authentication Attempt
// Detects attempts to authenticate with default or documentation API keys
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any ("/v1/", "/api/", "/anthropic/")
// Note: In real deployment, inspect HTTP headers via web logs
| project Timestamp, DeviceName, RemoteUrl, RemoteIP
| summarize AttemptCount=count() by RemoteIP, RemoteUrl
| where AttemptCount > 5
```

**Known false positives:**

- Development/testing with intentional default keys

**Tuning notes:** Should never see default keys in production - alert immediately

### 5 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Anthropic API Endpoint Scanning (locked: unlock with TL Creds)
- Tor Exit Node Accessing AI Infrastructure (locked: unlock with TL Creds)
- Mass API Endpoint Scanning Against AI Infrastructure (locked: unlock with TL Creds)
- Default API Key Authentication — Credential Stuffing Against LLM APIs (locked: unlock with TL Creds)
- Tor Exit Node Accessing AI API — Anonymous Reconnaissance (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 18)

Defanged, TLP:CLEAR.

- IP address: `83.7.139[.]184`
- URL: `hxxps://github[.]com/kingbased/keychecker`
- IP address: `103.108.229[.]55`

Full set of 18 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Sysdig TRT — LLMjacking: Stolen Cloud Credentials Used in New AI Attack](https://sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack/)
- [Sysdig TRT — Growing Dangers of LLMjacking: Evolving Tactics](https://sysdig.com/blog/growing-dangers-of-llmjacking/)
- [kingbased/keychecker — Credential Validation Tool](https://github.com/kingbased/keychecker)
- [OAI Reverse Proxy — LLM Credential Monetization](https://gitgud.io/khanon/oai-reverse-proxy)
- [AWS Bedrock Pricing](https://aws.amazon.com/bedrock/pricing/)
- [AWS Bedrock Runtime API Documentation](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_Operations_Amazon_Bedrock_Runtime.html)
- [CybeNari — Stolen AWS Credential Sources](https://cybenari.com/2024/08/whats-the-worst-place-to-leave-your-secrets/)
- [NVD — CVE-2021-3129 Laravel Ignition RCE](https://nvd.nist.gov/vuln/detail/CVE-2021-3129)

## Full data

The other 5 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0036