The Rise of LLMJacking: Threat Actors Monetize Compromised Cloud and Model Resources (UNC6993, D1337-KAIROS, CVE-2026-40217)

Key facts for LLMjacking UNC6993 campaign

Detection coverage for LLMjacking UNC6993 campaign

As of 2026-11-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5064 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: LiteLLM Proxy Guardrail Sandbox Escape and Admin Escalation Endpoint Abuse (CVE-2026-40217) - Exploitation

Detects POST requests to the LiteLLM endpoints abused in the TL-2026-5064 LLMjacking activity: /guardrails/test_custom_code (CVE-2026-40217 Custom Code Guardrail sandbox escape per NVD and X41-2026-001), /key/regenerate (Virtual Key to PROXY_ADMIN escalation per Google) and /user/update (CVE-2026-47102 role self-promotion). Requests from outside the admin network to these routes indicate exploitation of an exposed LiteLLM gateway. Research sources disagree on which endpoint CVE-2026-40217 maps to, so all are covered.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1059.006
• Data sources: index=web sourcetype=access_combined, index=web sourcetype=nginx:plus:access, index=web sourcetype=iis, CommonSecurityLog, webserver
• Severity: high
• Confidence: high

Splunk SPL

index=web (sourcetype=access_combined OR sourcetype=nginx:plus:access OR sourcetype=iis) method=POST (uri_path="/guardrails/test_custom_code" OR uri_path="/key/regenerate" OR uri_path="/user/update")
| eval litellm_endpoint=case(like(uri_path,"%/guardrails/test_custom_code"),"guardrail_sandbox_escape_CVE-2026-40217", like(uri_path,"%/key/regenerate"),"virtual_key_regenerate", like(uri_path,"%/user/update"),"user_role_update_CVE-2026-47102")
| stats count as requests min(_time) as first_seen max(_time) as last_seen values(status) as http_status values(http_user_agent) as user_agents by src, dest, litellm_endpoint
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| sort - requests

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestMethod =~ "POST"
| where RequestURL has_any ("/guardrails/test_custom_code", "/key/regenerate", "/user/update")
| extend LiteLLMEndpoint = case(RequestURL has "/guardrails/test_custom_code", "guardrail_sandbox_escape_CVE-2026-40217", RequestURL has "/key/regenerate", "virtual_key_regenerate", "user_role_update_CVE-2026-47102")
| summarize Requests = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), UserAgents = make_set(RequestClientApplication, 10) by SourceIP, DestinationIP, DestinationHostName, LiteLLMEndpoint
| order by Requests desc

Sigma

title: LiteLLM Guardrail Sandbox Escape and Admin Escalation Endpoint Access CVE-2026-40217
id: 5b1f0c7e-3a42-4d8e-9c61-7e2a9d4b1f01
status: experimental
description: Detects POST requests to LiteLLM proxy endpoints abused for CVE-2026-40217 code execution via the Custom Code Guardrail test endpoint and for Virtual Key and role escalation via /key/regenerate and /user/update.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-40217
  - https://www.x41-dsec.de/lab/advisories/x41-2026-001-litellm/
  - https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-02
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1059.006
  - cve.2026-40217
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-stem|endswith:
      - /guardrails/test_custom_code
      - /key/regenerate
      - /user/update
  condition: selection
falsepositives:
  - LiteLLM administrators using the admin UI or API from trusted management networks
  - Authorized penetration tests against the gateway
level: high

Known false positives:

• LiteLLM administrators legitimately calling /key/regenerate or /user/update from the admin network
• Authorized security testing or vulnerability scanning of the LiteLLM gateway

Tuning notes: Exclude known admin source IPs and management subnets. Raise priority when the source is external, when the same src hits more than one endpoint, or when /guardrails/test_custom_code is followed by outbound connections from the LiteLLM host. Patch LiteLLM to v1.83.14-stable or later. Adjust index and sourcetype to your reverse-proxy or WAF logs (the field is cs_uri_stem for IIS).

• 🔒 Unauthorized Generative AI Service Enablement or Model Deployment in GCP and Azure · unlock with TL Creds
• 🔒 GCP Service Account Burn-and-Rotate, Key Minting and SSH Key Metadata Injection · unlock with TL Creds
• 🔒 LLM Gateway and Relay Tooling Execution (new-api, gcli2api, ai-relay, [indicator]) and Exposed Ollama [indicator] · unlock with TL Creds
• 🔒 Repository Secret Hunting with Scanners or Credential-Pattern Grep (LLM API Key Harvesting) · unlock with TL Creds
• 🔒 AWS Bedrock Model Invocation Logging Configuration Tampering · unlock with TL Creds
• 🔒 Automated User-Agent Bedrock Model Invocation with Stolen Credentials (claude-cli, aws-sdk-rust, aws-sdk-go-v2) · unlock with TL Creds
• 🔒 AWS IAM Backdoor Identity, Access Key and Admin Policy Attachment (LLMjacking Persistence) · unlock with TL Creds
• 🔒 LLM Mixer Resale Infrastructure Egress ([indicator], [indicator]) - C2 / Relay · unlock with TL Creds

Indicators of compromise for LLMjacking UNC6993 campaign

As of 2026-11-02, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-5064.

Sample indicators (2 of 16)

• Domain: jet-night[.]com
• Domain: newapi[.]pro

Defanged, TLP:CLEAR. Full set of 16 indicators: unlock with TL Creds.

How LLMjacking UNC6993 campaign works

LLMjacking is the abuse of a victim's cloud-hosted generative AI access to run inference at the victim's expense and resell the capacity. Google Cloud Threat Intelligence / Mandiant responded to multiple incidents in 2026 spanning several cloud and LLM providers. Initial access relied on exposed or stolen cloud identity material: IAM credentials, Service Account keys, GitHub personal access tokens, active session tokens and federation tokens used to bypass MFA. UNC6993 compromised a cloud instance through a misconfigured Service Account key and hosted a session-hijacking page posing as an LLM application portal that tricked users into pasting raw JSON containing active access tokens. Actors also harvested LLM API keys from public GitHub repositories and validated them with minimal requests (max_tokens=1) before scaling abuse.

After access, actors enumerated cloud services, code repositories and data stores, cloned codebases to hunt for hardcoded secrets, scanned access logs for credentials and queried cloud data-warehouse metadata for credentials. Privilege escalation and persistence used token-creation privileges to mint temporary credentials for high-privilege service accounts, attachment of administrative policies, creation of unauthorized IAM/service accounts (including backdoor accounts disguised as billing optimization utilities), and injection of SSH keys into instance metadata. A 'burn and rotate' pattern of creating and deleting short-lived service accounts was observed. Monetization steps included enabling managed generative AI platforms, creating additional API keys, subscribing victim accounts to Pay-As-You-Go agreements, launching high-volume inference on premium foundation models, requesting quota increases and provisioning GPU compute. UNC6993 accumulated more than $100,000 USD in charges in one intrusion; a victim of the jet-night.com service was passed nearly $1 million USD in token costs (500,000+ API calls in under 8 hours).

The D1337-KAIROS persona deployed publicly reachable reverse proxies and custom Node.js proxy bundles, a containerized backdoor built on the Manus agent framework, LiteLLM gateways, and GPU instances. Stolen quotas are pooled with open-source gateways (new-api, gcli2api, LiteLLM) and custom relay infrastructure (ai-relay, hosted on lookalike domains masquerading as the victim's internal hosts) and resold through 'LLM Mixer' services such as jet-night.com (unlimited-token plans advertised around $60 USD/month, with outages announced on a public Telegram channel) and newapi.pro. Other tooling named in the report: SearXNG, agent-infra/sandbox, and Ollama (public exposure tested against /api/create).

CVE-2026-40217 (LiteLLM): Google describes a follow-on cluster exploiting it after receiving pre-validated Virtual Keys, escalating to PROXY_ADMIN, and characterizes it as a user-ID rebind flaw in /key/regenerate. NOTE: authoritative sources differ. NVD (published 2026-04-10, CVSS 3.1 8.8, CWE-94/CWE-420) and the X41 D-Sec advisory X41-2026-001 describe CVE-2026-40217 as authenticated remote code execution through a sandbox escape (regex-filter and bytecode-rewriting bypass) in the /guardrails/test_custom_code Custom Code Guardrail endpoint, returning uid=0 on the default Docker deployment. The Hacker News reports it fixed in LiteLLM v1.83.14-stable and chained by Obsidian Security with CVE-2026-47101 (allowed_routes authorization bypass) and CVE-2026-47102 (/user/update user_role self-promotion to proxy_admin). The /key/regenerate characterization could not be corroborated outside the Google blog; defenders should patch to v1.83.14-stable or later and cover both behaviors.

MITRE ATT&CK techniques by tactic:

Execution

T1059.006 Command and Scripting Interpreter: Python

Initial Access

T1078.004 Valid Accounts: Cloud Accounts; T1190 Exploit Public-Facing Application; T1566.002 Phishing: Spearphishing Link

Command and Control

T1090 Proxy

Persistence

T1098.001 Account Manipulation: Additional Cloud Credentials; T1098.004 Account Manipulation: SSH Authorized Keys; T1136.003 Create Account: Cloud Account

Collection

T1213.003 Data from Information Repositories: Code Repositories

Impact

T1496.004 Resource Hijacking: Cloud Service Hijacking

Discovery

T1526 Cloud Service Discovery; T1580 Cloud Infrastructure Discovery

Credential Access

T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files

defense-impairment

T1578.002 Modify Cloud Compute Infrastructure: Create Cloud Instance; T1685.002 Disable or Modify Cloud Log

Resource Development

T1583.001 Acquire Infrastructure: Domains

Remediation for LLMjacking UNC6993 campaign

Patches

• Upgrade LiteLLM to v1.83.14-stable or later (fixes CVE-2026-40217, CVE-2026-47101, CVE-2026-47102 per The Hacker News)

Immediate actions

• Revoke and rotate exposed IAM credentials, Service Account keys, GitHub PATs and LLM API keys; delete unauthorized IAM/service accounts and injected SSH keys in instance or project metadata
• Review cloud audit logs for unauthorized enablement of LLM services (Bedrock, Vertex AI, Azure CognitiveServices) and unexpected Pay-As-You-Go agreements or quota increases
• Set spending caps, budget alerts and granular API quotas on LLM services
• Block outbound connections to jet-night.com and newapi.pro

Workarounds

• Restrict network access to LiteLLM admin and guardrail endpoints (/guardrails/test_custom_code, /key/regenerate, /user/update)
• Do not expose Ollama or other LLM endpoints (e.g. /api/create) to the public internet

Longer-term hardening

• Centralize secrets management with automated rotation and short credential lifetimes; run automated secret scanning on code repositories
• Enforce phishing-resistant MFA across cloud identity providers, consoles and developer platforms
• Apply least privilege and deny LLM service access by default; scope API keys by model, environment and usage limit
• Extend vulnerability management to LiteLLM and other model gateways; restrict egress with VPC firewalls and rate-limit with a WAF
• Run sandboxed execution for dynamic code and pull models only from vetted internal registries; discover shadow LLM deployments with posture management

Affected and fixed versions

• BerriAI — LiteLLM
  Vulnerable versions: through 2026-04-08 (prior to v1.83.14-stable)
  Fixed in: v1.83.14-stable
• Amazon Web Services — Amazon Bedrock (abused cloud LLM service)
  Vulnerable versions: Accounts with exposed or stolen credentials
• Google — Vertex AI / Gemini API (abused cloud LLM service)
  Vulnerable versions: Projects with exposed Service Account keys or tokens
• Microsoft — Azure Cognitive Services / Azure OpenAI (abused cloud LLM service)
  Vulnerable versions: Subscriptions with exposed or stolen credentials

Timeline of LLMjacking UNC6993 campaign

• 2026-02-13 X41 D-Sec identifies the locked-ioc-12 Custom Code Guardrail sandbox escape later assigned CVE-2026-40217
• 2026-04-08 X41 D-Sec publishes advisory X41-2026-001 after embargo expiry; PoC returns uid=0 on default Docker deployment
• 2026-04-10 NVD publishes CVE-2026-40217 (CVSS 3.1 8.8, CWE-94/CWE-420)
• 2026-05-02 BerriAI releases locked-ioc-12 v1.83.14-stable containing fixes for the CVE-2026-40217/47101/47102 chain
• 2026-06-01 The Hacker News reports Obsidian Security's locked-ioc-12 vulnerability chain enabling low-privilege users to reach proxy admin and code execution
• 2026-06-30 Mid-2026: locked-ioc-14 compromises a cloud instance via a misconfigured Service Account key and accumulates over $100,000 USD in charges (date approximate per source 'mid-2026')
• 2026-11-02 Google Cloud Threat Intelligence publishes 'The Rise of LLMJacking' detailing locked-ioc-14, locked-ioc-6, LLM Mixer services and detection guidance

Sources cited for LLMjacking UNC6993 campaign

• NVD - CVE-2026-40217 NVD (NIST) · Advisory · 2026-04-10
• GitLab Advisory Database - CVE-2026-47101 (litellm) GitLab · Advisory · 2026-05-02
• GitLab Advisory Database - CVE-2026-47102 (litellm) GitLab · Advisory · 2026-05-02
• The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources Google Cloud · Vendor report · 2026-11-02
• X41 D-Sec Advisory X41-2026-001: LiteLLM Guardrail Sandbox Escape x41-dsec.de · Research · 2026-04-08
• GTI Collection (VirusTotal) - LLMjacking IOCs virustotal.com · Research · 2026-11-02
• BerriAI/litellm GitHub · Code repository · 2026-05-02
• LiteLLM vulnerability chain lets low-privilege users gain proxy admin and code execution (The Hacker News) The Hacker News · News · 2026-06-01

More in cloud

• Password Spraying Campaign Targets AWS Root User Accounts Across 150+ Organizations
• From Phishing to LLMjacking: Threat Actors Hijacking GCP Billing Accounts for Gemini API Usage
• AWS EKS Forensics: Data Sources and Investigation Tooling (Synacktiv)
• AWS AI Agent Vulnerabilities (Loom, SageMaker Unified Studio) Let Attackers Bypass Authentication and Steal Credentials - CVE-2026-103956, CVE-2026-103957, CVE-2026-103958, CVE-2026-104019
• TeamFiltration Returns: UNK_CondorFiltration Credential-Spraying Campaign Targets Dormant M365 Service Accounts in Latin America

Further reading

• OpenClaw AI Agent Threat Landscape: 8 Attacks
• OpenCode AI Coding Agent: 8 Attack Vectors