# The Rise of LLMJacking: Threat Actors Monetize Compromised Cloud and Model Resources (UNC6993, D1337-KAIROS, CVE-2026-40217)

> Google Cloud Threat Intelligence reports financially motivated clusters (UNC6993, persona D1337-KAIROS) hijacking enterprise access to cloud-hosted LLMs (AWS Bedrock, Google Vertex AI/Gemini, Azure Cognitive Services) using stolen cloud identity tokens, exposed LLM endpoints and LiteLLM gateway exploitation. Fraudulent charges exceeded $100,000 USD in a single day and reached about $1 million USD cumulatively at some organizations, with access resold via underground 'LLM Mixer' services.

- **Published:** 2026-11-02T15:36:30Z
- **Last reviewed:** 2026-11-02T15:36:30Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5064
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5064.png
- **ID:** TL-2026-5064
- **Severity:** HIGH (CVSS 8.8)
- **Category:** CLOUD
- **Status:** ACTIVE
- **Actor:** UNC6993
- **Detections:** 9 (1 shown free below) · **IOCs:** 16 (2 shown free below)
- **CVEs:** CVE-2026-40217, CVE-2026-47101, CVE-2026-47102

## Description

LLMjacking is the abuse of a victim's cloud-hosted generative AI access to run inference at the victim's expense and resell the capacity. Google Cloud Threat Intelligence / Mandiant responded to multiple incidents in 2026 spanning several cloud and LLM providers. Initial access relied on exposed or stolen cloud identity material: IAM credentials, Service Account keys, GitHub personal access tokens, active session tokens and federation tokens used to bypass MFA. UNC6993 compromised a cloud instance through a misconfigured Service Account key and hosted a session-hijacking page posing as an LLM application portal that tricked users into pasting raw JSON containing active access tokens. Actors also harvested LLM API keys from public GitHub repositories and validated them with minimal requests (max_tokens=1) before scaling abuse.

After access, actors enumerated cloud services, code repositories and data stores, cloned codebases to hunt for hardcoded secrets, scanned access logs for credentials and queried cloud data-warehouse metadata for credentials. Privilege escalation and persistence used token-creation privileges to mint temporary credentials for high-privilege service accounts, attachment of administrative policies, creation of unauthorized IAM/service accounts (including backdoor accounts disguised as billing optimization utilities), and injection of SSH keys into instance metadata. A 'burn and rotate' pattern of creating and deleting short-lived service accounts was observed. Monetization steps included enabling managed generative AI platforms, creating additional API keys, subscribing victim accounts to Pay-As-You-Go agreements, launching high-volume inference on premium foundation models, requesting quota increases and provisioning GPU compute. UNC6993 accumulated more than $100,000 USD in charges in one intrusion; a victim of the jet-night.com service was passed nearly $1 million USD in token costs (500,000+ API calls in under 8 hours).

The D1337-KAIROS persona deployed publicly reachable reverse proxies and custom Node.js proxy bundles, a containerized backdoor built on the Manus agent framework, LiteLLM gateways, and GPU instances. Stolen quotas are pooled with open-source gateways (new-api, gcli2api, LiteLLM) and custom relay infrastructure (ai-relay, hosted on lookalike domains masquerading as the victim's internal hosts) and resold through 'LLM Mixer' services such as jet-night.com (unlimited-token plans advertised around $60 USD/month, with outages announced on a public Telegram channel) and newapi.pro. Other tooling named in the report: SearXNG, agent-infra/sandbox, and Ollama (public exposure tested against /api/create).

CVE-2026-40217 (LiteLLM): Google describes a follow-on cluster exploiting it after receiving pre-validated Virtual Keys, escalating to PROXY_ADMIN, and characterizes it as a user-ID rebind flaw in /key/regenerate. NOTE: authoritative sources differ. NVD (published 2026-04-10, CVSS 3.1 8.8, CWE-94/CWE-420) and the X41 D-Sec advisory X41-2026-001 describe CVE-2026-40217 as authenticated remote code execution through a sandbox escape (regex-filter and bytecode-rewriting bypass) in the /guardrails/test_custom_code Custom Code Guardrail endpoint, returning uid=0 on the default Docker deployment. The Hacker News reports it fixed in LiteLLM v1.83.14-stable and chained by Obsidian Security with CVE-2026-47101 (allowed_routes authorization bypass) and CVE-2026-47102 (/user/update user_role self-promotion to proxy_admin). The /key/regenerate characterization could not be corroborated outside the Google blog; defenders should patch to v1.83.14-stable or later and cover both behaviors.

## MITRE ATT&CK

- T1078.004 Valid Accounts: Cloud Accounts
- T1190 Exploit Public-Facing Application
- T1566.002 Phishing: Spearphishing Link
- T1059.006 Command and Scripting Interpreter: Python
- T1098.001 Account Manipulation: Additional Cloud Credentials
- T1098.004 Account Manipulation: SSH Authorized Keys
- T1136.003 Create Account: Cloud Account
- T1685.002 Disable or Modify Cloud Log
- T1528 Steal Application Access Token
- T1552.001 Unsecured Credentials: Credentials In Files
- T1526 Cloud Service Discovery
- T1580 Cloud Infrastructure Discovery
- T1213.003 Data from Information Repositories: Code Repositories
- T1090 Proxy
- T1583.001 Acquire Infrastructure: Domains
- T1496.004 Resource Hijacking: Cloud Service Hijacking
- T1578.002 Modify Cloud Compute Infrastructure: Create Cloud Instance

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**LiteLLM Proxy Guardrail Sandbox Escape and Admin Escalation Endpoint Abuse (CVE-2026-40217) - Exploitation** (`TL-2026-5064-SPL-001`)

Detects POST requests to the LiteLLM endpoints abused in the TL-2026-5064 LLMjacking activity: /guardrails/test_custom_code (CVE-2026-40217 Custom Code Guardrail sandbox escape per NVD and X41-2026-001), /key/regenerate (Virtual Key to PROXY_ADMIN escalation per Google) and /user/update (CVE-2026-47102 role self-promotion). Requests from outside the admin network to these routes indicate exploitation of an exposed LiteLLM gateway. Research sources disagree on which endpoint CVE-2026-40217 maps to, so all are covered.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059.006
- **Data sources:** index=web sourcetype=access_combined, index=web sourcetype=nginx:plus:access, index=web sourcetype=iis, CommonSecurityLog, webserver
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=web (sourcetype=access_combined OR sourcetype=nginx:plus:access OR sourcetype=iis) method=POST (uri_path="/guardrails/test_custom_code" OR uri_path="/key/regenerate" OR uri_path="/user/update")
| eval litellm_endpoint=case(like(uri_path,"%/guardrails/test_custom_code"),"guardrail_sandbox_escape_CVE-2026-40217", like(uri_path,"%/key/regenerate"),"virtual_key_regenerate", like(uri_path,"%/user/update"),"user_role_update_CVE-2026-47102")
| stats count as requests min(_time) as first_seen max(_time) as last_seen values(status) as http_status values(http_user_agent) as user_agents by src, dest, litellm_endpoint
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| sort - requests
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestMethod =~ "POST"
| where RequestURL has_any ("/guardrails/test_custom_code", "/key/regenerate", "/user/update")
| extend LiteLLMEndpoint = case(RequestURL has "/guardrails/test_custom_code", "guardrail_sandbox_escape_CVE-2026-40217", RequestURL has "/key/regenerate", "virtual_key_regenerate", "user_role_update_CVE-2026-47102")
| summarize Requests = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), UserAgents = make_set(RequestClientApplication, 10) by SourceIP, DestinationIP, DestinationHostName, LiteLLMEndpoint
| order by Requests desc
```

### Sigma

```yaml
title: LiteLLM Guardrail Sandbox Escape and Admin Escalation Endpoint Access CVE-2026-40217
id: 5b1f0c7e-3a42-4d8e-9c61-7e2a9d4b1f01
status: experimental
description: Detects POST requests to LiteLLM proxy endpoints abused for CVE-2026-40217 code execution via the Custom Code Guardrail test endpoint and for Virtual Key and role escalation via /key/regenerate and /user/update.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-40217
  - https://www.x41-dsec.de/lab/advisories/x41-2026-001-litellm/
  - https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-02
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1059.006
  - cve.2026-40217
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-stem|endswith:
      - /guardrails/test_custom_code
      - /key/regenerate
      - /user/update
  condition: selection
falsepositives:
  - LiteLLM administrators using the admin UI or API from trusted management networks
  - Authorized penetration tests against the gateway
level: high

```

**Known false positives:**

- LiteLLM administrators legitimately calling /key/regenerate or /user/update from the admin network
- Authorized security testing or vulnerability scanning of the LiteLLM gateway

**Tuning notes:** Exclude known admin source IPs and management subnets. Raise priority when the source is external, when the same src hits more than one endpoint, or when /guardrails/test_custom_code is followed by outbound connections from the LiteLLM host. Patch LiteLLM to v1.83.14-stable or later. Adjust index and sourcetype to your reverse-proxy or WAF logs (the field is cs_uri_stem for IIS).

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Unauthorized Generative AI Service Enablement or Model Deployment in GCP and Azure (locked: unlock with TL Creds)
- GCP Service Account Burn-and-Rotate, Key Minting and SSH Key Metadata Injection (locked: unlock with TL Creds)
- LLM Gateway and Relay Tooling Execution (new-api, gcli2api, ai-relay, [indicator]) and Exposed Ollama [indicator] (locked: unlock with TL Creds)
- Repository Secret Hunting with Scanners or Credential-Pattern Grep (LLM API Key Harvesting) (locked: unlock with TL Creds)
- AWS Bedrock Model Invocation Logging Configuration Tampering (locked: unlock with TL Creds)
- Automated User-Agent Bedrock Model Invocation with Stolen Credentials (claude-cli, aws-sdk-rust, aws-sdk-go-v2) (locked: unlock with TL Creds)
- AWS IAM Backdoor Identity, Access Key and Admin Policy Attachment (LLMjacking Persistence) (locked: unlock with TL Creds)
- LLM Mixer Resale Infrastructure Egress ([indicator], [indicator]) - C2 / Relay (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 16)

Defanged, TLP:CLEAR.

- Domain: `jet-night[.]com`
- Domain: `newapi[.]pro`

Full set of 16 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources](https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models/)
- [NVD - CVE-2026-40217](https://nvd.nist.gov/vuln/detail/CVE-2026-40217)
- [X41 D-Sec Advisory X41-2026-001: LiteLLM Guardrail Sandbox Escape](https://www.x41-dsec.de/lab/advisories/x41-2026-001-litellm/)
- [LiteLLM vulnerability chain lets low-privilege users gain proxy admin and code execution (The Hacker News)](https://thehackernews.com/2026/06/litellm-vulnerability-chain-lets-low.html)
- [GitLab Advisory Database - CVE-2026-47101 (litellm)](https://advisories.gitlab.com/pypi/litellm/CVE-2026-47101/)
- [GitLab Advisory Database - CVE-2026-47102 (litellm)](https://advisories.gitlab.com/pypi/litellm/CVE-2026-47102/)
- [GTI Collection (VirusTotal) - LLMjacking IOCs](https://www.virustotal.com/gui/collection/4377d2403ea17a04744ca871113c1313b0162f190f0b785f5a10b744e8528245/iocs)
- [BerriAI/litellm](https://github.com/BerriAI/litellm)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5064