Threat video1:00
UNC6993 LiteLLM LLMjacking $1M Bills: Detection & IOCs
UNC6993 turns stolen cloud keys and LiteLLM CVE-2026-40217 into AI bills of up to $1M per victim. 9 detection rules, 14 IOCs and a free Splunk SPL rule.
Read the full threat intel for UNC6993 LiteLLM LLMjacking $1M Bills: Detection & IOCs →
Chapters
- 0:00The hookLLMjacking: one-million dollar fraudulent charges per victim.
- 0:05The storyMandiant disclosed one-million dollar LLMjacking fraud via stolen credentials.
- 0:12Attack pathAttackers scan endpoints, use code injection, steal tokens.
- 0:27AttributionAttributed to UNC6993.
- 0:33Indicators of compromise8 indicators to hunt: 3 domains, 1 URL and 2 paths, and more.
- 0:38MITRE ATT&CK techniques13 ATT&CK techniques, from resource development to impact.
- 0:43Remediation5 steps now: Revoke and rotate exposed cloud IAM credentials, service account keys.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00LLMjacking: one-million dollar fraudulent charges per victim.
0:05Mandiant disclosed one-million dollar LLMjacking fraud via stolen credentials.
0:12Attackers scan endpoints, use code injection, steal tokens.
0:16Authenticate, enumerate cloud services, extract secrets from repositories.
0:22Create backdoors and run hijacked AI inference at scale.
0:27Attributed to UNC6993. Confidence: low.
0:338 indicators to hunt: 3 domains, 1 URL and 2 paths, and more.
0:3913 ATT&CK techniques, from resource development to impact.
0:435 steps now: Revoke and rotate exposed cloud IAM credentials, service account keys.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.