Search — “UNC6993”

Mandiant/GTIG report LLMJacking intrusions in 2026 (including financial services) where actors used stolen cloud credentials, service account keys, PATs and LLM API keys to enable and abuse LLM services, generating up to $1M in charges. In one case a follow-on cluster exploited a LiteLLM /key/regenerate user ID rebind flaw (CVE-2026-40217) to elevate Virtual Keys to PROXY_ADMIN. Separately, a roundup reports Era observed the Greeter framework exploiting Flowise CVE-2024-58351 against honeypots for command execution; no victim compromises are reported for that activity. Hunt for unauthorized LLM service enablement, new access keys/service accounts, SSH key injection into instance metadata, and max_tokens=1 validation sweeps.

GTIG and Mandiant describe multiple 2026 incidents where actors (including UNC6993) used stolen IAM credentials, service account keys, GitHub PATs, session tokens and leaked LLM API keys to enable LLM services (Bedrock, Gemini API), create keys and service accounts, inject SSH keys, and resell access via LLM Mixers such as Jet Night and newapi[.]pro. Charges exceeded $100,000 in a day and reached ~$1M cumulatively at some victims, including financial services. One cluster exploited LiteLLM CVE-2026-40217 to elevate virtual keys to PROXY_ADMIN. Hunt cloud audit logs for unexpected LLM service enablement, access/service-account key creation, burn-and-rotate service account churn, project/instance SSH key metadata changes, GPU quota requests, and max_tokens=1 key-validation sweeps.

Mandiant responded to multiple 2026 incidents in which financially motivated actors (incl. UNC6993) used stolen cloud identity tokens, service account keys, GitHub PATs, leaked LLM API keys, or exposed Ollama endpoints to hijack enterprise LLM access, causing up to $1M in fraudulent charges. Actors enumerated cloud services and repos for secrets, created rogue IAM/service accounts, injected SSH keys into instance metadata, exploited a LiteLLM /key/regenerate flaw (CVE-2026-40217), enabled Bedrock/Gemini/Vertex services, and resold access via mixers like jet-night.com and newapi.pro. Hunt for unexpected LLM service enablement, max_tokens=1 validation sweeps, Bedrock InvokeModel spikes, logging config changes, and new service accounts/keys.