Search — “jet-night.com”

Mandiant responded to multiple 2026 incidents in which financially motivated actors (incl. UNC6993) used stolen cloud identity tokens, service account keys, GitHub PATs, leaked LLM API keys, or exposed Ollama endpoints to hijack enterprise LLM access, causing up to $1M in fraudulent charges. Actors enumerated cloud services and repos for secrets, created rogue IAM/service accounts, injected SSH keys into instance metadata, exploited a LiteLLM /key/regenerate flaw (CVE-2026-40217), enabled Bedrock/Gemini/Vertex services, and resold access via mixers like jet-night.com and newapi.pro. Hunt for unexpected LLM service enablement, max_tokens=1 validation sweeps, Bedrock InvokeModel spikes, logging config changes, and new service accounts/keys.