LLMJacking 的崛起：威胁行为者如何将受损的云与模型资源变现

作者：Christopher Romano、Codi Starks、Garrett Mahoney、John Wolfram、Josh Murchie、K Singh、Mathew Potaczek、Mike Lombardi、Rik DolfingWritten by: Christopher Romano, Codi Starks, Garrett Mahoney, John Wolfram, Josh Murchie, K Singh, Mathew Potaczek, Mike Lombardi, Rik Dolfing

引言Introduction 

Mandiant 在 2026 年响应了多起事件，威胁行为者劫持企业对大型语言模型（LLM）的访问权限，这种手法被称为“LLM 劫持”（LLMJacking）。这些入侵涉及多家云服务和 LLM 提供商，影响了北美、南美和亚太地区金融服务、零售、科技和交通运输行业的组织。Mandiant responded to multiple incidents in 2026 in which threat actors hijacked enterprise access to Large Language Models (LLMs), a tactic known as "LLMJacking." Spanning a variety of cloud and LLM providers, these intrusions impacted organizations in North America, South America, and Asia Pacific across the financial services, retail, technology, and transportation sectors. 

与加密劫持相关的资源消耗是逐渐发生的，而 LLM 劫持可能在短短几小时内就导致云服务费用激增。在多个个案中，我们观察到，资源消耗所产生的欺诈性费用单日超过 10 万美元；在某些组织，累计费用在访问权限被撤销前已达到 100 万美元。Unlike the gradual resource consumption associated with cryptojacking, LLMJacking can generate large spikes in fraudulent cloud charges in a matter of hours. Across individual incidents, we observed fraudulent charges associated with resource consumption exceeding $100,000 USD in a single day, with cumulative charges at some organizations reaching $1 million USD before access was revoked.

在分析这些一线入侵事件背后的犯罪生态，并结合此前关于 LLM 凭据地下市场不断扩大的报道后，Google 威胁情报小组（GTIG）发现了多个以经济利益为动机、活跃于全球不同地区的威胁集群。Analyzing the criminal ecosystem behind these frontline compromises, and building upon previous reporting on the growing underground market for LLM credentials, Google Threat Intelligence Group (GTIG) has identified a diverse set of financially motivated threat clusters operating out of multiple regions globally.

随着 LLM 劫持生态日趋成熟，我们也在追踪威胁行为者之间的分工：一方负责获取受损环境的初始访问权限，另一方则运营下游变现基础设施，后者称为“LLM Mixers”。LLM Mixers 是非法路由网关，充当代理、汇集并转售未经授权的 LLM 访问权限，供地下网络的订阅用户使用。在一项调查中，GTIG 观察到两个不同的行动集群协同攻击企业 LLM 基础设施并从中牟利，这表明该领域正涌现出高度专业化的分工。As the LLMJacking ecosystem matures, we are also tracking a division of labor between threat actors establishing initial access to compromised environments and operators managing downstream monetization infrastructure, known as “LLM Mixers”. LLM Mixers function as illicit routing gateways that proxy, aggregate, and resell unauthorized LLM access to underground subscribers. In one investigation, GTIG observed two distinct operational clusters coordinating to compromise and monetize enterprise LLM infrastructure, demonstrating the sophisticated specialization emerging in this space.

在这篇博客文章中，我们将介绍近期多起 LLMJacking 调查中观察到的攻击生命周期，并提供可执行的检测、加固和修复建议，帮助组织保护其基础设施。In this blog post, we describe the attack lifecycle observed across recent LLMJacking investigations and provide actionable detection, hardening, and remediation guidance to help organizations secure their infrastructure. 

初始访问Initial Access

虽然低层级资源盗用曾涉及操纵客户支持聊天机器人来执行代码生成等未经授权的任务，但实施 LLM 劫持的威胁行为者会绕过这些前端接口，直接攻击后端模型资源。具体而言，他们会设法识别公开暴露的 LLM 端点，或获取有效的 LLM 应用程序编程接口（API）密钥。图 1 展示了后一种情况的一个例子：威胁行为者使用自动化脚本调用 /api/create 端点来验证是否存在暴露，从而在毫不知情的用户公开开放的端点上独立运行自己的模型。如果不对这些服务加以保护，不仅会扩大组织传统的攻击面，还可能显著增加托管成本。While low-level resource theft has involved the manipulation of customer support chatbots to conduct unauthorized tasks like code generation, threat actors conducting LLMJacking bypass these front-end interfaces to target backend model resources directly. Specifically, they focus on either identifying publicly exposed LLM endpoints or obtaining valid LLM application programming interface (API) keys. An example of the latter can be seen in Figure 1, where a threat actor uses an automated script to verify exposure by calling the /api/create endpoint to independently run their own models on endpoints that unsuspecting users have left publicly accessible. Leaving these services unprotected not only expands an organization's traditional attack surface, but could also introduce a significant increase in hosting costs.

然而，在多起 LLMJacking 调查中，最常见的初始访问途径是暴露或被盗的云身份令牌，包括 IAM 凭据、服务账户密钥、GitHub 个人访问令牌（PAT）和有效会话令牌。威胁行为者利用这些令牌，在目标组织的基础设施中建立初始立足点。Across multiple LLMJacking investigations, however, the dominant initial access vector has been exposed or stolen cloud identity tokens—including IAM credentials, Service Account keys, GitHub Personal Access Tokens (PATs), and active session tokens—which threat actors leverage to establish an initial foothold into target organizations' infrastructure.

例如，2026年年中，UNC6993利用配置错误的服务账户密钥入侵了一个云实例，并利用该访问权限进一步获取了对某个 LLM API 的访问权限。UNC6993还托管了一个会话劫持页面，伪装成应用门户，用于加入一组 LLM 用户。该页面诱骗用户跳转至合法的 LLM 服务网站，并粘贴包含有效访问令牌的原始 JSON 负载；随后，这些内容会被提交到后端 API，以绕过密码和多因素身份验证（MFA）控制。For instance, in mid-2026 UNC6993 compromised a cloud instance through a misconfigured Service Account key and used this access to grant further access to an LLM API. UNC6993 also hosted a session hijacking page masquerading as an application portal to join a group of LLM users. This page tricks users into navigating to the legitimate LLM service website, and pasting their raw JSON payload containing an active access token, which was then posted to the backend  API to bypass password and multifactor authentication (MFA) controls.

在另一起事件中，一名威胁行为者将窃取的个人访问令牌（PAT）用于访问私有代码仓库，并利用运行于容器化云环境中的某个软件包所存在的疑似 Web 应用程序漏洞，从而获得初始访问权限。类似地，另一名威胁行为者利用遭入侵的企业用户 IAM 凭据，通过云联合身份令牌以编程方式生成新的访问密钥，以绕过 MFA 要求。在另一起事件中，首次观察到一名威胁行为者使用遭入侵的云服务账户密钥访问环境，而该密钥拥有广泛的项目权限。In another instance, one threat actor gained initial entry by combining a stolen Personal Access Token (PAT) to access private code repositories with the exploitation of a suspected web application vulnerability in a package running within a containerized cloud environment. Similarly, a different threat actor leveraged compromised IAM credentials of corporate users, using cloud federation tokens to programmatically generate fresh access keys to circumvent MFA requirements. In a separate incident, a threat actor was first observed accessing the environment with a compromised cloud Service Account key with broad project permissions.

除了通用云身份凭据外，威胁行为者也会将目标对准 LLM API 密钥。例如，某威胁行为者趁机从公开的 GitHub 仓库中窃取了暴露的企业 LLM API 密钥。该组织展现出高超的规避手法，通过自动化凭据验证扫描，发送最简化的单令牌请求（max_tokens=1）。这使威胁行为者能够秘密确认被盗密钥是否有效，同时避开受害者的终端检测与响应（EDR）系统和安全信息与事件管理（SIEM）系统发出的流量异常告警。Beyond general cloud identity credentials, threat actors also target LLM API keys. For example, a threat actor opportunistically harvested exposed corporate LLM API keys from public GitHub repositories. Demonstrating advanced evasion tradecraft, the group conducted automated credential validation sweeps using minimal single-token requests (max_tokens=1). This allowed the threat actor to stealthily confirm the viability of the stolen keys while remaining undetected by the victim’s endpoint detection and response (EDR) and SIEM volume anomaly alerts.

横向移动与持久化Lateral Movement and Persistence

获得初步立足点后，威胁行为者会有条不紊地提升权限、巩固访问权限，并开展内部侦察，以确定目标并获取更多云凭据。After gaining an initial foothold, threat actors systematically work to escalate privileges, solidify access, and conduct internal reconnaissance to identify targets and further cloud credentials.

为扩大其访问范围，威胁行为者枚举了云服务、代码仓库和数据存储，以查找敏感凭据。在一次入侵中，威胁行为者对多个云区域进行了内部侦察，以梳理可用服务和身份策略。在另一起入侵中，威胁行为者攻陷了一个容器化云环境。进入环境后，他们进行了广泛的代码仓库侦察，克隆敏感代码库，以搜索硬编码密钥、配置变量和开发者凭据。他们还扫描了访问日志，以识别用于其他云环境的凭据。威胁行为者还执行了有针对性的数据库查询，以获取更多凭据；在一个案例中，威胁行为者查询了云数据仓库的元数据表，以查找数据库凭据、管理员密码和敏感列，同时还执行了与有针对性数据窃取相关的云对象存储操作。To expand their access, threat actors enumerated cloud services, code repositories, and data stores for sensitive credentials. In one intrusion, a threat actor conducted internal reconnaissance across multiple cloud regions to map available services and identity policies. In a separate intrusion, a threat actor compromised a containerized cloud environment. Once inside, they performed extensive repository reconnaissance, cloning sensitive codebases to search for hardcoded secrets, configuration variables, and developer credentials. They also scanned access logs to identify credentials for secondary cloud environments. Threat actors also executed targeted database queries to harvest additional credentials; in one case, the threat actor queried cloud data warehouse metadata tables to search for database credentials, administrator passwords, and sensitive columns, alongside performing cloud object storage operations associated with targeted data theft.

在多起入侵事件中，我们观察到威胁行为者滥用云身份权限和虚拟机配置来提升权限并维持持久访问。某威胁行为者利用与受感染工作负载关联的服务账户，滥用令牌创建权限，为高权限服务账户生成临时凭据，进而从云端密钥管理器中窃取基础设施凭据、内部数据库密码和第三方 API 密钥。其他威胁行为者则通过创建未经授权的 IAM 账户和服务账户，以及向计算实例注入 SSH 密钥来建立持久访问。具体而言，一名行为者通过为服务角色附加管理策略来提升权限，创建拥有完整管理权限的未授权 IAM 账户，并与正在运行的虚拟机建立交互式管理会话，将未经授权的 SSH 公钥注入主机配置文件。类似地，另一名威胁行为者创建了伪装成内部账单优化工具的欺骗性后门服务账户，并将环境范围内的 SSH 密钥注入计算实例元数据。Across intrusions, we observed threat actors abusing cloud identity permissions and virtual machine configurations to escalate privileges and maintain persistent access. Utilizing service accounts associated with compromised workloads, one threat actor exploited token-creation privileges to generate temporary credentials for high-privilege service accounts, resulting in the exfiltration of infrastructure credentials, internal database passwords, and third-party API keys from cloud secret managers. Other threat actors established persistence by creating unauthorized IAM and service accounts and injecting SSH keys into compute instances. Specifically, one actor escalated privileges by attaching administrative policies to service roles, created unauthorized IAM accounts with full administrative rights, and established interactive management sessions into running virtual machines to inject unauthorized SSH public keys into host configuration files. Similarly, another threat actor created deceptive backdoor service accounts disguised as internal billing optimization utilities and injected environment-wide SSH keys into compute instance metadata.

除了利用传统云基础设施权限外，我们还观察到威胁行为者专门针对 LLM 路由软件中的漏洞，以提升权限。在一个案例中，后续攻击集群从最初建立访问权限的威胁行为者处获取预先验证的 Virtual Keys 后，针对受害者的 LiteLLM 网关实施了定向应用逻辑利用。该行为者利用 /key/regenerate 端点中的用户 ID 重新绑定漏洞（CVE-2026-40217），将普通 Virtual Keys 提权为完整的 PROXY_ADMIN 主管理员凭据，从而对遭入侵环境建立深入且持久的控制。Beyond exploiting traditional cloud infrastructure permissions, we have observed instances of threat actors targeting vulnerabilities specifically within LLM routing software to escalate privileges. In one case, after acquiring pre-validated Virtual Keys from the threat actor that established initial access, a follow-on cluster executed targeted application logic exploitation against the victim's LiteLLM gateway. The actor exploited a user ID rebind vulnerability in the /key/regenerate endpoint (CVE-2026-40217) to elevate standard Virtual Keys into full PROXY_ADMIN master administrative credentials, establishing deep, persistent control over the compromised environment.

LLM 滥用LLM Abuse

LLM 劫持的最终目标是将基础模型变现并劫持其资源，行为者通过令牌代理、自动化模型流式传输以及 GPU 硬件配置来实现这一目标。The ultimate objective of LLMJacking is the monetization and resource-hijacking of foundation models, which actors achieve through token proxying, automated model streaming, and GPU hardware provisioning.

威胁行为者经常启用各种托管式生成平台，并创建额外的 API 密钥来扩大其行动规模。在获取 LLM API 访问密钥后，UNC6993 试图生成更多 API 密钥，并在受害者的云项目中启用相关服务，短时间内累计产生了超过 10 万美元的账单费用。另一名威胁行为者让受害者账户订阅按需付费（Pay-As-You-Go）协议，选择高级基础模型并启动大规模推理流。为绕过速率限制，该威胁行为者采用“消耗并轮换”策略，不断创建和删除短期服务账号，同时审查云服务提供商的账单界面以监控财务影响。Threat actors frequently enabled a variety of managed generative platforms, and created additional API keys to scale their operations. Upon acquiring LLM API access keys, UNC6993 attempted to generate additional API keys and enable associated services within victim cloud projects, quickly accumulating over $100,000 USD in billing charges. Another threat actor subscribed victim accounts to Pay-As-You-Go agreements, selecting premium foundation models and launching high-volume inference streams. To bypass rate limits, the threat actor deployed a "burn and rotate" strategy, continuously creating and deleting short-lived service accounts while auditing the cloud provider’s billing interface to monitor financial impact.

威胁行为者还利用其访问权限托管自己的代理端点和智能体工作负载。例如，一名威胁行为者启用了智能体，部署了可公开访问的反向代理，并使用自定义 Node.js 代理套件，暴露了兼容多个前沿大语言模型的端点，并将其重新包装为一个名为 D1337-KAIROS 的角色。该行为者使用 Manus 智能体框架，在被入侵的云环境中部署了容器化后门。该后门会查询上游大语言模型，根据指令进行推理，并在本地执行由此生成的命令，同时借助 SearXNG 元搜索以及 agent-infra/sandbox 执行环境。为扩大计算能力，该威胁行为者配置了搭载强大 GPU 的计算实例，试图在多个区域启动高端硬件，并通过云服务提供商的 API 申请提高配额。该行为者还在外部服务器上托管 LiteLLM 网关，以管理和路由 API 流量。Threat actors also leveraged their access to host their own proxy endpoints and agentic workloads. For example, one threat actor enabled agents, deployed publicly accessible reverse proxies, and used custom Node.js proxy bundles to expose endpoints compatible with multiple frontier LLMs rebranded under a persona known as D1337-KAIROS. The actor deployed a containerized backdoor using the Manus agent framework to the compromised cloud environment, which queried an upstream LLM to reason through instructions and execute resulting commands locally, supported by SearXNG metasearch and agent-infra/sandbox execution environments. To scale compute, the threat actor provisioned compute instances with powerful GPUs, attempted to spin up high-end hardware across multiple regions, and requested quota increases via the cloud provider’s API. The actor also hosted LiteLLM gateways on external servers to manage and route API traffic.

GTIG 发现，有证据表明，威胁行为者并非仅将劫持的算力用于自身操作，而是通过 LLM 混合平台出售对这些资源的访问权限，以变现被盗用的 API 配额。威胁行为者利用开源 API 网关和定制中继基础设施汇集被盗凭证、计量使用量，并掩盖请求来源。例如，UNC6993 使用了 new-api（一个集中式模型枢纽和网关）和 gcli2api（一种可将命令行界面（CLI）工具转换为标准前沿模型端点的 API 代理工具）等开源工具，可能是为了汇总被盗密钥，并在多个账户间均衡分配请求负载。我们认为，该威胁行为者通过地下商店出售这些工具的访问权限。Rather than consuming hijacked compute solely for their own operations, GTIG observed evidence of threat actors monetizing compromised API quotas by selling access to these resources through LLM Mixers. The threat actors used open-source API gateways and custom relay infrastructure to pool stolen credentials, meter usage, and obscure the origin of the requests. For example, UNC6993 used open-source tools such as new-api (a centralized model hub and gateway) and gcli2api (an API proxy tool converting command line interface (CLI) tools into standard frontier model endpoints), likely to aggregate stolen keys and balance request loads across accounts. We believe the threat actor sells access to these tools via underground storefronts.

另一名威胁行为者在不到八小时内执行了超过 50 万次 LLM API 调用，并利用窃取的第三方 API 密钥为令牌路由服务 jet-night.com 提供支持。Jet Night 将近 100 万美元的令牌费用转嫁给了受害组织。鉴于 Jet Night 向用户收取的每令牌费用远低于市场通常水平，GTIG 认为该服务依靠窃取的密钥才能实现盈利。例如，Jet Night 提供每月约 60 美元的无限量令牌套餐，并声称可访问前沿模型；同等的消费者服务通常每月收费 100 至 250 美元。此外，该服务曾在其公开的 Telegram 频道上多次发布服务中断公告，这很可能是因为受害者发现各自遭到入侵后，窃取的密钥被撤销。Another threat actor that executed more than 500,000 LLM API calls in less than eight hours leveraged stolen third-party API keys to power the token routing service jet-night.com. Jet Night passed nearly one million dollars in token costs to the victim organization. Given Jet Night’s per-token costs to users are so far below typical market rates GTIG believes the service relies on stolen keys to operate profitably. For example, Jet Night offers an unlimited token plan for approximately $60 USD per month with alleged access to frontier models, a consumer service level that would typically run between $100 and $250 per month. Moreover, the service has advertised multiple outages on its public Telegram channel which is likely due to stolen keys being revoked as victims discover their respective compromises.

威胁行为者部署了定制代理中继基础设施（ai-relay），托管在具有欺骗性的仿冒域名上。例如，他们注册了一个域名，伪装成受害者合法的内部主机。这套定制中继基础设施被用于将高价值的商业 LLM 访问权限无缝转售到非法的 newapi[.]pro 生态中，直接消耗受害者企业账户的配额，为其地下客户提供服务。A threat actor deployed custom proxy relay infrastructure (ai-relay) hosted on deceptive lookalike domains. For example, they registered a domain to masquerade as the victim's legitimate internal host. This custom relay infrastructure was used to seamlessly siphon high-value commercial LLM access into the illicit newapi[.]pro resale ecosystem, directly draining the victim's corporate account quotas to serve their underground customers.

OutlookOutlook

GTIG 预计，受新兴地下 LLM 混合器带来的即时、高利润变现能力驱动，威胁行为者将越来越多地优先选择 LLM 劫持，而非加密货币挖矿劫持等传统资源盗窃手段。随着企业将更高等级的模型和智能体工作流整合到生产环境中，网络犯罪分子很可能会改进自动化侦察手段，瞄准暴露的 API 令牌，并利用模型路由中间件中的漏洞。这种业务上的专业化将推动非法转售市场不断扩大，使威胁行为者能够迅速盗用企业配额，并在入侵行为被发现之前将账单费用转嫁给受害者。GTIG expects that threat actors will increasingly prioritize LLMJacking over traditional resource theft like cryptojacking, driven by the immediate, high-margin monetization enabled by emerging underground LLM Mixers. As enterprises integrate higher-tier models and agentic workflows into production environments, cybercriminals will likely refine automated reconnaissance to target exposed API tokens and exploit vulnerabilities in model routing middleware. This operational specialization will sustain a growing illicit resale marketplace, allowing threat actors to rapidly siphon enterprise quotas while passing the billing costs to victims before compromises are detected.

检测与威胁搜寻Detection and Hunting

如果安全措施失效，防御人员必须能够及早发现云端 LLM 平台遭到滥用。防御人员应优先检测对 LLM 账户和服务的更改，并将任何未经授权的启用行为视为重大安全事件。在 Mandiant 调查的多起事件中，系统遭入侵时，LLM 服务尚未启用。威胁行为者利用访问密钥滥用权限，修改并启用了 LLM API 服务（例如 Bedrock、Gemini API 等）。服务启用后，威胁行为者只需几分钟或几小时，就能利用这些 API 为组织产生巨额账单。In the event that security measures have failed, it is critical that defenders have early visibility into abuse of cloud LLM platforms. Defenders should prioritize detection of modifications to LLM accounts and services and treat any unauthorized enablement as a critical security event. In multiple incidents that Mandiant investigated, LLM services were not enabled at the time of compromise. Abuse of access keys allowed the threat actor to modify and enable LLM API services (e.g. Bedrock, Gemini API, etc.). Once enabled, the threat actor can use the APIs to generate massive bills to the organization in just minutes or hours. 

Google 安全运营Google Security Operations

Google Security Operations 客户可以在 Cloud Threats、Mandiant Frontline Threats 和 Mandiant Hunting Rules 规则包中使用这些涵盖广泛类别的规则及更多内容。博客文章中讨论的活动在 Google SecOps 中由以下规则名称检测：Google Security Operations customers have access to these broad category rules and more under the Cloud Threats, Mandiant Frontline Threats, Mandiant Hunting Rules rule packs. The activity discussed in the blog post is detected in Google SecOps under the rule names:

• 创建 AWS 账户密钥

  AWS Account Key Creation

• AWS 创建新的访问密钥

  AWS Create New Access Key

• AWS 创建用户账户

  AWS Create User Account

• AWS 删除用户账户

  AWS Delete User Account

• Base64 编码的 Shell 命令执行

  Base64 Encoded Shell Command Execution

• 在默认网络中创建和删除防火墙

  Create and Delete Firewall in Default Network

• GCE 项目 SSH 密钥

  GCE Project SSH Keys

• 创建 GCP 服务账号密钥

  GCP Service Account Key Creation

• GCP 创建新服务账号

  GCP Create New Service Account

• 已创建 GCP 防火墙规则

  GCP Firewall Rule Created

• 通过 Curl 或 Wget 从 Linux 系统外传归档文件

  Linux Archive Exfiltration via Curl or Wget

• 持久化：通过设置计算实例或项目元数据中的启动脚本或 URL

  Persistence: Compute Set Instance or Project Metadata Startup Scripts or URLs

缓解与修复Mitigation and Remediation

为防止攻击者滥用云端 LLM 服务，防御者应优先关注身份与访问管理（IAM）和供应链安全，因为这两者是获取云服务访问权限并加以滥用的最常见途径。To prevent attackers from abusing Cloud LLM services, defenders should prioritize Identity and Access Management (IAM) and supply chain security, two of the most common pathways for gaining access to and abusing Cloud services. 

• 凭据卫生：利用集中式机密管理平台来控制敏感密钥和机密的管理与轮换。自动化管理机密和密钥，可以缩短泄露凭据的有效期。

  Credential Hygiene: Utilize a centralized secrets management platform to control the management and rotation of sensitive keys and secrets. Automation of secrets and keys can limit the lifespan of leaked credentials. 

• 最小权限原则：确保用户和服务账户仅拥有其特定角色及所需任务必需的权限。拒绝所有未明确要求的权限，包括访问云端 LLM 服务的权限。

  Least Privilege: Ensure users and service accounts only possess the permissions necessary for their specific role and required tasks. Deny all permissions that are not explicitly required, including access to Cloud LLM services. 

• 代码监控：在代码库（GitHub、GitLab 等）中自动扫描机密信息，确保及时发现并移除添加到源代码中的 API 密钥和机密信息。

  Code Monitoring: Automate secret scanning within codebases (GitHub, Gitlab, etc.) to ensure API keys and secrets added to source code are identified and removed promptly. 

• 常规配置审计：定期对云服务进行全面的配置审计，以识别潜在的攻击路径和端点的意外暴露。

  Routine Configuration Audits: Perform periodic comprehensive configuration audits of Cloud services to identify potential attack paths and unintended exposure of endpoints. 

• 速率限制：实施类似 Google Cloud Armor 的 WAF，为各个客户端连接强制实施速率限制。

  Rate Limiting: Implement a WAF like Google’s Cloud Armor to enforce rate limiting for individual client connections.

• 网络允许列表：在可行的情况下，通过 VPC 防火墙规则将云服务的出站连接限制为已知 IP 地址。

  Network Allow Listing: Restrict outbound connections from Cloud services via VPC firewall rules to known IP addresses where feasible.

• 预算预警：在 LLM 服务上实施细粒度的 API 配额，限制每个模型的请求量。使用支出上限设置预算，避免超支。

  Budget Alerts: Implement granular API quotas on LLM services to limit request volume per model. Utilize spending caps to set budgets and avoid over-spending.

• 多因素身份验证（MFA）：在所有云身份提供商、管理控制台和开发者平台上强制实施防钓鱼的多因素身份验证，确保被盗凭据或会话令牌不会轻易遭到利用。

  Multi-Factor Authentication (MFA): Enforce phishing-resistant multi-factor authentication across all cloud identity providers, management consoles, and developer platforms to ensure that stolen credentials or session tokens cannot be easily exploited.

• 影子 LLM 发现：利用安全态势管理工具自动扫描混合云环境，识别未经授权或未受监控的工具、模型和基础设施，确保全面掌握模型部署情况。

  Shadow LLM Discovery: Utilize Security Posture Management tools to automatically scan your hybrid cloud environments and identify unauthorized or unmonitored tools, models, and infrastructure, ensuring complete visibility of your model footprint.

• 细粒度 API 密钥权限范围：按特定模型端点、环境（开发/生产）和使用限额限制并划分 API 密钥，确保基础实用模型的令牌即使遭到泄露，也无法被用于调用昂贵的高端前沿模型。

  Granular API Key Scopes: Restrict and segment API keys by specific model endpoints, environments (dev/prod), and usage limits to ensure a compromised token for a basic utility model cannot be used to invoke expensive, high-tier frontier models.

• 验证扫描监控：监控模型网关和 API 访问日志，排查异常的低流量请求（例如 max_tokens=1 或 temperature 为零的探测请求）。攻击者经常利用这类微型事务，在大规模滥用基础设施之前，悄悄进行凭据验证扫描。

  Validation Sweep Monitoring: Monitor model gateway and API access logs for anomalous, low-volume requests (such as max_tokens=1 or zero-temperature pings). Attackers frequently use these micro-transactions for stealthy credential validation sweeps prior to launching large-scale infrastructure abuse.

• 漏洞与机器学习供应链补丁管理：在定制应用代码、容器化工作负载以及机器学习依赖项（如 PyTorch 和 Hugging Face 库）中集成自动化漏洞扫描（SAST/DAST/SCA），以防止攻击者利用未修补的服务器漏洞获取初始访问权限。

  Vulnerability & ML Supply Chain Patching: Integrate automated vulnerability scanning (SAST/DAST/SCA) across your custom application code, containerized workloads, and machine learning dependencies (like PyTorch and Hugging Face libraries) to prevent initial access via unpatched server vulnerabilities.

• 网关补丁管理：扩展漏洞管理计划，将集中式模型代理和路由网关（例如 LiteLLM）纳入其中，确保针对权限提升和身份验证绕过漏洞（如 CVE-2026-40217）及时打补丁。

  Gateway Patch Management: Extend vulnerability management programs to include centralized model proxy and routing  gateways (e.g., LiteLLM), ensuring rapid patching against privilege escalation and authentication bypass flaws (such as CVE-2026-40217).

• 动态工作负载的沙箱化执行：如果你的 LLM 应用需要动态执行生成的代码或数据库查询，请在高度虚拟化且经过进程隔离的无服务器沙箱中隔离运行时环境。

  Sandboxed Execution for Dynamic Workloads: Isolate the runtime environment in highly virtualized, process-isolated, serverless sandboxes if your LLM application is required to execute generated code or database queries dynamically.

• 经审核的模型仓库：限制并确保模型拉取和流水线依赖项只能来自可信的内部注册表或经批准的企业目录，以防止开发人员拉取含有预置后门的受损模型。

  Vetted Model Repositories: Restrict and enforce model pulls and pipeline dependencies solely from trusted internal registries or approved enterprise catalogs to prevent developers from pulling compromised models containing pre-configured backdoors.

• 基于图的暴露面建模：实施持续的图谱风险优先级排序，将云资产、应用程序代码和数据流关联起来，以自动识别并修复复杂的多跳攻击路径。

  Graph-Based Exposure Modeling: Implement continuous, graph-based risk prioritization that maps cloud assets, application code, and data flows to automatically identify and remediate complex, multi-hop attack paths.

• 对抗性暴露验证：部署自动化攻击代理，持续测试外部攻击面、发现暴露的端点，并模拟凭据验证扫描。

  Adversarial Exposure Validation: Deploy automated offensive agents to continuously test external attack surfaces, uncover exposed endpoints, and simulate credential validation sweeps.

监控原生云审计日志Monitoring Native Cloud Audit Logs 

• AWS：监控 CloudTrail 日志中来自 bedrock.amazonaws.com 的 API 事件。根据以往的 LLM 劫持事件，在整个攻击生命周期内监控以下 API 操作：

  AWS: Monitor CloudTrail logs for API events from bedrock.amazonaws.com. Based on historical LLM Jacking incidents, monitor for the following API operations across the attack lifecycle:

• 资源滥用：监控通过 Converse、InvokeModel 和 InvokeModelWithResponseStream API 操作直接执行 LLM 的情况。

  Resource Exploitation: Monitor for direct execution of the LLM via the Converse, InvokeModel, and InvokeModelWithResponseStream API operations.

• API 限流与错误激增：监控 ThrottlingException、ValidationException 或 ResourceNotFoundException 错误是否出现大量激增，这可能表明有人正采用自动化“喷洒”方法，针对云基础设施发起攻击。

  API Throttling & Error Spikes: Monitor for high-volume spikes in ThrottlingException, ValidationException, or ResourceNotFoundException errors, which could indicate an automated “spraying” methodology targeting cloud infrastructure.

• 目标范围界定：监控可能用于通过 ListFoundationModels、ListInferenceProfiles 和 GetFoundationModelAvailability 操作发现可用模型的侦察活动。此外，监控通过 PutUseCaseForModelAccess 和 CreateFoundationModelAgreement API 操作尝试解锁环境中新模型的行为。

  Target Scoping: Monitor potential reconnaissance activity used to discover available models via the ListFoundationModels,ListInferenceProfiles, and GetFoundationModelAvailability operations. Additionally, monitor for attempts to unlock new models in the environment via the PutUseCaseForModelAccess and CreateFoundationModelAgreement API operations.

• 安全/规避：审查查看、修改或禁用日志记录配置的尝试，以隐藏提示内容并逃避检测。监控 GetModelInvocationLoggingConfiguration 操作，以及 PutModelInvocationLoggingConfiguration 和 DeleteModelInvocationLoggingConfiguration。非 IaC（基础设施即代码）主体发起的任何禁用日志记录的调用都应视为高严重性事件。

  Security/Evasion: Review attempts to view, alter, or disable logging configurations to conceal prompt contents and avoid detection. Monitor the GetModelInvocationLoggingConfiguration operation, as well as PutModelInvocationLoggingConfiguration and DeleteModelInvocationLoggingConfiguration. Any calls to disable logging by non-IaC (Infrastructure as Code) principals should be treated as high severity.

自动化工具：分析 User-Agent 字符串，以识别直接与目标云基础设施交互的自动化工具和 SDK（例如 claude-cli、aws-sdk-rust 和 aws-sdk-go-v2）。Automated Tooling: Analyze User-Agent strings to identify automated tools and SDKs (e.g., claude-cli, aws-sdk-rust, and aws-sdk-go-v2) interacting directly with the target cloud infrastructure.

• Azure：监控 Azure 活动日志（控制平面）和诊断日志（数据平面）中与 Microsoft.CognitiveServices 命名空间相关的事件。为搜寻或检测 LLM 劫持事件，请监控以下操作：

  Azure: Monitor Azure Activity Logs (Control Plane) and Diagnostic Logs (Data Plane) for events associated with the Microsoft.CognitiveServices namespace. To hunt for or detect LLM Jacking incidents, monitor the following operations:

• 资源滥用：监控对 LLM 的直接调用。在 Azure 中，模型调用发生在数据平面，需要启用诊断日志。留意发往 Completions 或 Chat Completions 等推理端点的大量 POST 请求。在管理平面（活动日志）上，监控是否有人通过 Microsoft.CognitiveServices/accounts/deployments/write 操作未经授权地创建新实例。

  Resource Exploitation: Monitor for direct execution of the LLM. In Azure, model invocations occur on the data plane and require Diagnostic Logs to be enabled. Look for high volumes of POST requests to inference endpoints such as Completions or Chat Completions APIs. On the management plane (Activity Logs), monitor for unauthorized creation of new instances via the Microsoft.CognitiveServices/accounts/deployments/write operation.

• 目标范围界定：监控潜在的侦察活动，通过 Microsoft.CognitiveServices/accounts/read 和 Microsoft.CognitiveServices/accounts/deployments/read 操作发现可用的 Azure LLM 资源、模型和部署。

  Target Scoping: Monitor potential reconnaissance activity to discover available Azure LLM resources, models, and deployments via the Microsoft.CognitiveServices/accounts/read and Microsoft.CognitiveServices/accounts/deployments/read operations.

• 安全/规避：检查是否尝试通过 Microsoft.Insights/diagnosticSettings/read、Microsoft.Insights/diagnosticSettings/write 或 Microsoft.Insights/diagnosticSettings/delete 操作查看或修改日志记录配置（以确认是否正在记录数据平面模型调用）。

  Security/Evasion: Review attempts to view or modify logging configurations (to see if data plane model invocations are being recorded) via the Microsoft.Insights/diagnosticSettings/read, Microsoft.Insights/diagnosticSettings/write, or Microsoft.Insights/diagnosticSettings/delete operations.

• GCP：监控 Cloud Audit Logging 中对 Gemini Enterprise Agent Platform 端点（aiplatform.googleapis.com）的调用。Gemini Enterprise Agent Platform 的推理操作记录在 Data Access 日志中；由于日志量和摄取成本较高，这些日志默认处于禁用状态。必须手动配置 IAM 审计策略来跟踪这些操作。

  GCP: Monitor Cloud Audit Logging for calls to Gemini Enterprise Agent Platform endpoints (aiplatform.googleapis.com). Gemini Enterprise Agent Platform inference operations are contained within Data Access logs, which are disabled by default due to volume and ingestion costs. You must manually configure your IAM audit policies to track these.

• Agent Platform 服务启用：通过 google.api.serviceusage.v1.ServiceUsage.EnableService 方法启用 Gemini Enterprise Agent Platform 服务时发出警报。

  Enablement of Agent Platform Services: Alert on enablement of Gemini Enterprise Agent Platform services via the google.api.serviceusage.v1.ServiceUsage.EnableService method.

• 资源利用：监控通过 Gemini Enterprise Agent Platform 直接执行 LLM 的情况，这需要启用 Data Access 审计日志记录。查找 google.cloud.aiplatform.v1.PredictionService.Predict、google.cloud.aiplatform.v1.PredictionService.GenerateContent 和 google.cloud.aiplatform.v1.PredictionService.StreamGenerateContent 操作。

  Resource Exploitation: Monitor for direct execution of the LLM via Gemini Enterprise Agent Platform, which requires Data Access audit logging to be enabled. Look for google.cloud.aiplatform.v1.PredictionService.Predict, google.cloud.aiplatform.v1.PredictionService.GenerateContent, and google.cloud.aiplatform.v1.PredictionService.StreamGenerateContent operations.

• 目标范围界定：监控可能的侦察活动，通过 google.cloud.aiplatform.v1.ModelService.ListModels、google.cloud.aiplatform.v1.EndpointService.ListEndpoints 和 google.cloud.aiplatform.v1.PublisherModelService.ListPublisherModels API 操作发现可用的模型和端点。

  Target Scoping: Monitor potential reconnaissance activity to discover available models and endpoints via the google.cloud.aiplatform.v1.ModelService.ListModels, google.cloud.aiplatform.v1.EndpointService.ListEndpoints, and google.cloud.aiplatform.v1.PublisherModelService.ListPublisherModels API operations.

• 安全/规避：审查查看或更改日志记录和审计配置的尝试。监控诸如 google.iam.v1.IAMPolicy.GetIamPolicy（用于检查项目/资源是否启用了数据访问日志）之类的操作，或通过 google.logging.v2.ConfigServiceV2.ListSinks 和 google.logging.v2.ConfigServiceV2.GetSink 查看日志导出的尝试。

  Security/Evasion: Review attempts to view or alter logging and audit configurations. Monitor for operations like google.iam.v1.IAMPolicy.GetIamPolicy (to check if Data Access logs are enabled on the project/resource) or attempts to review log exports via google.logging.v2.ConfigServiceV2.ListSinks and google.logging.v2.ConfigServiceV2.GetSink.

失陷指标（IOC）Indicators of Compromise (IOCs)

为了帮助更广泛的社区搜寻并识别这篇博文中概述的活动，我们已在 GTI Collection 中为注册用户提供了入侵指标（IOC）。To assist the wider community in hunting and identifying activity outlined in this blog post, we have included indicators of compromise (IOCs) in a GTI Collection for registered users.

网络指标Network Indicators

表 1：网络指标Table 1: Network Indicators