X-Industry

Generative AI is quickly becoming one of the more lucrative uses for stolen cloud credentials.  Attackers no longer need to set up crypto miners or exfiltrate data to cash in on a leaked IAM key.  They can instead subscribe to foundation models through AWS Marketplace and resell inference access, a technique called LLMjacking, first documented in 2024.  FortiCNAPP recently investigated a case that shows how fast and mechanical that pivot has become.[1]

FortiGuard Labs recently analyzed a long-lived AWS IAM access key with administrator privileges that was used to create a new IAM identity, subscribe it to foundation models on AWS Marketplace, and begin invoking them.

FortiCNAPP provides coverage against attacks like this through a combination of detections and LQL policies that span the identity compromise, credential issuance, and marketplace activity involved in such a chain.

LLMjacking: Attackers Want Your Model Access, Not Your Data

LLMjacking refers to the theft and abuse of access to hosted AI models, rather than the theft of model weights or training data. The attacker's objective is simple: get another organization's cloud account to pay for expensive, high-capability model inference, then either use that access directly or resell it.

It's attractive for a few structural reasons:

Low tooling cost, high monetization.  The only prerequisite is a working cloud identity, typically a leaked access key, an exposed CI/CD secret, or a stolen local credential.

Fast time-to-abuse.  Once a cloud credential is exposed, attackers move in minutes, not days.

Real money, fast.  Premium foundation-model invocation is not cheap at scale.  LLMjacking research puts victim exposure at over $46,000 per day for a Claude 2.x-class inference and past $100,000 per day once attackers move to Claude 3 Opus.  Some campaigns resell stolen access as a subscription "AI chatbot" service to third parties who have no idea the underlying compute is stolen, turning a single leaked key into recurring revenue.

It hides in plain sight.  A Bedrock InvokeModel call from a compromised-but-valid IAM identity is, at the API level, indistinguishable from legitimate use.  It is simply a cloud API used exactly as designed, with credentials that technically have permission to use it.

The market has matured.  What began as opportunistic credential theft has evolved into a commercial supply chain.  "Operation Bizarre Bazaar" cataloged more than 35,000 attack sessions and a marketplace reselling access to 30-plus LLM providers on Telegram and Discord.  This is no longer opportunistic.  It has been commoditized.

The Compromise Fortinet Observed:

Figure 1: Sequence of events in the compromise

An AWS account was compromised due to a leaked long-lived IAM access key with AdministratorAccess permissions.  Using that access, the operator:

Created a new IAM user.

Subscribed to one or more foundation models through AWS Marketplace (CreateAgreementRequest/AcceptAgreementRequest on agreement-marketplace.amazonaws.com).

Invoked the subscribed foundation model(s), generating inference charges against the victim account.

This class of attack typically includes an additional step to generate Bedrock service-specific credentials for the new identity via AWS's long-term API key mechanism.  This is distinct from a standard IAM access key, as an alternative or to supplement invocations directly through the new user.

Recommendations for Defenders - Because LLMjacking uses valid credentials and legitimate cloud services, effective prevention and detection demand strong identity verification, thorough logging, and contextual analysis.  The practices outlined below can assist organizations in minimizing their risk and spotting suspicious Bedrock activity more efficiently.

Enable CloudTrail on every account.  It's what turns a suspicious signal into a full picture: who created the identity, what credentials it issued, what it subscribed to, and in what order.

Turn on Bedrock invocation logging in addition to CloudTrail, where feasible.  It's off by default and captures request-level details that CloudTrail alone won't capture.

Treat long-lived, broad-scope IAM keys as tier-0 risk.  The entire chain in this incident depended on a single AdministratorAccess key that never expires.  Prefer short-lived, role-assumed credentials wherever workloads allow it.

Don't assume "new AI service usage" is always benign or always malicious.  The right posture is corroboration.  First-time Bedrock use in an account is only actionable when paired with a second signal, such as a new identity, an unfamiliar IP, enumeration behavior, or access-denied noise, not on its own.

This article is shared at no charge for educational and informational purposes only.

Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization.  We provide indicators of compromise information (CTI) via a notification service (RedXray) or an analysis service (CTAC).  For questions, comments or assistance, please contact the office directly at 1-844-492-7225, or feedback@redskyalliance.com    

Weekly Cyber Intelligence Briefings:

• Reporting: https://www.redskyalliance.org/
• Website: https://www.redskyalliance.com/
• LinkedIn: https://www.linkedin.com/company/64265941 

Weekly Cyber Intelligence Briefings:

REDSHORTS - Weekly Cyber Intelligence Briefings

https://register.gotowebinar.com/register/5207428251321676122

[1] https://www.fortinet.com/blog/threat-research/someone-else-is-using-your-ai?lctg=141970831