Thieves use stolen company AI access for $100,000 a day
Google says victims paid $1 million before they cut off the thieves.
The incident team of Mandiant reported on Monday. Criminals steal company access to large language models and make the company pay. The charges can be more than $100,000 a day. At some victims, the total reached $1 million before the company revoked the access of the intruders. Google calls the crime LLMJacking. It says the crime grows for 2 years.
How it works
A group that Google tracks as UNC6993 got keys for a model through an incorrect cloud account key. It then made more keys and turned on services in the cloud projects of the victim. A different thief put victim accounts on pay-as-you-go plans. The thief made and deleted short-lived accounts to prevent rate limits (limits on use).
The numbers
One intruder made more than 500,000 calls with stolen keys. The calls supplied Jet Night, a service that sells AI tokens. It offers an unlimited plan for about $60 a month. Google says such a plan usually costs $100 to $250, and it believes Jet Night uses stolen keys.
What is not known
The report gives no count of victims or of total losses. Google predicts that criminals will more frequently select LLMJacking than other crimes that use stolen computers, such as cryptojacking (use of a stolen computer to mine coins).
Insight: Stolen AI keys now feed a resale market
Wiz reported that 9 AI developer platforms had breaches in October, and that attackers went for keys. One key made 1.7 million calls. Jet Night sells access far below the market price. This reads as a supply chain: breached platforms supply keys, resellers sell the access, and the victim pays the bill. For leaders, the bill can be the first sign of a breach.
Sources
Posted
