Blog

Cybercriminals are hijacking corporate access to large language models across the Asia-Pacific region, driving unauthorized cloud billing charges past USD $100,000 in a single day. The findings, released this week by Mandiant and the Google Threat Intelligence Group, revealed that victims spanned retail, financial services, transportation and technology across Asia Pacific, North America and South America.

For some targets, aggregate billing reached almost USD $1 million before administrators discovered the breach and revoked access keys. The financial damage mounts much faster than conventional cryptojacking, which typically drains server capacity at a slow, continuous pace. In one investigated incident, attackers executed more than 500,000 API calls against advanced language models in less than eight hours.

How Attackers Breach Cloud Accounts

Intruders frequently exploit credentials leaked inside public GitHub code repositories or harvest access through compromised browser sessions and stolen identity tokens. In several documented breaches, the targeted companies had never activated machine learning or model features within their cloud accounts. Attackers simply logged into dormant environments, turned on the services themselves and began issuing high-volume automated requests.

A threat group tracked as UNC6993 gained access to corporate systems in mid-2026 by exploiting a misconfigured service account key. The group also operated a fake web portal that prompted internal users to submit active session tokens alongside JSON payloads, allowing attackers to slip past multi-factor authentication checks and passwords entirely. Another cluster extracted API keys from public repositories and tested them using single-token queries to avoid tripping intrusion detection systems.

Once inside a tenant, attackers escalated system privileges to secure their hold. Intruders created administrative backdoor accounts masked as legitimate billing optimization utilities and injected unauthorized SSH keys into corporate compute instances. Some attackers exploited vulnerability CVE-2026-40217 in the open-source LiteLLM gateway, elevating basic virtual keys into full administrative proxy permissions.

Illicit Resale Through Discount Gateways

Stolen model capacity feeds an organized underground market where criminal syndicates divide tasks between network infiltration and wholesale resale. Broker networks bundle compromised corporate keys into centralized routing proxies known as LLM Mixers. These illicit hubs rely on open-source utilities like new-api and gcli2api to manage traffic distribution.

One illicit routing platform, operating under the name Jet Night, transferred nearly USD $1 million in artificial intelligence compute charges onto a single victim company. Jet Night resold unlimited model access to paying underworld customers for approximately USD $60 a month, undercutting legitimate commercial plans that cost between USD $100 and USD $250. Service interruptions announced on underground messaging channels like Telegram directly matched instances where breached corporate victims detected anomalies and cancelled their compromised access credentials.

Other attackers expanded their operations by provisioning high-end graphics processing unit clusters across multiple cloud regions. Intruders submitted administrative requests for higher computing quotas, deploying persistent backdoors based on the Manus agent framework to automate operations at corporate expense.

The Real Cost for Regional Retail Operators

For Asia-Pacific retailers racing to deploy automated customer service bots, inventory forecasting and algorithmic pricing engines, the findings alter cloud risk calculations. Regional retail groups have rushed to integrate machine learning endpoints into e-commerce storefronts without auditing legacy cloud consoles or default cloud permissions. A compromised key can trigger hundreds of thousands of dollars in operational liabilities before month-end accounting reconciliation notices the discrepancy.

The threat extends well beyond unexpected invoices. When criminal syndicates route unvetted third-party traffic through corporate model instances, retail operators face potential regulatory and data exposure liabilities across regional jurisdictions. Security teams must now treat unexpected cloud API activations as urgent containment priorities rather than routine billing errors.

Containment Measures and What to Watch

Defensive guidelines published in the investigation urge companies to monitor code repositories for exposed tokens, audit cloud consoles for unapproved model services, and enforce strict spending caps. Organizations should configure model-level rate limits and mandate hardware-backed, phishing-resistant multi-factor authentication across developer systems.

Whenever possible, threat actors want to use this technology to gain a scale advantage over defenders. They achieve that with agentic tools and by stealing tokens from unwitting third parties. Locking down these resources will not only protect organizations from runaway costs, but also protect the broader community from a deluge of cheap, autonomous attacks.

John Hultquist, Chief Analyst at the Google Threat Intelligence Group, noted that companies must aggressively control access to the computing resources they are bringing online to stop external actors from exploiting corporate budgets. Cloud providers and enterprise clients are now monitoring whether upcoming security updates for tools like LiteLLM and automated API spending hard caps will curb unauthorized token abuse before enterprise cloud budgets reset for the next fiscal quarter.