Mandiant

LLM jacking comes with a high price tag.

Google's Threat Intelligence Group and Mandiant issued a report warning about the high cost of so-called LLM jacking, where attackers obtain API keys to gain unauthorized access to LLM accounts.

Google said charges for these attacks can scale quickly, with resource consumption exceeding $100,000 in a single day and some organizations receiving bills up to $1 million before access was revoked.

Google observed one threat actor creating additional API keys after gaining initial access to scale out operations within cloud projects, further increasing billing charges.

Um, It's from Google.

It's Mandiant's report.

This Mtrends report's another absolute heater.

That one's a good one.

But, but that general dude,

LLM jacking comes with a high price tag.

Google's threat intelligence group and Mandiant issued a report warning about the high cost of so-called LLM jacking, where attackers obtained API keys to gain unauthorized access to LLM accounts.

Google said charges for these attacks can scale quickly, with resource consumption exceeding $100,000 in a single day and some organizations receiving bills up to a million dollars before access was revoked.

We'll move to another story with stolen credentials, but in a different way to cache them.

Google's threat intelligence group in Mandiant say LLM jacking, the hijacking of enterprise access to large language models.

is accelerating, with some victims absorbing more than $100,000 in fraudulent charges in a single day and cumulative bills reaching a million dollars.

The model itself works like this.

Fletcher is the co-founder and CEO of ArcLink.

He previously served as director of research at BeyondTrust, leading research across AI, cloud, and identity security, and was principal red teamer at CrowdStrike and Mandiant, conducting sophisticated adversary emulation operations against Fortune 500 enterprises.

Having operated on both sides of enterprise defense, he brings a unique operational perspective to today's crisis.

I hope you enjoy this episode of The Looking Glass.

Many of the recent attacks involve social engineering, as I said before, but this would involve exploiting a software vulnerability and a software called Oracle PeopleSoft.

What PeopleSoft is, it's really an enterprise software that is used for things like HR and payroll, employee management.

In the FBI's particular case, from what I read online, it was associated with the online recruitment system, FBIjobs.gov. And so earlier in the year, actually, before the FBI breach, Google's Mandiant had actually documented the Chinese hunters exploiting this critical vulnerability multiple times.

Oracle actually released a patch, but according to the FBI's investigation, the third-party contractor responsible for managing the PeopleSoft solution did not and failed to apply the necessary security update.

Steal a company's access and stick it with the bill.

Google's Mandiant investigators say fraudulent AI usage can exceed $100,000 a day.

Some victimized organizations accumulated over a million dollars in unauthorized charges before noticing the compromised keys and shutting them down, the Register reports.

The scam is called LLM jacking.

And they said, there was only three of us that were really doing it the way that we were.

And Mandiant was one, the company that Google bought.

And another one became part of Booz Allen.

And so we were the three doing this, what I was describing before of looking at the traffic and making blocking actions.