- Attackers compromised a LiteLLM Proxy AI gateway connected to Amazon Bedrock and installed XMRig cryptocurrency mining software.
- Researchers believe an internet exposed SSH service allowed attackers to gain access through a likely brute force attack.
- Suspicious AWS IAM activity suggested possible attempts to enumerate Bedrock models and create new user accounts.
- Security experts recommend restricting remote access, enforcing least privilege permissions, and monitoring cloud environments for unusual activity.
Cloud security researchers have uncovered a fresh example of how attackers are adapting older cybercrime tactics to modern AI infrastructure. Instead of targeting traditional servers or personal computers, threat actors compromised an AI gateway connected to Amazon Bedrock and used it to secretly mine cryptocurrency.
The incident highlights an emerging security challenge for organizations deploying generative AI services. As AI gateways become central access points for multiple large language models, they also become attractive targets for attackers looking to exploit cloud resources or gain access to privileged environments.
According to researchers at Darktrace, the compromised system was running LiteLLM Proxy on an Amazon EC2 instance. After gaining access, the attackers installed cryptocurrency mining software and carried out additional activities that suggested they may also have been exploring opportunities to expand their access within the victim’s AWS environment.
Poorly secured remote access appears to have opened the door
Darktrace believes the attackers most likely gained access through a brute force attack against an exposed Secure Shell (SSH) service. The EC2 instance had been configured to accept SSH connections from anywhere on the internet, making it significantly easier for attackers to repeatedly attempt login credentials until they succeeded.
Once inside the system, the attackers wasted little time. They downloaded XMRig, one of the most widely used cryptocurrency mining applications, and began using the compromised cloud instance to generate digital currency.
The mining operation quickly produced a recognizable pattern of encrypted outbound connections to a cryptocurrency mining pool. These unusual communications triggered Darktrace’s monitoring systems, allowing researchers to identify the compromise shortly after the malicious activity began.
Although cryptomining attacks are far from new, their appearance inside AI infrastructure reflects how cybercriminals continue to shift toward high value cloud environments where computing resources are plentiful and often expensive.
Suspicious AWS activity raised additional concerns
The investigation did not stop with the cryptomining operation.
Researchers also observed unusual behavior involving an AWS Identity and Access Management user account. The account began issuing commands that had never been seen before in the affected environment.
Among the actions recorded were attempts to enumerate available Amazon Bedrock foundation models and invoke those models directly. Investigators also noticed efforts to create a new IAM user account, an activity that often raises concern because it can be used to establish long term access after an initial compromise.
Darktrace noted that there was not enough evidence to definitively connect the IAM activity with the earlier compromise of the AI gateway. However, the timing and nature of the commands suggest that the attackers may have been attempting to misuse cloud credentials or explore additional ways to expand their access within the AWS environment.
Another point that attracted attention was the source of the IAM activity. The associated IP address traced back to Vietnam. While geographic origin alone does not prove attribution, researchers included the information as part of the broader investigation into the suspicious behavior.
AI gateways are becoming attractive targets for attackers
AI gateways have become increasingly popular because they provide a single point through which users and applications can access multiple AI models. They simplify authentication, monitoring, routing, and usage management across different large language models.
However, that convenience also creates risk.
Because AI gateways often hold privileged credentials and connect directly to valuable AI services, a successful compromise can give attackers access to multiple resources through a single entry point. That makes them especially appealing targets for cybercriminals seeking computing power, sensitive data, or broader cloud access.
Security experts say organizations should view AI gateways with the same level of protection as other critical infrastructure components. Leaving management services exposed to the public internet significantly increases the likelihood of unauthorized access.
To reduce the attack surface, organizations should restrict remote management ports, implement strong authentication controls, assign only the minimum permissions necessary through IAM roles, and closely monitor cloud control plane activity for unexpected changes.
Continuous monitoring can also help security teams identify unusual behavior early, whether it involves unauthorized cryptocurrency mining, suspicious API calls, or attempts to create new privileged accounts.
While this incident primarily involved cryptomining, researchers caution that the same type of compromise could potentially be used for more damaging attacks in the future. As businesses continue integrating AI services into production environments, protecting the infrastructure that connects those services is becoming just as important as securing the AI models themselves.
Follow TechBSB For More Updates
