LLMjacking: Exploiting AWS Keys for AI Model Access

Cybersecurity experts have uncovered a new vector of attack known as LLMjacking, which involves exploiting leaked AWS credentials to gain unauthorized access to high-value AI models. This method allows attackers to rapidly convert a compromised identity management key into a profitable tool by subscribing to premium AI services.

Understanding the LLMjacking Technique

Researchers at FortiGuard Labs identified this breach as originating from an AWS Identity and Access Management (IAM) key with AdministratorAccess privileges. Once attackers acquired this key, they quickly established a new IAM user within the victim’s account to access AI models available on the AWS Marketplace. By executing CreateAgreementRequest and AcceptAgreementRequest, they secured subscriptions to these models.

This unauthorized access enabled the attackers to initiate model inference operations, subsequently billing the legitimate account holder. Additionally, they generated API keys specific to the AWS Bedrock service, providing an alternative method to exploit the system, thus evading detection.

Economic Implications of LLMjacking

The LLMjacking approach differs from traditional cloud abuses like cryptomining. Instead of extracting data, attackers monetize the victim’s billing relationship with the cloud provider. Premium AI models, such as Claude 2.x, can cost victims upwards of $46,000 daily, and this number can exceed $100,000 when escalating to even more advanced models like Claude 3 Opus.

FortiGuard Labs reported that illicit access is often resold as discounted AI chatbot subscriptions on platforms like Telegram and Discord. One operation, termed Operation Bizarre Bazaar, was linked to over 35,000 attack sessions across more than 30 AI model providers.

Detecting and Preventing LLMjacking

Detecting LLMjacking can be challenging due to its use of valid credential permissions, making it appear as legitimate usage. Conventional monitoring methods struggle to identify this type of abuse since the activity does not inherently appear malicious.

To combat such threats, FortiGuard Labs advises enabling AWS CloudTrail across all accounts to trace the complete sequence of identity creation and marketplace activities. Activating Bedrock invocation logging is also crucial, as it provides detailed request-level insights absent in CloudTrail logs. Organizations should prioritize using short-lived, role-assumed credentials over long-lived IAM keys to mitigate risks.

Furthermore, first-time usage of Bedrock services should not be presumed safe solely; it becomes noteworthy when combined with unusual signals like new identities, unexpected IP addresses, or unusual patterns in access-denied errors.

Adopting these strategies can significantly enhance an organization’s defense against sophisticated attacks such as LLMjacking, safeguarding their resources and financial assets.