Attackers are abusing stolen AWS IAM credentials to hijack Amazon Bedrock model access through AWS Marketplace, a technique known as LLMjacking, and monetize the victim account’s inference charges. FortiGuard Labs observed a long-lived AdministratorAccess key used to create a new IAM user, subscribe to foundation models, and invoke them, while FortiCNAPP maps defenses across the full attack chain. #AWS #AmazonBedrock #FortiCNAPP #FortiGuardLabs #LLMjacking
Keypoints
- Attackers are using stolen cloud credentials to pay for expensive AI model inference instead of deploying miners or stealing data.
- The attack technique, called LLMjacking, abuses valid access to hosted models and can be resold as “AI chatbot” access.
- FortiGuard Labs observed a compromised AWS account tied to a long-lived IAM access key with AdministratorAccess permissions.
- The attacker created a new IAM user, subscribed it to foundation models through AWS Marketplace, and invoked those models to generate charges.
- This abuse can be hard to detect because Bedrock InvokeModel requests from valid identities look like normal cloud API activity.
- Defenders are advised to enable CloudTrail and Bedrock invocation logging, and to treat long-lived IAM keys as high risk.
- FortiCNAPP provides detections for privilege escalation, marketplace subscriptions, service-specific credentials, and Bedrock logging tampering.
MITRE Techniques
- [T1078 ] Valid Accounts – The attacker used a legitimate but compromised AWS IAM access key to operate inside the victim account (‘using a leaked long-lived IAM access key with AdministratorAccess permissions’).
- [T1098 ] Account Manipulation – A new IAM user was created to continue access and abuse model subscriptions (‘Created a new IAM user’).
- [T1586 ] Compromise Accounts – The attacker obtained and abused cloud account credentials to hijack paid AI service usage (‘a leaked IAM key’ and ‘stolen cloud credentials’).
- [T1105 ] Ingress Tool Transfer – The article describes the attacker creating and using credentials and access paths inside the victim environment to carry out the abuse (‘generate Bedrock service-specific credentials for the new identity’).
- [T1528 ] Steal Application Access Token – The stolen long-lived IAM access key functioned as the access token used to enter the account (‘leaked long-lived IAM access key’).
- [T1562.001 ] Impair Defenses: Disable or Modify Tools – The attacker may attempt to remove visibility by deleting Bedrock logging (‘Bedrock model invocation logging deleted’).
- [T1059 ] Command and Scripting Interpreter – The attacker executed API-driven actions programmatically to create users, accept marketplace agreements, and invoke models (‘CreateAgreementRequest/AcceptAgreementRequest’ and ‘Invoked the subscribed foundation model(s)’).
- [T1496 ] Resource Hijacking – The core objective was to use victim AWS resources for paid model inference and resell the access (‘get another organization’s cloud account to pay for expensive, high-capability model inference’).
Indicators of Compromise
- [Cloud IAM Access Key] long-lived administrator key used in the compromise – leaked IAM access key, AdministratorAccess key
- [AWS IAM User] newly created identity used to continue the attack – new IAM user, Bedrock service-specific credential identity
- [AWS Marketplace Agreement Event] subscription activity tied to model access abuse – CreateAgreementRequest, AcceptAgreementRequest
- [AWS Service/API] requests used to invoke foundation models and generate charges – InvokeModel, agreement-marketplace.amazonaws.com
- [Detection Rule Names] FortiCNAPP detections relevant to the attack chain – lacework-global-2906, lacework-global-2907
Read more: https://feeds.fortinet.com/~/968521970/0/fortinet/blog/threat-research~Someone-Else-Is-Using-Your-AI