AI Gateways Hijacked for Cryptojacking Attacks
Experts warn that AI gateways connected to Amazon Bedrock are being compromised to steal cryptocurrency. Threat actors, likely from Vietnam, gained access through exposed SSH connections and used XMRig mining software. This highlights the risk of centralized access to AI services and the importance of strict security measures.
Key points
- Darktrace reports a compromised AI gateway, LiteLLM-Proxy, connected to Amazon Bedrock, was used for cryptocurrency mining via XMRig.
- The attack likely originated from Vietnam, with suspicious IAM activity and connections to exposed SSH connections.
- Experts warn that AI gateways concentrate privileged access, urging strict port closures, least-privilege roles, and control-plane monitoring.
- This incident highlights the risk of centralized access to AI services and the importance of robust security measures.
A recent report by Darktrace has highlighted a growing concern in the tech industry: AI gateways are being hijacked for cryptojacking attacks. The compromised AI gateway, LiteLLM-Proxy, was connected to Amazon Bedrock, Amazon's fully managed generative AI platform. Threat actors, likely from Vietnam, gained access to the gateway through exposed SSH connections and used XMRig, a popular cryptocurrency mining program.
This incident serves as a reminder of the importance of robust security measures in the cloud. AI gateways, which concentrate privileged access to AI services, are particularly vulnerable to attacks. Experts warn that strict port closures, least-privilege roles, and control-plane monitoring are essential to reduce the blast radius of such attacks.
As the use of AI gateways continues to grow, it is crucial for organizations to prioritize security and take proactive measures to prevent similar incidents. By doing so, they can protect their sensitive data and prevent the misuse of their AI services.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.