Defensive Dispatch

BLUF: Bottom Line Up Front

Northflank, a cloud hosting platform, told customers to replace all stored secrets after reports that AI API keys were misused. The cause is unconfirmed, but exposed keys can let outsiders run up paid AI usage on your account. If you use Northflank, rotate credentials now and review AI billing.

Key Points

• Northflank is investigating reported unauthorized use of AI keys and has told customers to treat stored environment variables, which often hold passwords and API keys, as compromised.
• The entry point, the attacker, and the affected customers are not yet confirmed, so the rotation advice is precautionary, though Northflank linked the activity to a wider October pattern of attacks on AI platforms described by Wiz.
• Organizations running workloads on Northflank face possible fraudulent AI charges (called LLMjacking) and wider exposure of database and application credentials held in workloads, secret groups, and global settings.
• Revoke existing credentials with the providers that issued them, create replacements, and update the affected Northflank secrets and workloads, rather than rotating only keys already showing abuse.
• Ask your IT team to review AI provider usage and billing for unexpected activity, report anything suspicious to Northflank and the provider, and restrict public access to add-ons.

Read more: Northflank Security Breach Leads to Unauthorized AI API Key Usage, Customers Urged to Rotate Secrets

BLUF: Bottom Line Up Front

Mandiant and GTIG report 2026 incidents in which attackers hijacked enterprise LLM access, mainly through stolen cloud identity tokens and exposed API keys, running up fraudulent charges of $100,000+ in a day and up to $1 million. Stolen access is resold through "LLM Mixers." Defenders should lock down credentials, alert on LLM service enablement, enable relevant audit logs, and patch gateways such as LiteLLM.

Key Points

• Exposed or stolen cloud identity tokens (IAM credentials, Service Account keys, GitHub PATs, session tokens) were the dominant initial access vector, though exposed LLM endpoints and leaked LLM API keys were also targeted.
• Attackers validated stolen keys with single-token requests (max_tokens=1) to avoid volume-based alerts, so defenders should watch gateway and API logs for low-volume validation pings.
• For persistence and escalation, actors created unauthorized IAM and service accounts, injected SSH keys into compute instances, and abused token-creation privileges, while a LiteLLM flaw (CVE-2026-40217) let Virtual Keys become PROXY_ADMIN credentials.
• LLM Mixers such as jet-night.com and the newapi[.]pro ecosystem pool stolen keys and resell cheap access, shifting costs to victims, with UNC6993 using tools like new-api and gcli2api.
• Defenders should treat unauthorized enablement of LLM services as critical, turn on data-plane audit logging in AWS, Azure, and GCP, and enforce least privilege, secret scanning, phishing-resistant MFA, quotas, and spending caps.

Read more: The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources | Google Cloud Blog

Bottom Line Up Front

Artificial intelligence is making it easier and faster for criminals to write ransomware, but it hasn’t changed the fundamentals of how these attacks cause damage. The Sophos article explains that while AI may help attackers automate parts of ransomware creation, the real risk still comes from long‑standing techniques—such as remotely encrypting shared files—that exploit trust and access inside organizations. In short, AI changes the tools attackers use, not the basic math of ransomware risk. 

5 Key Takeaways 

• AI accelerates attackers, but doesn’t reinvent ransomware: Ransomware has followed a familiar playbook for over a decade, and AI mainly helps criminals scale and automate what already works.  

• Most damage happens remotely: Modern ransomware often encrypts files on shared systems from a compromised device, meaning the most affected systems may never directly run malicious software themselves.  

• Trust is the real vulnerability: Attackers take advantage of legitimate access and normal system behavior, which allows ransomware to spread without triggering obvious alarms.  

• Detection must focus on impact, not just attackers: Watching for what is happening to data—such as sudden, unauthorized encryption—is more reliable than trying to identify every new ransomware variant.  

• The core risk hasn’t changed: Whether written by humans or assisted by AI, ransomware still succeeds when organizations lack visibility into how their data is accessed and modified.  

Read The Source Article:
https://www.sophos.com/en-us/blog/sophos-ransomware-ai