{"id":2148,"date":"2025-02-28T17:34:03","date_gmt":"2025-02-28T17:34:03","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=2148"},"modified":"2025-02-28T17:34:03","modified_gmt":"2025-02-28T17:34:03","slug":"microsoft-files-lawsuit-against-llmjacking-gang-that-bypassed-ai-safeguards","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=2148","title":{"rendered":"Microsoft files lawsuit against LLMjacking gang that bypassed AI safeguards"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Microsoft has filed a civil lawsuit against an international gang of cybercriminals that exploited stolen credentials to access generative AI services, including its own. The gang, tracked as Storm-2139, used the stolen credentials along with AI jailbreaking techniques to set up paid services of their own capable of generating content that bypassed built-in ethical safeguards and violated the terms of service of the abused large language models (LLMs).<\/p>\n

The lawsuit and its alleged activities shed light on the black market that has emerged around stolen credentials enabling access to AI chatbots or cloud platforms where a range of LLMs can be deployed. Attacks that abuse LLM resources, often with big financial costs for unsuspecting victims, have become known as LLMjacking.<\/p>\n

\u201cStorm-2139 is organized into three main categories: creators, providers, and users,\u201d lawyers with Microsoft\u2019s Digital Crimes Unit wrote in a blog post<\/a>. \u201cCreators developed the illicit tools that enabled the abuse of AI-generated services. Providers then modified and supplied these tools to end users, often with varying tiers of service and payment. Finally, users utilized these tools to generate violating synthetic content, often centered around celebrities and sexual imagery.\u201d<\/p>\n

Microsoft has managed to identify four of the 10 persons believed to be part of Storm-2139: Arian Yadegarnia, aka \u201cFiz,\u201d of Iran; Alan Krysiak, aka \u201cDrago,\u201d of the United Kingdom; Ricky Yuen, aka \u201ccg-dot,\u201d of Hong Kong; and Ph\u00e1t Ph\u00f9ng T\u1ea5n, aka \u201cAsakuri,\u201d of Vietnam. Cg-dot is believed to be one of the two \u201ccreators,\u201d while the other three were \u201cproviders\u201d in the criminal operation.<\/p>\n

The company said it has also identified two members based in the US, in Illinois and Florida, but for now, it\u2019s keeping those identities secret because of ongoing criminal investigations.<\/p>\n

Gang members out each other<\/h2>\n

Microsoft originally announced it was taking legal action against cybercriminals abusing its AI services in January<\/a> and subsequently managed to seize a website that was critical to the Storm-2139 operation. This seizure and the unsealed legal filings immediately generated chatter on the communication channels used by the gang, with members and users speculating about whose identities might have been exposed. Microsoft lawyers also had their personal information and photographs shared.<\/p>\n

\u201cAs a result, Microsoft\u2019s counsel received a variety of emails, including several from suspected members of Storm-2139 attempting to cast blame on other members of the operation,\u201d Microsoft\u2019s Digital Crimes Unit said.<\/p>\n

LLMjacking can cost organizations a lot of money<\/h2>\n

LLMjacking is a continuation of the cybercriminal practice of abusing stolen cloud account credentials for various illegal operations, such as cryptojacking<\/a> \u2014 abusing hacked cloud computing resources to mine cryptocurrency. The difference is that large quantities of API calls to LLMs can quickly rack up huge costs, with researchers estimating potential costs of over $100,000 per day when querying cutting-edge models.<\/p>\n

Security firm Sysdig reported last September a tenfold increase in the observed number of rogue requests to Amazon Bedrock APIs<\/a> and a doubling of the number of IP addresses engaged in such attacks.<\/p>\n

Amazon Bedrock is an AWS service that allows organizations to easily deploy and use LLMs from multiple AI companies, augment them with their own datasets, and build agents and applications around them. The service supports a long list of API actions through which models can be managed and interacted with programmatically. Microsoft runs a similar service called Azure AI Foundry, and Google has Vertex AI.<\/p>\n

Sysdig initially saw attackers abusing AWS credentials to access Bedrock models that were already deployed by the victims organizations, but later started seeing attempts by attackers to actually enable and deploy new models in the compromised accounts.<\/p>\n

Earlier this month, after the release of the DeepSeek R1 model, Sysdig detected LLMjacking attackers targeting it within days<\/a>. The company also discovered over a dozen proxy servers that used stolen credentials across many different services, including OpenAI, AWS, and Azure.<\/p>\n

\u201cLLMjacking is no longer just a potential fad or trend,\u201d the security company warned. \u201cCommunities have been built to share tools and techniques. ORPs [OpenAI Reverse Proxies] are forked and customized specifically for LLMjacking operations. Cloud credentials are being tested for LLM access before being sold.\u201d<\/p>\n

See also:<\/strong><\/p>\n

10 most critical LLM vulnerabilities<\/a><\/p>\n

Gen AI is transforming the cyber threat landscape by democratizing vulnerability hunting<\/a><\/p>\n

Top 5 ways attackers use generative AI to exploit your systems<\/a><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Microsoft has filed a civil lawsuit against an international gang of cybercriminals that exploited stolen credentials to access generative AI services, including its own. The gang, tracked as Storm-2139, used the stolen credentials along with AI jailbreaking techniques to set up paid services of their own capable of generating content that bypassed built-in ethical safeguards […]<\/p>\n","protected":false},"author":0,"featured_media":2149,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-2148","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/2148"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2148"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/2148\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/2149"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2148"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2148"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2148"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}