Date: 11/04/2026
Severity: High
Summary
The team investigated multiple incidents in 2026 involving threat actors hijacking enterprise access to Large Language Models (LLMs), a technique known as LLMJacking. These attacks affected organizations across North America, South America, and Asia Pacific, spanning financial services, retail, technology, and transportation sectors. Unlike cryptojacking, LLMJacking can generate significant fraudulent cloud expenses within a short period. In some incidents, unauthorized usage exceeded $100,000 in a single day, with cumulative charges reaching $1 million at certain organizations before access was revoked.
Indicators of Compromise (IOC) List
Domains/URLs | jet-night.com newapi.pro |
Hash | 104.21.3.227
172.67.153.189
172.67.163.109
104.21.57.112
103.120.80.6
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "newapi.pro" or url like "newapi.pro" or siteurl like "newapi.pro" or domainname like "jet-night.com" or url like "jet-night.com" or siteurl like "jet-night.com" |
Detection Query 2 : | dstipaddress IN ("104.21.57.112","172.67.163.109","103.120.80.6","172.67.153.189","104.21.3.227") or srcipaddress IN ("104.21.57.112","172.67.163.109","103.120.80.6","172.67.153.189","104.21.3.227") |
Reference:
LLMJacking Drives Million-Dollar Cloud Cost Abuse