CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →
‹Mon · 09 Nov 2026
All daily briefs →
Daily brief · UTC day

Monday, 9 November 2026

1 verified finding from 1 run · 1 update to prior coverage · the settled record for this UTC day, in the classic brief order.

Criticality
Kind
Topic
Region
TL;DR · the day in one read
  1. 01GTIG: stolen cloud keys enable Bedrock and Gemini model services, then resell the quota; hunt the control-plane logs. GTIG and Mandiant report 2026 incident-response cases in which actors used exposed or stolen cloud identity tokens (IAM credentials, service-account keys, GitHub tokens) for initial access and then enabled managed model services such as Amazon Bedrock and the Gemini API in victim accounts, ran up charges above USD 100,000 in a single day and resold the quota through proxy gateways. Wiz describes a Google Cloud billing-account variant and Datadog the validation of stolen AWS keys for Bedrock; GTIG lists the audit-log events to watch in AWS, Azure and Google Cloud. →

01Active threats, incidents & disclosures1 item

NOTABLENATOB2

LLMjacking: stolen cloud identities and keys enable managed model services in victim accounts and resell the quota through proxy gateways (GTIG and Mandiant), with control-plane hunting guidance for AWS, Azure and Google Cloud

Mandiant responded to multiple 2026 incidents in which actors hijacked enterprise access to large language models ("LLMJacking") with charges above USD 100,000 in a single day (GTIG, 2026-11-02). The dominant initial access was exposed or stolen cloud identity tokens (IAM credentials, service-account keys, GitHub tokens, session tokens). One actor harvested LLM API keys from public GitHub repositories and validated them with single-token requests that stayed under EDR and SIEM volume alerts; another scripted calls against exposed Ollama endpoints to register its own models; cluster UNC6993 had users paste a raw JSON payload holding an active access token into a fake application-portal page, which bypasses password and MFA (GTIG, 2026-11-02).

After the foothold the actors enumerated cloud services and repositories for credentials, took secrets from cloud secret managers, created unauthorized IAM and service accounts, attached administrative policies to service roles and injected SSH keys into compute instances or instance metadata; one rotated short-lived service accounts to get around rate limits (GTIG, 2026-11-02). In multiple incidents the model services were not enabled at compromise, and the stolen keys were used to enable them and to create further API keys (GTIG, 2026-11-02). A follow-on cluster holding pre-validated virtual keys exploited the victim's LiteLLM gateway at its /key/regenerate endpoint to lift standard virtual keys to proxy-admin credentials (GTIG, 2026-11-02). "LLM Mixers" proxy, aggregate and resell the stolen access; UNC6993 used the open-source new-api and gcli2api gateways (GTIG, 2026-11-02).

Triage: GTIG treats any call that disables model invocation logging, made by a principal outside infrastructure-as-code, as high severity (GTIG, 2026-11-02).

the dominant initial access vector has been exposed or stolen cloud identity tokens

In multiple incidents that Mandiant investigated, LLM services were not enabled at the time of compromise.

Gemini Enterprise Agent Platform inference operations are contained within Data Access logs, which are disabled by default due to volume and ingestion costs.

Google Threat Intelligence Group and Mandiant 2026-11-02

Wiz identified threat actors hijacking Google Cloud Platform (GCP) billing accounts via search-ad phishing to fund unauthorized Gemini API usage.

Wiz

Valid credentials then undergo a separate check for Bedrock access

Datadog Security Labs 2026-10-06

Builds on: An exposed AI API key is a billing incident on a clock: Unit 42 saw one reach a reseller in…

threat09 Nov 03:26Zmulti-sourceOpen finding →
Sources: Google Threat Intelligence Group and Mandiant · Wiz (Cloud Threat Landscape) · Datadog Security Labs

02Updates to prior coverage1 item

NOTABLECVE-2026-123158exploitedupdatedNATOA2

CVE-2026-123158, OpenSSH Portable before 10.6p2 (*sshole): on Linux with musl libc and no PAM, a password of 257 to 1,024 bytes logs in to accounts whose password field is *; NCSC Switzerland issued an advisory (CVSS 3.1 8.1)

First published 2026-11-06 · open finding →

Improvementrun 2026-11-09T0255Z-intelsourcesevidencesourcing_notesummarybody

SANS Internet Storm Center's honeypots independently report a rise in sshole exploitation attempts from 2026-11-05, with 713 long-password attempts on 2026-11-06 the highest of its daily counts, and Previdian's counter now stands at 20 attempts from 13 addresses, so the attempts rest on two sensor sets, not one; still no report of a compromised production host.

SANS Internet Storm Center's Cowrie SSH honeypots independently record the attempts: ISC dates the first genuine sshole attempt to 2026-11-05, with an all-"A" password, from scanners it lists on commercial hosting and telecom networks, and counts long-password attempts at 232 on 2026-11-05, 713 on 11-06, 246 on 11-07 and 51 on 11-08 (the day the page was published) (SANS ISC, 2026-11-08). The honeypots collect only the first 255 characters of a password, which limits what ISC sees; after listing the first scanners, its author expects that quite a few of those login attempts succeeded on its honeypots and promises a follow-up (SANS ISC, 2026-11-08). Two sensor sets, ISC's from 2026-11-05 and Previdian's from 2026-11-06, now record exploitation attempts; Previdian's page, read again on 2026-11-09, shows 20 attempts from 13 addresses in 9 countries, the last on 2026-11-08 (Previdian, 2026-11-05). No source reports a compromised production host.

Sources: NCSC Switzerland (Security Hub advisory 13155) · OpenSSH project (Portable OpenSSH 10.6p2 release notes) · OX Security · heise online · Previdian · The Hacker News · Alpine Linux · SANS Internet Storm Center · GreyNoise (SSHole event tracker) · CISA · Canadian Centre for Cyber Security (AV26-1130, Update 1) · BleepingComputer
Verification & coverage notes1 run

2026-11-09T0255Z-intel · Sonnet 5.5 · window 26 h · 1 entry published

Verification & coverage notes

Quiet Monday window: 26 h (gap 24.0 h to 2026-11-08T0256Z-intel, normal daily cadence, no outage backfill). CISA KEV carried no addition in the window (kev_window_diff: 0 rows), no scheduled multi-product release fell in it (Microsoft Patch Tuesday and SAP Patch Day are 2026-11-10), and NCSC.ch, BACS, NCSC-NL, CERT-FR, BSI, CERT-EU, CERT.PL, NCSC-UK, Fortinet and Palo Alto had nothing newer than 2026-11-06. No lab research was published inside the 26 h window itself (the newest Microsoft post is 2026-11-07), so S3's items came through source lookbacks. Output: 1 new entry and 1 changelog record; nothing in the window clears the critical or high bar that the store lacks.

  • Published, new: LLMjacking (threat, notable): GTIG and Mandiant's 2026-11-02 incident-response report on stolen cloud identities used to enable Bedrock and Gemini model services and resell the quota, with Wiz's Google Cloud billing-account variant and Datadog's AWS key validation. First seen as trade-press titles of 2026-11-03 (Infosecurity Magazine and Dark Reading, inside their 145 h lookbacks), then traced to the GTIG post of 2026-11-02 (PD-7 d, first coverage from rotational lookbacks; event_date 2026-11-02). mandiant-gtig and sans-isc were read in S3's beyond-slice sweeps, so they carry no slice-ledger row; their last_successful_fetch moved because the main agent's deep read used them. Clears PD-11 (d): per-cloud control-plane hunting a Tier 2/3 responder can build detections from, for cloud tenants any public body runs; no Swiss or public-sector victim is stated, hence notable and not higher. Distinct from 2026-08-07/ai-api-token-jacking-transfer-station-resale (different publisher, case data and window), which it lists in references[]. The body describes GTIG's LiteLLM /key/regenerate exploitation without the CVE id (CVE-2026-40217), which GTIG attaches to it.
  • Updated: 2026-11-06/cve-2026-123158-openssh-musl-no-pam-password-bypass-sshole (type improvement, so it does not re-float): SANS ISC's honeypot counts add a second independent sensor set (first genuine attempt 2026-11-05, peak 2026-11-06), which replaces the entry's "one telemetry vendor" sourcing statement; the entry's decision and priority are unchanged, so an update was not warranted.
  • borderline-drop: OpenAM before 16.1.4 (CVE-2026-123549, -123550, -123551: session-token theft, unsigned SAML assertions, self-registration admin creation); project advisories and the fix are from 2026-10-22; only the CVE assignment (VulnCheck 2026-11-07, EUVD 2026-11-08) is in the window, no exploitation, no constituency use of OpenAM established. Reopen if exploitation is reported or a Swiss body is shown to run it.
  • borderline-drop: Contact Form 7 6.2 to 6.2.3 CVE-2026-114432, fixed 2026-10-29, no exploitation, rated medium by Patchstack, and code execution needs an Apache configuration that lists directories and maps .phar to PHP; a patch-cycle item.
  • borderline-drop: Plex2Shell (CVE-2026-96652, -96654, -96655, -96656; KEV since 2026-10-20, QNAP's report of 2026-11-06), re-seen by S1 with no development since the 2026-11-08 drop (no Swiss body, QNAP-managed estate or KEV-listed campaign touching the constituency); the earlier reopen condition is unmet.
  • borderline-drop: UgCS CVE-2026-59104, re-seen, niche, no exploitation, no vendor advisory, no Swiss use evidenced (second consecutive drop).
  • borderline-drop: Debian and Ubuntu apt CVE-2026-109518 (TOCTOU in the download retry path; root code execution through a malicious mirror, proxy or on-path position), fixed 2026-11-04, not exploited, needs a network position, a patch-cycle item.
  • borderline-drop: Vaud Grand Conseil interpellation 26_INT_155 on the school IT-support platform (S2), the MP's governance questions with no government answer, no vector and no new technical fact; also about a day outside the Vaud entry's lookback.
  • borderline-drop: CERT.LV's 2026-11-06 refrigeration advisory (S2), widens the warning to heating boilers, water pumps, solar controls and building services (a warning, not observed attacks) and adds the Latvian case; most of its control list repeats CERT-FR, CISA and ENISA guidance the entry carries, and a twelfth record would grow an entry whose analysis is already far past the word bound. Recoverable if a Swiss body reports an attack on non-refrigeration building equipment.
  • borderline-drop: SpecterOps on third-party service principals in Entra ID (2026-11-06), an explainer on the ConnectWise Cloud Backup incident whose hunts the entry already carries (credential-addition audit events, service-principal sign-ins); the general customer-side audit of consented multi-tenant apps would grow an analysis of 1,047 words. Recoverable as an improvement record if the audit wants it.
  • borderline-drop: Trellix CyberThreat Report November 2026 (vendor telemetry statistics, government most targeted by ransomware campaigns, edge devices as the front door), the tradecraft repeats entries already in the store (Talos IR Q3, Elastic quarterly report) and the numbers are vendor statistics.
  • borderline-drop: SH Consulting's scan of dangling DNS records in US government domains; OpenAI's 948 kernel LPE exploits pipeline (no CVE list, no exploitation); Layer3 Intel's residential-proxy exits on a US government network (second consecutive drop); Chainalysis intrusion, Credit Mutuel Arkea, Gleis D / Medi Porta Chur, Holcim and the Swiss leak-site listings (Treuhand & Immobilien Abt, Labatec, HighTec, Erowa); each fails the relevance or actionability gate or the incident floor on today's facts.
  • borderline-drop: ChimeraZ's forum sale of a claimed SGS France customer database (S4; single forum post relayed by ZATAZ and FrenchBreaches, no SGS or CNIL statement, no vector, French customer data of a private group), an unconfirmed leak-site claim (PD-6) that would sit below the incident floor even if confirmed; no backlog row opened. Reopen if SGS, the CNIL or an Admiralty A or B outlet confirms it and names a vector.
  • Hold (not a backlog row): Keycloak CVE-2026-120984 (delegated-admin script-policy upload leading to code execution, Red Hat 2026-11-07) has no fixed upstream build named; a possible update on 2026-11-08/cve-2026-117691-keycloak-saml-http-redirect-signature-bypass once a fix version appears.
  • Backlog: the ChimeraZ forum-sale claim against the Belgian rescue zone Hainaut-Est (ZOHE) stays held; S4 re-searched in French (twice), Dutch and English and found no zone statement and no press, expiry 2026-11-17 unchanged. No row changed state, so nothing was appended to it.
  • Single-source: none among the run's outputs.
  • Contradiction: GTIG attaches CVE-2026-40217 to the LiteLLM /key/regenerate user-ID rebind flaw, while the store's 2026-06-16 Obsidian entry carries that id as a different LiteLLM flaw (custom-code guardrail execution). No LiteLLM advisory was read, so the id is left out of the new entry.
  • Candidate sources: vd-grand-conseil (cantonal parliament agendas carry the full interpellation texts; the only primary for cantonal oversight of a covered Swiss incident). S3's sh-consulting, S1's openam-security-advisories and contactform7-releases were not added: their items fell below the gate. android-security-bulletin met the three-run bar and was promoted to active.
  • Source notes appended: Fortinet's ir.xml feed works while its HTML listing is stale; cert-lv feed plus extract; the Curia Vista OData filter shape; extract on vd.ch/cybersecurite lists items newest first. hadrian-labs read as marketing only (ten of ten posts), a demotion candidate if the next sweeps stay quiet.
  • Source health: source_health.py ended with an empty UNSOLVED list after one repair, balbooa-blog (the record URL returned no security vocabulary; the Newsroom index reads with extract, pinned as health_cmd, and is scoped general-news). Other verdicts: one stale and three unreadable sources already handled.
  • Watchlist: none configured, sweeps are a no-op.
  • Coverage gaps: connectwise-trust-center (403 on every transport); sygnia (403 on every transport); ico-uk (403 on every transport for the seventh fire, WebSearch found no ICO notice after 2026-08-12); bfv-verfassungsschutz-de (feed connection reset, reader page undated); anssi-cyber-gouv-actualites (readable only through the metered reader); sap-security-notes (404 until the 2026-11-10 patch day); cisa-advisories RSS (unreadable; WebFetch of the listing plus cisa csaf-recent works); tagesschau (feed depth about 1.5 days against a 124 h lookback).
  • Reader credit: the jina keys are close to exhausted (eight answered HTTP 402 for S4; one S1 key reported an exhausted balance); three extracts fell through to the reader.
  • Next audit: two optional advisories on pre-existing sshole text (the summary clause that reads as if Previdian reports the honeypot login; the title's CVSS attribution to the NCSC advisory); S1's recipe findings on the Chrome releases Atom feed (answers 302; extract of the blog root worked through the reader), bsi-de quiet since 2026-11-06, and an independent read of the LLMjacking entry's per-cloud event names against each cloud's own documentation, which this fire could not read.