AI Gateway Exploitation and Data Theft

Source

---
analysis: A static rule can detect access to /proc/1/environ, but this hunt adds context
  by pivoting between known AI-specific vulnerabilities, behavioral environment-block
  harvesting, and fleet-wide prevalence counting of database connections on standard
  ports.
blind_spots:
- id: vulnerability-scan-lag
  question: whether a gateway was exploited before the daily scan captured the vulnerability
  requires: hb_vulnerability_finding with real-time container scanning
  risk: The gate may close prematurely for a newly deployed, unpatched gateway that
    is already under attack.
  stage: initial-access-ai-gateway-exploitation
- id: no-agent-on-gateway
  question: whether process-level activity occurred on an unmanaged container service
  requires: endpoint agent installed on the underlying host or sidecar
  risk: Attacks on shadow AI infrastructure or unmanaged cloud instances will remain
    invisible to process and environment-block queries.
  stage: runtime-credential-harvesting
- id: database-internal-visibility
  question: which specific configuration tables were read from the database
  requires: database audit logging for SELECT statements
  risk: Network telemetry shows the connection to the database but not the specific
    records dumped, requiring the analyst to infer intent from the process command
    line.
  stage: application-layer-data-exfiltration
coverage:
- stage: initial-access-ai-gateway-exploitation
  status: covered
  steps:
  - vulnerable-ai-infrastructure
- stage: runtime-credential-harvesting
  status: covered
  steps:
  - runtime-secret-harvesting
- stage: application-layer-data-exfiltration
  status: covered
  steps:
  - rare-ai-db-connections
- reason: 'Belongs to another part of the ''When AI infrastructure becomes the target:
    Securing gateways and control points'' series.'
  stage: masqueraded-payload-delivery
  status: out_of_scope
- reason: 'Belongs to another part of the ''When AI infrastructure becomes the target:
    Securing gateways and control points'' series.'
  stage: host-and-miner-discovery
  status: out_of_scope
- reason: 'Belongs to another part of the ''When AI infrastructure becomes the target:
    Securing gateways and control points'' series.'
  stage: resource-hijacking-cryptomining
  status: out_of_scope
- reason: 'Belongs to another part of the ''When AI infrastructure becomes the target:
    Securing gateways and control points'' series.'
  stage: host-persistence-mechanisms
  status: out_of_scope
guardrails:
  claims: no_unsupported
  evidence: citation_required
  missing_data: not_benign
  telemetry: untrusted
hunt:
  applicability: campaign-specific
  handoff: promote-to-detection
  justification: AI gateways concentrate sensitive master keys and backend connection
    strings; a single compromise exposes the entire organization's AI provider trust
    chain.
  methodology: model-assisted
  trigger: intel-report
hypothesis: An intruder has exploited an exposed AI gateway or orchestration platform
  to harvest LLM API keys from process memory and exfiltrate tenant configurations
  from backend databases.
labels:
- hunt
- attack.t1190
- attack.t1552.001
- attack.t1041
name: AI Gateway Exploitation and Data Theft
parameters:
  ai_cves:
    default:
    - CVE-2026-42271
    - CVE-2026-48710
    - CVE-2026-49869
    - CVE-2026-45312
    - CVE-2026-28797
    - CVE-2026-24770
    - CVE-2025-68700
    description: CVE IDs associated with LiteLLM, RAGFlow, and Kestra infrastructure.
    from:
      kind: article
      observed: '2026-08-26'
      ref: msrc-blog
    type: list[string]
  lookback_days:
    default: '14'
    description: Days of historical telemetry to examine.
    from:
      kind: manual
      observed: '2026-08-26'
      ref: default
    type: number
  scope_hosts:
    default: []
    description: Hosts identified as vulnerable in the lead query; leave empty to
      hunt across the entire estate.
    from:
      kind: manual
      observed: '2026-08-26'
      ref: analyst-provided
    type: list[host]
provenance:
  authors:
  - name: Huntbase hunt generation
    org: huntbase.io
  generated:
    by: huntbase-hunt-generation
    from: https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/
    gates:
    - dry-run
    - lint
    model: hb_google/gemini-3-flash-preview
rationale: Focus the hunt on containers or servers running Python-based gateways like
  LiteLLM or orchestration engines like RAGFlow and Kestra. Start with systems identified
  in the vulnerability scoping step.
references:
- name: "msrc-blog \u2014 When AI infrastructure becomes the target: Securing gateways\
    \ and control points"
  url: https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/
related:
- hunt: ai-infrastructure-miner-persistence
  reason: After credential harvesting, the report notes that attackers frequently
    deploy miners and establish persistence.
  relation: follows
scenario:
  stages:
  - name: Exploitation of Exposed AI Control Points
    observables:
    - CVE-2026-42271
    - CVE-2026-48710
    - CVE-2026-49869
    - CVE-2026-45312
    - CVE-2026-28797
    - CVE-2026-24770
    - CVE-2025-68700
    - Outbound Burp Collaborator callbacks from RAGFlow server
    - POST /mcp-rest/test/connection
    - POST /mcp-rest/test/tools/list
    slug: initial-access-ai-gateway-exploitation
    tactic: initial-access
    techniques:
    - T1190
  - name: Gateway Runtime Secret Harvesting
    observables:
    - Reading /proc/1/environ from gateway PID 1
    - Filtering environment for 'master', 'API key', 'token', 'password', 'DATABASE_URL'
    - Python urllib, curl, or wget used for exfiltration of environment blocks
    slug: runtime-credential-harvesting
    tactic: credential-access
    techniques:
    - T1552.001
  - name: Masqueraded Payload Delivery and Execution
    observables:
    - ELF binaries staged in temporary paths
    - Service-style naming masquerading as benign Linux daemons
    - Shell-stage downloaders with short timeouts and fallbacks
    - python3 -c commands retrieving remote payloads
    slug: masqueraded-payload-delivery
    tactic: execution
    techniques:
    - T1105
    - T1036.005
  - name: Host Discovery and Competitor Cleanup
    observables:
    - Silent passwordless sudo checks
    - Listening port inspection
    - Process sweeps for competing miners or remote shells
    - Modification of crontab to remove other miner entries
    slug: host-and-miner-discovery
    tactic: discovery
    techniques:
    - T1082
    - T1046
  - name: AI Gateway Database Exfiltration
    observables:
    - Access to postgres.database.azure.com
    - Queries against LiteLLM_ProxyModelTable and LiteLLM_VerificationToken
    - Self-contained python3 one-liners installing PostgreSQL support
    - Base64-encoded exfiltration in small chunks
    slug: application-layer-data-exfiltration
    tactic: collection
    techniques:
    - T1041
  - name: Compute Resource Hijacking
    observables:
    - XMRig deployment
    - Loading Linux Model-Specific Register (msr) module with write access
    - RandomX-related CPU tuning
    slug: resource-hijacking-cryptomining
    tactic: impact
    techniques:
    - T1496
  - name: System Persistence and C2
    observables:
    - Modification of SSH authorized_keys under service accounts
    - Hidden-file relay execution
    - Masqueraded systemd service names
    - Periodic out-of-band callbacks (C2 relay)
    slug: host-persistence-mechanisms
    tactic: persistence
    techniques:
    - T1098.004
    - T1053.003
    - T1090.003
  summary: Attackers are targeting exposed AI infrastructure components like LiteLLM
    gateways, RAGFlow document engines, and Kestra orchestrators to harvest LLM provider
    keys and credentials. Once access is gained, they pivot to container host persistence
    and monetize compromised compute resources through cryptomining.
series:
  index: 1
  slug: when-ai-infrastructure-becomes-the-target-securing-gateways-and-control-points
  title: 'When AI infrastructure becomes the target: Securing gateways and control
    points'
  total: 2
severity: high
targets:
  analyst:
    name: Tier-2 analyst
    role: analyst
  endpoint:
    category: endpoint
    name: Endpoint telemetry (hb_ surfaces)
    telemetry:
    - endpoint
  hunter:
    agent: true
    name: Hunt agent
  network:
    category: network
    name: Network telemetry
    telemetry:
    - network
tlp: clear
type: investigation
---


# AI Gateway Exploitation and Data Theft

AI infrastructure components like LiteLLM and RAGFlow concentrate high-value secrets, including API keys for model providers and database connection strings. This hunt identifies unpatched AI control points and correlates them with post-exploitation behaviors such as environment variable harvesting and rare connections to managed database instances. It uses a gated flow to first confirm the presence of vulnerable software before fanning out to analyze process and network telemetry for evidence of active compromise.

## vulnerable-ai-infrastructure
<!-- Unpatched AI infrastructure leads -->
Identify hosts running AI gateways or orchestration software with active vulnerabilities named in the research.

```sqlite target=endpoint role=scoping params=(ai_cves=ai_cves)
~~~yaml
expected: A list of hostnames running vulnerable AI software. Zero rows mean the known
  initial access surface is likely patched.
reads:
- device_uid
- cve_uid
- severity
- affected_package_name
- title
- hostname
- provider
silence: not_evidence_of_absence
source: hb_vulnerability_finding
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT d.hostname, v.cve_uid, v.severity, v.affected_package_name, v.title FROM hb_vulnerability_finding v JOIN hb_devices d ON v.device_uid = d.device_uid AND v.provider = d.provider WHERE instr(',' || '{{ai_cves}}' || ',', ',' || v.cve_uid || ',') > 0 AND v.status != 'suppressed' AND v.severity_id >= 3
```

## lead-assessment
<!-- Lead risk assessment -->
```agent target=hunter
cite: required
context:
- vulnerable-ai-infrastructure
max_iterations: 3
objective: Identify whether RAGFlow, LiteLLM, or Kestra instances are unpatched and
  exposed to RCE.
success_criteria: A clear per-host assessment of the AI infrastructure exposure.
tools:
- endpoint
- network
```

## gate-decision
<!-- Gate: Open deep behavioral hunt? -->
if~: "the lead-assessment indicates at least one host is running vulnerable AI software with high risk of exploitation" (confidence: high, judge=hunter)
then: → behavioral-fan-out
indeterminate: → analyst-review
unavailable: → analyst-review (blind_spot: vulnerability-scan-lag)
else: → close-out

## behavioral-fan-out
<!-- Fan-out to behavioral signals -->
parallel:
- → runtime-secret-harvesting
- → rare-ai-db-connections
join: → triage-evaluation

## runtime-secret-harvesting
<!-- Gateway runtime secret harvesting -->
Detect commands reading process environment blocks or searching for AI-specific master keys and API tokens.

```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts)
~~~yaml
expected: A process context associated with an AI gateway reading sensitive environment
  variables. This is a high-confidence behavioral indicator.
reads:
- device_hostname
- process_name
- process_cmd_line
- user_name
- time
silence: not_evidence_of_absence
source: hb_process_activity
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%python%' OR LOWER(process_name) LIKE '%node%') AND (LOWER(process_cmd_line) LIKE '%/proc/1/environ%' OR LOWER(process_cmd_line) LIKE '%master%' OR LOWER(process_cmd_line) LIKE '%api_key%' OR LOWER(process_cmd_line) LIKE '%database_url%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')
```

## rare-ai-db-connections
<!-- Rare AI gateway database connections -->
Stack-count network connections to backend AI databases or common database ports to identify anomalous dumping behavior.

```sqlite target=network role=baseline params=(lookback_days=lookback_days, scope_hosts=scope_hosts)
~~~yaml
baseline:
  compare: first_seen
  window: '{{lookback_days}}d'
expected: A specific AI gateway process connecting to a backend database or common
  DB port on only one or two hosts. This suggests a post-exploitation configuration
  dump.
prevalence:
  by: device_hostname
  key:
  - dst_endpoint_hostname
  - dst_endpoint_port
  - process_name
  rare_below: 3
reads:
- dst_endpoint_hostname
- dst_endpoint_port
- process_name
- device_hostname
- time
silence: not_evidence_of_absence
source: hb_network_connection
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT dst_endpoint_hostname, dst_endpoint_port, process_name, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_network_connection WHERE (dst_endpoint_port IN (5432, 3306, 1433) OR LOWER(dst_endpoint_hostname) LIKE '%.postgres.database.azure.com') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY dst_endpoint_hostname, dst_endpoint_port, process_name HAVING host_count < 3 ORDER BY host_count ASC
```

## triage-evaluation
<!-- Triage AI infrastructure compromise -->
```agent target=hunter
cite: required
context:
- lead-assessment
- runtime-secret-harvesting
- rare-ai-db-connections
max_iterations: 6
objective: Determine if any AI gateway host with an unpatched vulnerability shows
  evidence of environment secret harvesting or rare database connections, citing specific
  rows.
success_criteria: A per-host verdict of malicious | suspicious | benign citing evidence
  from all context steps.
tools:
- endpoint
- network
```

## route-on-verdict
<!-- Route on triage verdict -->
if~: "the triage-evaluation verdict is malicious for at least one AI gateway host" (confidence: high, judge=hunter)
then: → isolate-compromised-host
indeterminate: → analyst-review
unavailable: → analyst-review (blind_spot: no-agent-on-gateway)
else: → close-out

## isolate-compromised-host
<!-- Isolate compromised AI gateway -->
```action target=endpoint
~~~yaml
approval: required
~~~
Isolate the endpoint. Revoke all AI provider master keys and rotate the database connection string found in the environment blocks.
```
→ analyst-review

## analyst-review
<!-- Analyst review and tuning -->
```manual target=analyst
Examine the processes that read /proc/1/environ. Confirm if the database connections were authorized administrative activity or part of an exploit payload.
```
→ close-out

## close-out
<!-- Hunt close-out -->
```manual target=analyst
Record the findings. If vulnerabilities were present but no behavioral signal was found, issue an urgent request for patching the AI gateway infrastructure.
```
→ end