{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "AI gateways concentrate sensitive master keys and backend connection strings; a single compromise exposes the entire organization's AI provider trust chain." }, "name": "AI Gateway Exploitation and Data Theft", "type": "investigation", "labels": [ "hunt", "attack.t1190", "attack.t1552.001", "attack.t1041" ], "series": { "slug": "when-ai-infrastructure-becomes-the-target-securing-gateways-and-control-points", "index": 1, "title": "When AI infrastructure becomes the target: Securing gateways and control points", "total": 2 }, "related": [ { "hunt": "ai-infrastructure-miner-persistence", "reason": "After credential harvesting, the report notes that attackers frequently deploy miners and establish persistence.", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A static rule can detect access to /proc/1/environ, but this hunt adds context by pivoting between known AI-specific vulnerabilities, behavioral environment-block harvesting, and fleet-wide prevalence counting of database connections on standard ports.", "coverage": [ { "stage": "initial-access-ai-gateway-exploitation", "steps": [ "vulnerable-ai-infrastructure" ], "status": "covered" }, { "stage": "runtime-credential-harvesting", "steps": [ "runtime-secret-harvesting" ], "status": "covered" }, { "stage": "application-layer-data-exfiltration", "steps": [ "rare-ai-db-connections" ], "status": "covered" }, { "stage": "masqueraded-payload-delivery", "reason": "Belongs to another part of the 'When AI infrastructure becomes the target: Securing gateways and control points' series.", "status": "out_of_scope" }, { "stage": "host-and-miner-discovery", "reason": "Belongs to another part of the 'When AI infrastructure becomes the target: Securing gateways and control points' series.", "status": "out_of_scope" }, { "stage": "resource-hijacking-cryptomining", "reason": "Belongs to another part of the 'When AI infrastructure becomes the target: Securing gateways and control points' series.", "status": "out_of_scope" }, { "stage": "host-persistence-mechanisms", "reason": "Belongs to another part of the 'When AI infrastructure becomes the target: Securing gateways and control points' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Exploitation of Exposed AI Control Points", "slug": "initial-access-ai-gateway-exploitation", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "CVE-2026-42271", "CVE-2026-48710", "CVE-2026-49869", "CVE-2026-45312", "CVE-2026-28797", "CVE-2026-24770", "CVE-2025-68700", "Outbound Burp Collaborator callbacks from RAGFlow server", "POST /mcp-rest/test/connection", "POST /mcp-rest/test/tools/list" ] }, { "name": "Gateway Runtime Secret Harvesting", "slug": "runtime-credential-harvesting", "tactic": "credential-access", "techniques": [ "T1552.001" ], "observables": [ "Reading /proc/1/environ from gateway PID 1", "Filtering environment for 'master', 'API key', 'token', 'password', 'DATABASE_URL'", "Python urllib, curl, or wget used for exfiltration of environment blocks" ] }, { "name": "Masqueraded Payload Delivery and Execution", "slug": "masqueraded-payload-delivery", "tactic": "execution", "techniques": [ "T1105", "T1036.005" ], "observables": [ "ELF binaries staged in temporary paths", "Service-style naming masquerading as benign Linux daemons", "Shell-stage downloaders with short timeouts and fallbacks", "python3 -c commands retrieving remote payloads" ] }, { "name": "Host Discovery and Competitor Cleanup", "slug": "host-and-miner-discovery", "tactic": "discovery", "techniques": [ "T1082", "T1046" ], "observables": [ "Silent passwordless sudo checks", "Listening port inspection", "Process sweeps for competing miners or remote shells", "Modification of crontab to remove other miner entries" ] }, { "name": "AI Gateway Database Exfiltration", "slug": "application-layer-data-exfiltration", "tactic": "collection", "techniques": [ "T1041" ], "observables": [ "Access to postgres.database.azure.com", "Queries against LiteLLM_ProxyModelTable and LiteLLM_VerificationToken", "Self-contained python3 one-liners installing PostgreSQL support", "Base64-encoded exfiltration in small chunks" ] }, { "name": "Compute Resource Hijacking", "slug": "resource-hijacking-cryptomining", "tactic": "impact", "techniques": [ "T1496" ], "observables": [ "XMRig deployment", "Loading Linux Model-Specific Register (msr) module with write access", "RandomX-related CPU tuning" ] }, { "name": "System Persistence and C2", "slug": "host-persistence-mechanisms", "tactic": "persistence", "techniques": [ "T1098.004", "T1053.003", "T1090.003" ], "observables": [ "Modification of SSH authorized_keys under service accounts", "Hidden-file relay execution", "Masqueraded systemd service names", "Periodic out-of-band callbacks (C2 relay)" ] } ], "summary": "Attackers are targeting exposed AI infrastructure components like LiteLLM gateways, RAGFlow document engines, and Kestra orchestrators to harvest LLM provider keys and credentials. Once access is gained, they pivot to container host persistence and monetize compromised compute resources through cryptomining." }, "severity": "high", "rationale": "Focus the hunt on containers or servers running Python-based gateways like LiteLLM or orchestration engines like RAGFlow and Kestra. Start with systems identified in the vulnerability scoping step.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder has exploited an exposed AI gateway or orchestration platform to harvest LLM API keys from process memory and exfiltrate tenant configurations from backend databases.", "parameters": { "ai_cves": { "from": { "ref": "msrc-blog", "kind": "article", "observed": "2026-08-26" }, "type": "list[string]", "default": [ "CVE-2026-42271", "CVE-2026-48710", "CVE-2026-49869", "CVE-2026-45312", "CVE-2026-28797", "CVE-2026-24770", "CVE-2025-68700" ], "description": "CVE IDs associated with LiteLLM, RAGFlow, and Kestra infrastructure." }, "scope_hosts": { "from": { "ref": "analyst-provided", "kind": "manual", "observed": "2026-08-26" }, "type": "list[host]", "default": [], "description": "Hosts identified as vulnerable in the lead query; leave empty to hunt across the entire estate." }, "lookback_days": { "from": { "ref": "default", "kind": "manual", "observed": "2026-08-26" }, "type": "number", "default": "14", "description": "Days of historical telemetry to examine." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/", "name": "msrc-blog \u2014 When AI infrastructure becomes the target: Securing gateways and control points" } ], "blind_spots": [ { "id": "vulnerability-scan-lag", "risk": "The gate may close prematurely for a newly deployed, unpatched gateway that is already under attack.", "stage": "initial-access-ai-gateway-exploitation", "question": "whether a gateway was exploited before the daily scan captured the vulnerability", "requires": "hb_vulnerability_finding with real-time container scanning" }, { "id": "no-agent-on-gateway", "risk": "Attacks on shadow AI infrastructure or unmanaged cloud instances will remain invisible to process and environment-block queries.", "stage": "runtime-credential-harvesting", "question": "whether process-level activity occurred on an unmanaged container service", "requires": "endpoint agent installed on the underlying host or sidecar" }, { "id": "database-internal-visibility", "risk": "Network telemetry shows the connection to the database but not the specific records dumped, requiring the analyst to infer intent from the process command line.", "stage": "application-layer-data-exfiltration", "question": "which specific configuration tables were read from the database", "requires": "database audit logging for SELECT statements" } ] }, "name": "AI Gateway Exploitation and Data Theft", "description": "AI infrastructure components like LiteLLM and RAGFlow concentrate high-value secrets, including API keys for model providers and database connection strings. This hunt identifies unpatched AI control points and correlates them with post-exploitation behaviors such as environment variable harvesting and rare connections to managed database instances. It uses a gated flow to first confirm the presence of vulnerable software before fanning out to analyze process and network telemetry for evidence of active compromise." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "when-ai-infrastructure-becomes-the-target-securing-gateways-and-control-points", "index": 1, "title": "When AI infrastructure becomes the target: Securing gateways and control points", "total": 2 }, "coverage": [ { "stage": "initial-access-ai-gateway-exploitation", "steps": [ "vulnerable-ai-infrastructure" ], "status": "covered" }, { "stage": "runtime-credential-harvesting", "steps": [ "runtime-secret-harvesting" ], "status": "covered" }, { "stage": "application-layer-data-exfiltration", "steps": [ "rare-ai-db-connections" ], "status": "covered" }, { "stage": "masqueraded-payload-delivery", "reason": "Belongs to another part of the 'When AI infrastructure becomes the target: Securing gateways and control points' series.", "status": "out_of_scope" }, { "stage": "host-and-miner-discovery", "reason": "Belongs to another part of the 'When AI infrastructure becomes the target: Securing gateways and control points' series.", "status": "out_of_scope" }, { "stage": "resource-hijacking-cryptomining", "reason": "Belongs to another part of the 'When AI infrastructure becomes the target: Securing gateways and control points' series.", "status": "out_of_scope" }, { "stage": "host-persistence-mechanisms", "reason": "Belongs to another part of the 'When AI infrastructure becomes the target: Securing gateways and control points' series.", "status": "out_of_scope" } ], "rationale": "An intruder has exploited an exposed AI gateway or orchestration platform to harvest LLM API keys from process memory and exfiltrate tenant configurations from backend databases.", "blind_spots": [ { "id": "vulnerability-scan-lag", "risk": "The gate may close prematurely for a newly deployed, unpatched gateway that is already under attack.", "stage": "initial-access-ai-gateway-exploitation", "question": "whether a gateway was exploited before the daily scan captured the vulnerability", "requires": "hb_vulnerability_finding with real-time container scanning" }, { "id": "no-agent-on-gateway", "risk": "Attacks on shadow AI infrastructure or unmanaged cloud instances will remain invisible to process and environment-block queries.", "stage": "runtime-credential-harvesting", "question": "whether process-level activity occurred on an unmanaged container service", "requires": "endpoint agent installed on the underlying host or sidecar" }, { "id": "database-internal-visibility", "risk": "Network telemetry shows the connection to the database but not the specific records dumped, requiring the analyst to infer intent from the process command line.", "stage": "application-layer-data-exfiltration", "question": "which specific configuration tables were read from the database", "requires": "database audit logging for SELECT statements" } ], "scoping_notes": "Focus the hunt on containers or servers running Python-based gateways like LiteLLM or orchestration engines like RAGFlow and Kestra. Start with systems identified in the vulnerability scoping step.", "beyond_detection": "A static rule can detect access to /proc/1/environ, but this hunt adds context by pivoting between known AI-specific vulnerabilities, behavioral environment-block harvesting, and fleet-wide prevalence counting of database connections on standard ports." } }, { "id": "vulnerable-ai-infrastructure", "type": "query", "label": "Unpatched AI infrastructure leads", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT d.hostname, v.cve_uid, v.severity, v.affected_package_name, v.title FROM hb_vulnerability_finding v JOIN hb_devices d ON v.device_uid = d.device_uid AND v.provider = d.provider WHERE instr(',' || '{{ai_cves}}' || ',', ',' || v.cve_uid || ',') > 0 AND v.status != 'suppressed' AND v.severity_id >= 3", "surface": "hb_vulnerability_finding", "description": "Identify hosts running AI gateways or orchestration software with active vulnerabilities named in the research.", "expected_signal": "A list of hostnames running vulnerable AI software. Zero rows mean the known initial access surface is likely patched." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Unpatched AI infrastructure leads", "reads": [ "device_uid", "cve_uid", "severity", "affected_package_name", "title", "hostname", "provider" ], "source": "hb_vulnerability_finding", "target": "endpoint", "content": "SELECT d.hostname, v.cve_uid, v.severity, v.affected_package_name, v.title FROM hb_vulnerability_finding v JOIN hb_devices d ON v.device_uid = d.device_uid AND v.provider = d.provider WHERE instr(',' || '{{ai_cves}}' || ',', ',' || v.cve_uid || ',') > 0 AND v.status != 'suppressed' AND v.severity_id >= 3", "silence": "not_evidence_of_absence", "expected": "A list of hostnames running vulnerable AI software. Zero rows mean the known initial access surface is likely patched.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "lead-assessment", "type": "analytic", "label": "Lead risk assessment", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "vulnerable-ai-infrastructure" ], "objective": "Identify whether RAGFlow, LiteLLM, or Kestra instances are unpatched and exposed to RCE.", "description": "Evaluate whether the identified vulnerabilities represent a sufficient risk to proceed with behavioral analysis.", "max_iterations": 3, "expected_signal": "A recommendation to either proceed with the hunt or stop if the risk is low.", "success_criteria": "A clear per-host assessment of the AI infrastructure exposure." }, "parents": [ { "id": "vulnerable-ai-infrastructure" } ] }, { "id": "gate-decision", "type": "checkpoint", "label": "Gate: Open deep behavioral hunt?", "config": { "fuzzy": true, "judge": "hunter", "question": "the lead-assessment indicates at least one host is running vulnerable AI software with high risk of exploitation", "condition": "the lead-assessment indicates at least one host is running vulnerable AI software with high risk of exploitation", "blind_spot": "vulnerability-scan-lag", "confidence": "high", "description": "Halt the hunt if no vulnerable AI control points are found, or proceed if the lead is validated.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "lead-assessment" } ] }, { "id": "runtime-secret-harvesting", "type": "query", "label": "Gateway runtime secret harvesting", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%python%' OR LOWER(process_name) LIKE '%node%') AND (LOWER(process_cmd_line) LIKE '%/proc/1/environ%' OR LOWER(process_cmd_line) LIKE '%master%' OR LOWER(process_cmd_line) LIKE '%api_key%' OR LOWER(process_cmd_line) LIKE '%database_url%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Detect commands reading process environment blocks or searching for AI-specific master keys and API tokens.", "expected_signal": "A process context associated with an AI gateway reading sensitive environment variables. This is a high-confidence behavioral indicator." }, "parents": [ { "id": "gate-decision", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Gateway runtime secret harvesting", "reads": [ "device_hostname", "process_name", "process_cmd_line", "user_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%python%' OR LOWER(process_name) LIKE '%node%') AND (LOWER(process_cmd_line) LIKE '%/proc/1/environ%' OR LOWER(process_cmd_line) LIKE '%master%' OR LOWER(process_cmd_line) LIKE '%api_key%' OR LOWER(process_cmd_line) LIKE '%database_url%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A process context associated with an AI gateway reading sensitive environment variables. This is a high-confidence behavioral indicator.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "rare-ai-db-connections", "type": "query", "label": "Rare AI gateway database connections", "config": { "dsl": "sqlite", "role": "baseline", "source": "network", "content": "SELECT dst_endpoint_hostname, dst_endpoint_port, process_name, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_network_connection WHERE (dst_endpoint_port IN (5432, 3306, 1433) OR LOWER(dst_endpoint_hostname) LIKE '%.postgres.database.azure.com') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY dst_endpoint_hostname, dst_endpoint_port, process_name HAVING host_count < 3 ORDER BY host_count ASC", "surface": "hb_network_connection", "description": "Stack-count network connections to backend AI databases or common database ports to identify anomalous dumping behavior.", "expected_signal": "A specific AI gateway process connecting to a backend database or common DB port on only one or two hosts. This suggests a post-exploitation configuration dump." }, "parents": [ { "id": "gate-decision", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare AI gateway database connections", "reads": [ "dst_endpoint_hostname", "dst_endpoint_port", "process_name", "device_hostname", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT dst_endpoint_hostname, dst_endpoint_port, process_name, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_network_connection WHERE (dst_endpoint_port IN (5432, 3306, 1433) OR LOWER(dst_endpoint_hostname) LIKE '%.postgres.database.azure.com') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY dst_endpoint_hostname, dst_endpoint_port, process_name HAVING host_count < 3 ORDER BY host_count ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A specific AI gateway process connecting to a backend database or common DB port on only one or two hosts. This suggests a post-exploitation configuration dump.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "dst_endpoint_hostname", "dst_endpoint_port", "process_name" ], "rare_below": 3 }, "verified_at": "2026-09-20" } }, { "id": "triage-evaluation", "type": "analytic", "label": "Triage AI infrastructure compromise", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "lead-assessment", "runtime-secret-harvesting", "rare-ai-db-connections" ], "objective": "Determine if any AI gateway host with an unpatched vulnerability shows evidence of environment secret harvesting or rare database connections, citing specific rows.", "description": "Correlate the vulnerability exposure with the observed behavioral signals to confirm an intrusion.", "max_iterations": 6, "expected_signal": "A per-host verdict on whether the AI gateway has been compromised and data exfiltrated.", "success_criteria": "A per-host verdict of malicious | suspicious | benign citing evidence from all context steps." }, "parents": [ { "id": "runtime-secret-harvesting", "kind": "merge" }, { "id": "rare-ai-db-connections", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on triage verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage-evaluation verdict is malicious for at least one AI gateway host", "condition": "the triage-evaluation verdict is malicious for at least one AI gateway host", "blind_spot": "no-agent-on-gateway", "confidence": "high", "description": "Direct high-confidence compromises to action and questionable hits to analyst review.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-evaluation" } ] }, { "id": "isolate-compromised-host", "type": "action", "label": "Isolate compromised AI gateway", "config": { "target": "endpoint", "description": "Prevent further credential or configuration exfiltration.", "instructions": "Isolate the endpoint. Revoke all AI provider master keys and rotate the database connection string found in the environment blocks.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst review and tuning", "config": { "assignee": "analyst", "description": "Verify the automated findings and tune hunt parameters to reduce future false positives.", "instructions": "Examine the processes that read /proc/1/environ. Confirm if the database connections were authorized administrative activity or part of an exploit payload." }, "parents": [ { "id": "gate-decision", "branch": "default" }, { "id": "gate-decision", "branch": "on_unavailable" }, { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-compromised-host" } ] }, { "id": "close-out", "type": "task", "label": "Hunt close-out", "config": { "assignee": "analyst", "description": "Finalize the records and ensure patching is prioritized for vulnerable assets.", "instructions": "Record the findings. If vulnerabilities were present but no behavioral signal was found, issue an urgent request for patching the AI gateway infrastructure." }, "parents": [ { "id": "gate-decision", "branch": "on_refutes" }, { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "analyst-review" } ] } ] }