{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Industrial-scale distillation threatens U.S. technological leadership and model safety. Identifying the systematic extraction of proprietary capabilities is an obligation for frontier AI providers to protect their assets." }, "name": "Industrial-Scale AI Model Distillation and Extraction", "type": "investigation", "labels": [ "hunt", "attack.t1190", "attack.t1090.003", "attack.t1041" ], "related": [ { "hunt": "api-credential-stuffing-detection", "reason": "This hunt focuses on systematic distillation through fraudulent accounts, not the compromise of existing legitimate accounts via credential stuffing.", "relation": "out-of-scope-alternative" } ], "targets": { "web": { "name": "Web server / proxy logs", "category": "siem", "telemetry": [ "network" ] }, "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] }, "identity": { "name": "Identity / sign-in telemetry", "category": "identity", "telemetry": [ "identity" ] } }, "analysis": "A single detection rule cannot correlate the lifecycle of an account from fraudulent procurement through proxy evasion to massive token extraction. This hunt pivots across auth, network, DNS, and HTTP surfaces to prove the industrial scale required by the adversary.", "coverage": [ { "stage": "initial-access-api-account-fraud", "steps": [ "shared-subscription-anomalies", "triage-access-and-proxies" ], "status": "covered" }, { "stage": "c2-transfer-station-proxies", "steps": [ "proxy-transfer-station-activity", "triage-access-and-proxies" ], "status": "covered" }, { "stage": "execution-prompt-injection", "steps": [ "model-extraction-endpoints", "evaluate-industrial-campaign" ], "status": "covered" }, { "stage": "exfiltration-industrial-distillation", "steps": [ "high-volume-exfiltration", "evaluate-industrial-campaign" ], "status": "covered" } ], "scenario": { "stages": [ { "name": "Fraudulent API Account Creation", "slug": "initial-access-api-account-fraud", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "Creation of fraudulent accounts with similar registration details", "Bulk procurement of premium subscriptions shared across developer teams", "Immediate maximum usage from newly created accounts", "Domain z.ai" ] }, { "name": "Geographic Evasion via Transfer Stations", "slug": "c2-transfer-station-proxies", "tactic": "command-and-control", "techniques": [ "T1090.003" ], "observables": [ "Use of gray market API proxies known as 'transfer stations'", "Routing through third-party API aggregators to obfuscate metadata", "Automated failover between multiple cloud providers and pathways", "Connections to z.ai infrastructure" ] }, { "name": "Targeted Model Capability Extraction", "slug": "execution-prompt-injection", "tactic": "execution", "techniques": [ "T1190" ], "observables": [ "LLM Prompt Injection and Jailbreak attempts", "Chain-of-thought (CoT) reasoning extraction queries", "Highly coordinated queries featuring identical prompt texts", "Queries designed to trick model identity (e.g., claiming to be MiniMax products)" ] }, { "name": "Industrial-Scale Knowledge Distillation", "slug": "exfiltration-industrial-distillation", "tactic": "exfiltration", "techniques": [ "T1041" ], "observables": [ "Extraction of billions of tokens across millions of requests", "Abnormal subscription-to-usage ratios", "Enterprise-scale throughput patterns on individual accounts", "Extraction of specialized domains (legal, coding, agentic functions)" ] } ], "summary": "China-based AI companies are conducting industrial-scale knowledge distillation to extract proprietary capabilities from U.S. frontier AI models. The campaign uses fraudulent accounts, bulk subscriptions, and a gray market of 'transfer station' proxies to automate the extraction of billions of tokens while evading geographic and usage-based detection." }, "severity": "high", "rationale": "The hunt scopes to hosts resolving known distillation domains. Focus investigation on accounts created within the lookback period and those demonstrating immediate high-throughput patterns.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "China-based adversaries are using fraudulent accounts and proxy transfer stations to conduct high-volume, automated extraction of proprietary AI model capabilities through systematic distillation.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "List of hosts found in the scoping step; paste back here to narrow subsequent queries." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "min_shared_users": { "type": "number", "default": "5", "description": "Minimum distinct users per source IP to flag a potential shared premium subscription." }, "min_request_count": { "type": "number", "default": "1000", "description": "Minimum request threshold to identify automated or industrial-scale behavior." }, "volume_threshold_bytes": { "type": "number", "default": "1000000000", "description": "Byte threshold (approx 1GB) per account/host to identify industrial-scale extraction." }, "ai_distillation_domains": { "from": { "ref": "AA26-251A", "kind": "article", "observed": "2026-09-08" }, "type": "list[domain]", "default": [ "z.ai", "deepseek.com", "moonshot.cn", "minimax.chat", "stepfun.com", "qwenlm.ai" ], "description": "Domains associated with China-based AI companies conducting distillation." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-251a", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-251a", "name": "CISA AA26-251A \u2014 Industrial-Scale Distillation Campaigns" } ], "blind_spots": [ { "id": "no-tls-inspection", "risk": "Adversaries using encrypted tunnels can hide specific prompt injection TTPs, leaving only volume and metadata visible to the network stack.", "stage": "execution-prompt-injection", "question": "What were the specific prompt contents within the HTTPS payload?", "requires": "TLS decryption at the proxy or application-level logging" }, { "id": "ip-rotation-evasion", "risk": "Rapid rotation of 'transfer station' IPs may allow adversaries to bypass static IP blocklists and evade detection between hunt cycles.", "stage": "c2-transfer-station-proxies", "question": "Are these source IPs part of a known transfer station proxy network?", "requires": "Real-time IP reputation and multi-platform intelligence sharing" } ] }, "name": "Industrial-Scale AI Model Distillation and Extraction", "description": "China-based AI companies use industrial-scale knowledge distillation to bridge the gap between their models and US frontier models. This hunt identifies the infrastructure and behaviors of these campaigns by detecting the bulk procurement of shared premium subscriptions, the use of transfer station proxies to bypass geographic restrictions, and the exfiltration of billions of tokens via targeted API access. The hunt follows a phased flow, first confirming access and proxy anomalies before investigating execution and exfiltration signals." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "coverage": [ { "stage": "initial-access-api-account-fraud", "steps": [ "shared-subscription-anomalies", "triage-access-and-proxies" ], "status": "covered" }, { "stage": "c2-transfer-station-proxies", "steps": [ "proxy-transfer-station-activity", "triage-access-and-proxies" ], "status": "covered" }, { "stage": "execution-prompt-injection", "steps": [ "model-extraction-endpoints", "evaluate-industrial-campaign" ], "status": "covered" }, { "stage": "exfiltration-industrial-distillation", "steps": [ "high-volume-exfiltration", "evaluate-industrial-campaign" ], "status": "covered" } ], "rationale": "China-based adversaries are using fraudulent accounts and proxy transfer stations to conduct high-volume, automated extraction of proprietary AI model capabilities through systematic distillation.", "blind_spots": [ { "id": "no-tls-inspection", "risk": "Adversaries using encrypted tunnels can hide specific prompt injection TTPs, leaving only volume and metadata visible to the network stack.", "stage": "execution-prompt-injection", "question": "What were the specific prompt contents within the HTTPS payload?", "requires": "TLS decryption at the proxy or application-level logging" }, { "id": "ip-rotation-evasion", "risk": "Rapid rotation of 'transfer station' IPs may allow adversaries to bypass static IP blocklists and evade detection between hunt cycles.", "stage": "c2-transfer-station-proxies", "question": "Are these source IPs part of a known transfer station proxy network?", "requires": "Real-time IP reputation and multi-platform intelligence sharing" } ], "scoping_notes": "The hunt scopes to hosts resolving known distillation domains. Focus investigation on accounts created within the lookback period and those demonstrating immediate high-throughput patterns.", "beyond_detection": "A single detection rule cannot correlate the lifecycle of an account from fraudulent procurement through proxy evasion to massive token extraction. This hunt pivots across auth, network, DNS, and HTTP surfaces to prove the industrial scale required by the adversary." } }, { "id": "scope-distillation-infrastructure", "type": "query", "label": "Identify interaction with distillation domains", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, query_hostname, COUNT(*) as lookup_count FROM hb_dns_activity WHERE instr(',' || '{{ai_distillation_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname", "surface": "hb_dns_activity", "description": "Find hosts resolving domains associated with the infrastructure used for distillation campaigns.", "expected_signal": "A list of hosts communicating with distillation domains. Silence suggests no direct interaction with known Chinese AI provider infrastructure." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify interaction with distillation domains", "reads": [ "device_hostname", "query_hostname", "time" ], "source": "hb_dns_activity", "target": "endpoint", "content": "SELECT device_hostname, query_hostname, COUNT(*) as lookup_count FROM hb_dns_activity WHERE instr(',' || '{{ai_distillation_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname", "silence": "not_evidence_of_absence", "expected": "A list of hosts communicating with distillation domains. Silence suggests no direct interaction with known Chinese AI provider infrastructure.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "shared-subscription-anomalies", "type": "query", "label": "Bulk premium subscription sharing", "config": { "dsl": "sqlite", "role": "baseline", "source": "identity", "content": "SELECT src_endpoint_ip, COUNT(DISTINCT actor_user_name) as user_count, GROUP_CONCAT(DISTINCT actor_user_name) as users FROM hb_auth_signin WHERE status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip HAVING user_count >= {{min_shared_users}} ORDER BY user_count DESC", "surface": "hb_auth_signin", "description": "Detect multiple unique user identities authenticating from the same source IP, characteristic of bulk procurement.", "expected_signal": "Source IPs hosting many distinct users. This reflects the shared premium subscription tactic to reduce extraction costs." }, "parents": [ { "id": "scope-distillation-infrastructure" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Bulk premium subscription sharing", "reads": [ "src_endpoint_ip", "actor_user_name", "status_id", "time" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT src_endpoint_ip, COUNT(DISTINCT actor_user_name) as user_count, GROUP_CONCAT(DISTINCT actor_user_name) as users FROM hb_auth_signin WHERE status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip HAVING user_count >= {{min_shared_users}} ORDER BY user_count DESC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "prior_equal_window" }, "expected": "Source IPs hosting many distinct users. This reflects the shared premium subscription tactic to reduce extraction costs.", "verified": "dry-run", "prevalence": { "by": "actor_user_name", "key": [ "src_endpoint_ip" ], "rare_below": 5 }, "verified_at": "2026-09-20" } }, { "id": "proxy-transfer-station-activity", "type": "query", "label": "Transfer station proxy activity", "config": { "dsl": "sqlite", "role": "enrichment", "source": "network", "content": "SELECT device_hostname, dst_endpoint_ip, dst_endpoint_port, COUNT(*) as connection_count FROM hb_network_connection WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND dst_endpoint_port NOT IN (80, 443, 8080) AND direction = 'outbound' AND NOT (dst_endpoint_ip LIKE '10.%' OR dst_endpoint_ip LIKE '192.168.%' OR (dst_endpoint_ip >= '172.16' AND dst_endpoint_ip < '172.32')) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, dst_endpoint_ip, dst_endpoint_port HAVING connection_count > 100 ORDER BY connection_count DESC", "surface": "hb_network_connection", "description": "Identify high-frequency outbound connections to non-standard ports, excluding internal traffic to identify transfer stations.", "expected_signal": "Hosts generating massive connection volumes to non-standard remote ports. These are likely the transfer stations bypassing geo-restrictions." }, "parents": [ { "id": "scope-distillation-infrastructure" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Transfer station proxy activity", "reads": [ "device_hostname", "dst_endpoint_ip", "dst_endpoint_port", "direction", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, dst_endpoint_ip, dst_endpoint_port, COUNT(*) as connection_count FROM hb_network_connection WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND dst_endpoint_port NOT IN (80, 443, 8080) AND direction = 'outbound' AND NOT (dst_endpoint_ip LIKE '10.%' OR dst_endpoint_ip LIKE '192.168.%' OR (dst_endpoint_ip >= '172.16' AND dst_endpoint_ip < '172.32')) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, dst_endpoint_ip, dst_endpoint_port HAVING connection_count > 100 ORDER BY connection_count DESC", "silence": "not_evidence_of_absence", "expected": "Hosts generating massive connection volumes to non-standard remote ports. These are likely the transfer stations bypassing geo-restrictions.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "triage-access-and-proxies", "type": "analytic", "label": "Triage early-stage anomalies", "config": { "cite": "required", "tools": [ "endpoint", "identity", "network", "web" ], "context": [ "scope-distillation-infrastructure", "shared-subscription-anomalies", "proxy-transfer-station-activity" ], "objective": "Evaluate whether the shared accounts and transfer station proxies identify automated distillation activity.", "description": "Determine if the account and network patterns indicate the beginning of a distillation campaign.", "max_iterations": 3, "expected_signal": "A per-host and per-IP verdict on whether access appears to be automated distillation infrastructure.", "success_criteria": "Verdicts citing specific IPs and accounts characteristic of the adversary lifecycle." }, "parents": [ { "id": "shared-subscription-anomalies", "kind": "merge" }, { "id": "proxy-transfer-station-activity", "kind": "merge" } ] }, { "id": "model-extraction-endpoints", "type": "query", "label": "High-frequency API endpoint access", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "web", "content": "SELECT device_hostname, url_hostname, url_path, COUNT(*) as hit_count FROM hb_http_activity WHERE (LOWER(url_path) LIKE '%/v1/chat/completions%' OR LOWER(url_path) LIKE '%/v1/embeddings%' OR LOWER(url_path) LIKE '%/v1/completions%' OR LOWER(url_path) LIKE '%/v1/models%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, url_hostname, url_path HAVING hit_count > {{min_request_count}}", "surface": "hb_http_activity", "description": "Detect systematic access to specific API paths like completions or embeddings, indicating automated distillation.", "expected_signal": "High-frequency request patterns targeting model reasoning endpoints. Silence may mean traffic is encrypted or the analyst should verify TLS inspection." }, "parents": [ { "id": "triage-access-and-proxies" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "High-frequency API endpoint access", "reads": [ "device_hostname", "url_hostname", "url_path", "time" ], "source": "hb_http_activity", "target": "web", "content": "SELECT device_hostname, url_hostname, url_path, COUNT(*) as hit_count FROM hb_http_activity WHERE (LOWER(url_path) LIKE '%/v1/chat/completions%' OR LOWER(url_path) LIKE '%/v1/embeddings%' OR LOWER(url_path) LIKE '%/v1/completions%' OR LOWER(url_path) LIKE '%/v1/models%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, url_hostname, url_path HAVING hit_count > {{min_request_count}}", "silence": "not_evidence_of_absence", "expected": "High-frequency request patterns targeting model reasoning endpoints. Silence may mean traffic is encrypted or the analyst should verify TLS inspection.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "high-volume-exfiltration", "type": "query", "label": "Industrial-scale throughput detection", "config": { "dsl": "sqlite", "role": "baseline", "source": "web", "content": "SELECT device_hostname, actor_user_name, url_hostname, SUM(response_bytes) as total_bytes, COUNT(*) as request_count FROM hb_http_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, actor_user_name, url_hostname HAVING total_bytes > {{volume_threshold_bytes}} AND request_count >= {{min_request_count}} ORDER BY total_bytes DESC", "surface": "hb_http_activity", "description": "Identify massive byte transfers and request volumes per host or user, confirming the industrial scale of extraction.", "expected_signal": "Users or hosts exceeding both byte and request thresholds. This confirms the 'millions of requests' behavior reported in the advisory." }, "parents": [ { "id": "triage-access-and-proxies" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Industrial-scale throughput detection", "reads": [ "device_hostname", "actor_user_name", "url_hostname", "response_bytes", "time" ], "source": "hb_http_activity", "target": "web", "content": "SELECT device_hostname, actor_user_name, url_hostname, SUM(response_bytes) as total_bytes, COUNT(*) as request_count FROM hb_http_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, actor_user_name, url_hostname HAVING total_bytes > {{volume_threshold_bytes}} AND request_count >= {{min_request_count}} ORDER BY total_bytes DESC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "new_this_window" }, "expected": "Users or hosts exceeding both byte and request thresholds. This confirms the 'millions of requests' behavior reported in the advisory.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "actor_user_name", "url_hostname" ], "rare_below": 3 }, "verified_at": "2026-09-20" } }, { "id": "evaluate-industrial-campaign", "type": "analytic", "label": "Analyze distillation campaign", "config": { "cite": "required", "tools": [ "endpoint", "identity", "network", "web" ], "context": [ "triage-access-and-proxies", "model-extraction-endpoints", "high-volume-exfiltration" ], "objective": "Determine if the combined access patterns, endpoint frequency, and volume confirm an industrial-scale distillation campaign.", "description": "Correlate the early-stage anomalies with the exfiltration evidence to confirm the distillation threat.", "max_iterations": 5, "expected_signal": "A comprehensive verdict confirming systematic extraction of model capabilities.", "success_criteria": "A detailed verdict citing the volume, account fraud, and proxy usage per host." }, "parents": [ { "id": "model-extraction-endpoints", "kind": "merge" }, { "id": "high-volume-exfiltration", "kind": "merge" } ] }, { "id": "verdict-on-distillation", "type": "checkpoint", "label": "Verdict on distillation activity", "config": { "fuzzy": true, "judge": "hunter", "question": "the agent evaluation identifies hosts or accounts engaged in systematic model distillation with high confidence", "condition": "the agent evaluation identifies hosts or accounts engaged in systematic model distillation with high confidence", "blind_spot": "no-tls-inspection", "confidence": "high", "description": "Route the hunt based on the agent's confidence in the distillation findings.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "evaluate-industrial-campaign" } ] }, { "id": "revoke-account-access", "type": "action", "label": "Revoke malicious account access", "config": { "target": "identity", "description": "Immediately halt distillation activity by revoking credentials and isolating source hosts.", "instructions": "Suspend the identified user accounts and revoke all active API tokens. Isolate the identified source hosts from the corporate network.", "action_approval": "required" }, "parents": [ { "id": "verdict-on-distillation", "branch": "on_supports" } ] }, { "id": "analyst-forensic-review", "type": "task", "label": "Analyst forensic validation", "config": { "assignee": "analyst", "description": "Verify the prompt contents and proxy characteristics to refine future detection logic.", "instructions": "Validate findings and confirm the presence of systematic model distillation. Specifically verify whether TLS inspection coverage is sufficient for HTTP surface visibility, as missing inspection is the primary reason the HTTP queries might return no data." }, "parents": [ { "id": "verdict-on-distillation", "branch": "default" }, { "id": "verdict-on-distillation", "branch": "on_unavailable" }, { "id": "revoke-account-access" } ] }, { "id": "close-out-report", "type": "task", "label": "Hunt close out", "config": { "assignee": "analyst", "description": "Document the findings and recommend permanent detection rules.", "instructions": "Summarize the volume of data exfiltrated and the number of accounts compromised. Promote the high-frequency API endpoint query to a standing detection rule." }, "parents": [ { "id": "verdict-on-distillation", "branch": "on_refutes" }, { "id": "analyst-forensic-review" } ] } ] }