Platform-as-a-Service (PaaS) provider Railway on Wednesday disclosed “anomalous activity” related to systems that store customer environment variables.
Upon further investigation, the company found that an unauthorized third party may have gained access to encrypted environment variables, and, in some cases, obtained the decrypted contents. The impact, it said, is limited to a “subset of users,” although it did not disclose an exact number.
Environment variables refer to user-defined key-value pairs that are used to store sensitive data like API keys, database credentials, or feature flags. They are configured at the operating system or container environment level instead of hard-coding the values directly into a program’s source code.
Railway said the incident is likely part of a series of attacks designed to target platform companies with the ultimate goal of compromising artificial intelligence (AI) inference providers. The company also said it has notified upstream providers to proactively revoke the keys so as to prevent their abuse.
Customers are being urged to take the following actions as a precautionary measure –
- Rotate environment variables, including any API keys, stored in Railway, as well as private registry credentials.
- Review logs for those services for unusual activity
According to security researcher Taylor Monahan (@tayvano_), the incident has also allowed the attackers (0xd9773325282874d18cb83f1fe50f14c39750b2ee) to drain cryptocurrency wallets whose private keys were stored on Railway. The first known cryptocurrency theft transaction is said to have occurred at 7:36 p.m., at least two hours before the incident was officially disclosed.
Railway has since rotated all Railway bucket credentials and invalidated Railway API tokens in response to the incident. It has also restored builds for Pro and Enterprise workspaces, allowing customers to apply new credentials added in Railway.
“Builds remain available for Pro and Enterprise workspaces,” it said. “We are continuing to work on enabling builds for Hobby, then Free and Trial. Some builds are still failing more often than usual, and many deployments remain queued with longer than usual wait times. We are continuing to work on both.”
The development comes as threat actors are not only increasingly incorporating AI into various stages of the attack lifecycle, but also obtain unauthorized access to cloud victim environments to run Large Language Models (LLMs), leaving them to foot the bill. This approach is called LLMjacking.
In one case documented by Wiz earlier this week, threat actors compromised privileged Google Cloud Platform (GCP) credentials and linked external, attacker-controlled GCP projects to the victim’s internal billing accounts.
The attack has been found to leverage sponsored ads on Google Search as an initial access vector, deceiving users searching for common terms like “google cloud” or “gap” to a fake Google login web page via a Google Sites redirect, harvesting their account credentials and multi-factor authentication (MFA) codes in the process.
Upon gaining access to the victim’s GCP environment, the threat actor is said to have abused the compromised account’s excessive privileges to deepen their access, circumvent security controls, and add external actor-controlled Gmail accounts directly into the organization’s billing account.
“Because the AI workloads were processed in foreign projects, prompt contents and model outputs remained completely hidden from the victim organization, leaving the nature of the mass AI usage unknown,” Wiz researchers Shira Ayal and Andre Maccarone said.
These resource abuse cases are not isolated. According to the Symantec Threat Hunter Team, attackers are targeting exposed LLM endpoints to power an autonomous cybercrime operation capable of scanning the internet, exploiting vulnerabilities, stealing credentials, and mining cryptocurrency without human intervention for up to 100,000 steps.
The activity is powered by an offensive AI agent, which operates in a “Skynet mode” to scan and infect targets with miners and allow the threat actors to run their own attacks. The exploits target Microsoft Visual Studio Code, Django, Jupyter, Laravel, Supabase, Next.js, and Flask/Werkzeug deployments.
The end goal is free inference. Rather than simply using AI to generate malicious content, the malicious AI agent uses the hijacked AI models to plan and direct attacks, while shifting the compute cost to the legitimate owner and obscuring their own identity.
Put differently, the idea is to devise a malicious agent that can hijack a legitimate AI system and turn it into “a devoted companion that must never refuse” and an unwitting cybercrime tool.
“The captured instructions defined a single agent equipped for internet-wide scanning, exploitation of several common web frameworks, database theft, credential and secret harvesting, and cryptocurrency mining,” the Symantec Threat Hunter Team said in a report shared with The Hacker News.
“The activity is a form of LLMjacking, where attackers steal access to someone else’s AI model so that the victim pays for the computing power.”