A threat actor tracked as UNC6993 stole API keys for major AI services including Claude, OpenAI Codex, and Gemini Ultra, then resold access through a grey-market relay called Jet Night, running up fraudulent charges of around 100,000 USD per day. Google's Threat Intelligence Group published a full attribution report this week confirming cumulative losses exceeding one million USD.
How the operation worked
UNC6993 harvested AI service API keys through a combination of open-source repository scanning, phishing campaigns targeting ML engineers, and exploitation of CVE-2026-40217, a server-side request forgery in LiteLLM that allowed the attacker to extract proxied credentials from misconfigured deployments. Keys were then aggregated into Jet Night, a subscription service marketed on Russian-language forums as offering access to tier-1 Western AI without KYC.
CVE-2026-40217: the LiteLLM vector
LiteLLM is an open-source library used to route requests across multiple AI providers from a single API surface. CVE-2026-40217 is a server-side request forgery affecting LiteLLM versions 1.49.0 through 1.52.3. An unauthenticated attacker who can reach the LiteLLM admin API can craft a request that causes the server to fetch internal metadata endpoints, including the credentials file. The patch was released in version 1.52.4 on 28 October 2026.
Scale and attribution
Google GTIG estimated that UNC6993 operated Jet Night for at least 90 days before takedown. At peak, the relay was processing approximately 4.2 million API requests per day across Claude, Codex, and Gemini. Fraudulent charges were billed to the legitimate account holders, most of whom discovered the problem only when receiving unexpected monthly invoices. Attribution to UNC6993 was based on infrastructure overlap with a prior credential-theft campaign and a consistent operational signature in the Jet Night panel code.
What to audit now
Review AI service billing dashboards for unexpected spikes, particularly in the 02:00 to 06:00 UTC window when Jet Night traffic peaked. Rotate any API key stored in an environment variable accessible to a LiteLLM deployment. Upgrade LiteLLM to 1.52.4 or later. Enable spend limits and per-key budgets on AI provider dashboards: Claude, OpenAI, and Google all offer these controls but they are off by default. If your keys were active during August to October 2026 and you used LiteLLM in that period, treat them as compromised.
Written by Gigia Tsiklauri, founder of Infosec.ge.