Chainalysis, a cybersecurity firm investigating the agentic cyber attack on its systems, has disclosed that its ongoing investigation has uncovered usernames, password hashes, and live tokens for all affected users.
"At this point, we do not have evidence that any investigation data has been accessed or that Chainalysis' attribution data has been tampered with." Chainalysis has enhanced its proactive monitoring systems to detect unusual activity and has taken the Know Your Transaction (KYT) user interface and API offline, along with other address screening products and the login page.
The monetization infrastructure revolves around LLM Mixers, who act as an illicit intermediary to advertise compromised enterprise LLM accounts on underground markets without customers needing legitimate API credentials or cloud infrastructure. In essence, LLM mixers transform stolen enterprise model access into a gateway for paying subscribers, while legitimate systems continue to accept requests.
Last month, Zeabur disclosed a security breach in which an unknown threat actor exploited credentials stored in plaintext to compromise its infrastructure, exfiltrating over 3.2 million environment variable records and data associated with 321,810 accounts. Threat actors are not only using AI as a tool to conduct attacks but are also compromising victim environments solely to abuse their finances for mass Large Language Model (LLM) execution, incurring hundreds of thousands of dollars in AI API charges, as Wiz stated.
