eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
LLMJacking Monetizes Hijacked Cloud Models
Bottom Line: LLMJacking is an emerging attack method involving threat actors hijacking companies' Large Language Models. The simple monetization of this technique is likely to lead to an increase in related attacks.
Researchers from Google Threat Intelligence Group (GTIG) and Mandiant observed a significant increase in "LLMJacking" activity during 2026, where threat actors compromise cloud-hosted Artificial Intelligence (AI) resources and monetize unauthorized access to Large Language Models (LLMs). These intrusions impacted organizations in North America, South America, and Asia Pacific region across the financial services, retail, technology, and transportation sectors. LLMJacking generates immediate and substantial financial impact by abusing premium AI services, with some victim organizations incurring more than $100,000 USD in fraudulent charges within a single day and cumulative losses exceeding $1 million USD before access was revoked.
The investigation found that threat actors primarily gain access through exposed or stolen cloud identity credentials, including IAM credentials, service account keys, GitHub Personal Access Tokens (PATs), and active session tokens. In one incident, UNC6993 compromised a cloud environment through a misconfigured service account key and leveraged that access to obtain permissions for an LLM API. The same threat actor also hosted a session hijacking page designed to steal active session tokens from users by convincing them to submit JSON authentication data containing valid access tokens. Researchers also observed threat actors harvesting exposed corporate LLM API keys from public GitHub repositories and conducting automated validation sweeps. This low-volume activity allowed attackers to verify the validity of stolen credentials while avoiding detection by security monitoring tools.
After establishing initial access, threat actors conducted extensive reconnaissance to identify additional credentials, cloud services, repositories, and data stores. In several incidents, attackers searched source code repositories for hardcoded secrets, cloud configuration files, and developer credentials. They also queried databases and cloud data warehouses to locate administrator passwords, API keys, and sensitive business data.
The ultimate objective of LLMJacking operations is the monetization of compromised AI resources. One of the report's findings is the emergence of "LLM Mixers," which function as underground marketplaces that aggregate stolen AI access and resell it to subscribers.
eSentire Threat Intelligence Analysis:
GTIG assesses that LLMJacking is likely to become increasingly attractive to cybercriminals because it offers faster and more profitable monetization opportunities than traditional resource theft techniques such as cryptojacking. As organizations continue integrating advanced AI models and agentic workflows into production environments, threat actors are expected to intensify efforts to locate exposed API keys, compromise cloud identities, and exploit vulnerabilities in AI model gateways and routing platforms.
The emergence of specialized access brokers, LLM Mixers, and AI-focused monetization infrastructure demonstrates that AI resource theft has evolved into a structured criminal ecosystem. Organizations that deploy cloud-based AI capabilities should therefore consider AI infrastructure, API keys, model gateways, and agent frameworks as high-value assets that require the same level of protection as privileged cloud identities and business-critical systems.
Organizations should also monitor cloud audit logs and AI service telemetry for indicators of abuse, including unusual inference activity, unauthorized service activation, creation of new API keys, excessive token consumption, and low-volume credential validation requests. Budget alerts, API quotas, and model-specific access controls should be implemented to limit financial exposure in the event of a compromise. The eSentire Threat Intelligence team is actively tracking this topic for additional details and detection opportunities.
Vishing Campaigns Lead to Data Extortion
Bottom Line: In recent weeks, eSentire's Threat Response Unit (TRU) has identified an increase in vishing attacks leading to data extortion against organizations in the legal, financial, and healthcare sectors.
On November 3rd, 2026, eSentire published a security advisory describing a rise in impersonation-based vishing (voice phishing) attacks leading to data extortion, primarily affecting legal, healthcare, and financial services organizations. These attacks use both direct phone calls and Microsoft Teams impersonation as initial contact channels. The patterns observed in these specific cases line up with reporting on the UNC6671 threat actor group. UNC6671 is a threat cluster that Google Threat Intelligence Group (GTIG) has publicly tracked since at least early 2026; the group has utilized various branded names to conduct their activity, including BlackFile, Redact, Pink, Helix, and Falcon. Outside of this specific campaign, eSentire continues to observe high volumes of Microsoft Teams-based vishing attempts against manufacturing, business services, and retail organizations.
Within the eSentire-investigated cases, the attack chain began with threat actors contacting employees either by direct phone call or over Microsoft Teams, impersonating IT Support staff or a named colleague, and directing them to Adversary in the Middle (AiTM) phishing pages themed to look like their own organization. Okta researchers identified UNC6671-linked actors using a web-based operator console called “Work Panel” to run these campaigns, which draws on RocketReach, a commercial business contact data service, to automatically pull employee names, phone numbers, job titles, and social profiles for targeting. Notably, the use of phone calls as an initial contact method is a new addition to this campaign’s tradecraft, which had previously relied on Teams impersonation. With the captured session, attackers registered new MFA methods or devices on the compromised account. In one case, a user approved a rogue Microsoft Authenticator registration, and in another, a victim was convinced during a Teams call to grant remote control of their device through Zoom. Attackers then exfiltrated data from OneDrive, SharePoint, Citrix Workspace, and Google Drive, and used the stolen data to demand payment under threat of public release.
eSentire detailed three specific cases illustrating the speed and scale of this activity. In one, 127 members of a single customer organization were called by phone within one hour, all from the same phone number. One employee who answered was redirected to a tailored AiTM page, and the attacker relayed the captured session to exfiltrate OneDrive data in under 10 minutes. In a second case, a user approved a rogue Authenticator App registration that gave the attacker access to Citrix Workspace, with stolen data subsequently moved to Google Drive ahead of an extortion demand. In a third, a Teams call convinced a user to grant Zoom remote control, again resulting in data copied to Google Drive before extortion attempts.
eSentire Threat Intelligence Analysis:
This activity reflects a broader shift in credential-theft tradecraft away from static phishing pages and toward attacks that exploit the user directly. The entire chain, the vishing pretext, the AiTM session-token capture, and the MFA or device registration abuse, depends on convincing a person to act, not on exploiting a flaw in software or deploying malware. This makes the activity difficult to detect; initial contact may occur via a phone call or a personal device, channels that sit outside an organization’s monitored environment, limiting available telemetry until the attack progresses to later stages.
GTIG’s tracking of UNC6671 shows this is not a short-lived campaign but an operation that has sustained itself for the better part of a year, shifted its extortion branding multiple times, and adjusted its targeting from opportunistic industries toward high value sectors like private equity, law firms, and financial agencies, where stolen data carries outsized extortion value. The mass-calling case eSentire observed, 127 employees contacted within a single hour from one phone number, demonstrates that this is a volume-oriented operation optimized for speed. Once a single employee is compromised, the window from initial contact to data exfiltration can be under 10 minutes, leaving very little time for manual detection and response to intervene before data has already left the environment. The use of a commercial contact data service to automate target selection further lowers the operational cost of running these campaigns at scale. eSentire’s TRU team assesses with high confidence that UNC6671 will continue conducting vishing campaigns, and that additional threat actor groups will adopt similar techniques.
Organizations can defend against similar attacks by implementing identity controls to reduce the impact of compromised credentials. Refer to the eSentire advisory Increase in Impersonation Vishing Attacks Leading to Data Extortion for a full list of actionable recommendations. In response to the increase in vishing activity, eSentire has created new MDR for Log detections and blocked known malicious IP addresses via the Global Block list for MDR for Network customers. This topic will be discussed in more detail in the November 10th TRU Intelligence Briefing webinar.
CISA Warns of Attacks Targeting Industrial Refrigeration Systems
Bottom Line: Various government agencies are warning of cyberattacks against industrial refrigeration units. Real-world implications of this activity include the risk of product damage, fires, and possible harm to individuals.
On November 5th, 2026, CISA, the FBI, the Department of Health and Human Services (HHS), the U.S. Department of Agriculture (USDA), and the Department of Transportation (DoT) issued a joint advisory warning of cyberattacks targeting industrial refrigeration and cold chain monitoring systems globally. These attacks are targeting electronic temperature controllers to alter settings and force units into “continuous heating and defrost cycles”. These controllers are leveraged in various industries, including the Healthcare and Public Health, Chemical, Food and Agriculture, and Transportation Systems, and used to perform a variety of functions, such as refrigerated transport services, automated and remote monitoring of temperatures, continuous temperature logging, defrost cycle management, and energy optimization.
Threat actors are exploiting vulnerabilities and weaknesses within Internet-accessible systems, such as authentication bypass, arbitrary code injection, or weak configurations. CISA states that successful attacks can lead to threat actors changing temperature settings on impacted devices, resulting in equipment damage, fire hazards, loss of inventory, and possible public safety through the consumption of products after unsafe storage conditions. The advisory states that organizations utilizing these devices should enforce strong authentication, ensure software updates are applied, identify Internet-exposed systems, and restrict access to allow-listed IP addresses and devices only.
eSentire Threat Intelligence Analysis:
The joint advisory follows reporting over the past several weeks of attacks targeting supermarkets and a blood bank in Europe. In one attack in October 2026 against a French supermarket chain, attackers were able to modify the temperature controls on refrigerators, raising temperatures to 50°C (122°F), spoiling perishable food and causing fires. In November 2026, similar attacks were seen against supermarkets across Europe, resulting in “stock losses”. The attack against a French blood bank involved threat actors increasing temperatures within cold stores that held blood samples and bags of plasma but resulted in “no loss of blood product”. Cyberattacks like these, that cause real-world physical impacts, may be seen as valuable to state-sponsored threat actors in strategic disruption campaigns. Additionally, hacktivist groups may adopt similar tactics, as disruptions receive significant media attention, amplifying the attackers message. Although no specific threat actor has been attributed to the attacks, the range of targeted industries across Europe, and concerns from US federal agencies, suggests that attacks may be opportunistic, but the motivations, outside of causing disruptions, are unclear.
These attacks highlight the increased risk against organizations involved within critical supply chains. Targeting food services can potentially result in food shortages and elevated food prices for a population, as well as physical harm risks and financial losses. CISA's inclusion of HHS, USDA, and DoT within the advisory reinforce this idea, likely as the impact of these attacks extend beyond financial losses and into supply chain interruptions and public safety risks. The timing of these attacks is notable, as they follow recent advisories from CISA and the FBI on cyberattacks targeting Operational Technology (OT) and Programmable Logic Controller (PLC) devices against other critical infrastructure, including water and wastewater, manufacturing, and the energy sector. These advisories highlight similar impacts, including water shortages, production disruptions, and personnel safety risks, demonstrating why these devices are attractive targets for cyber operations.
Although CISA did not outline any specific brands of industrial refrigeration and cold chain monitoring systems being targeted, or mention a specific vulnerability, organizations utilizing these systems should ensure that the recommended mitigation steps are taken, as there is current elevated risk of attacks.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
