Darktrace researchers said they observed cryptomining activity on an AWS EC2 instance tied to Amazon Bedrock access, highlighting how familiar cloud security risks are extending into enterprise AI infrastructure.
The June 12 activity involved an instance named LiteLLM-Proxy, which Darktrace said appeared to support LiteLLM operations and function as a gateway to Bedrock-hosted AI services. The activity was consistent with Monero mining, the company said.
Cryptomining on cloud servers is a common form of post-compromise activity in which attackers use exposed or poorly secured cloud resources to run mining software at the victim’s expense. In this case, the significance was not the miner alone, but the role of the affected asset.
Why the Asset Raised the Stakes
AI gateways sit between enterprise applications and the foundation models those applications rely on. In many environments, they decide which requests are allowed, where those requests are routed, and what activity gets logged.
That role can make them useful for managing enterprise AI deployments. It can also make them sensitive infrastructure. Depending on the deployment, a gateway may hold cloud permissions or model access that would make a compromise more consequential than the abuse of an ordinary workload.
The concern is that a compromise of such infrastructure may not stop at unauthorized compute use. If the gateway has broad permissions or access to model services, attackers may be operating closer to the systems that govern enterprise AI activity.
SSH Exposure Was a Plausible Access Path
Darktrace did not confirm the initial access vector. But before the cryptomining activity, the LiteLLM-Proxy instance was exposed over SSH, with port 22 open to 0.0.0.0/0, meaning the management port was reachable from the public internet.
The company also saw a high volume of connection attempts to the instance from external IP addresses. Many were short-lived, lasting only a few seconds, which Darktrace said suggested scanning, failed login attempts, or brute-force activity.
Darktrace could not determine from the available evidence whether anyone successfully logged in over SSH. Still, the sequence made SSH a plausible focus for investigators.
Instance Connected to Mining Infrastructure
Before the instance began contacting the mining pool, it pulled a 3.42 MB file over HTTP from an outside server. Darktrace said the server appeared to be hosting a ZIP archive linked to XMRig, a Monero mining tool.
Darktrace said host-level logs were not available, so it couldn’t confirm how the mining software was launched or whether the earlier SSH activity played a role.
Soon after the download, the LiteLLM-Proxy instance began making repeated outbound connections to pool.hasvault[.]pro, a known mining-pool hostname. Darktrace said the pattern was consistent with active cryptomining pool communication.
The activity triggered Darktrace’s Enhanced Monitoring model for high-priority cryptocurrency mining. The company’s Managed Threat Detection service reviewed the activity and notified the customer.
Sean Malone, chief information security officer at BeyondTrust, said the incident followed a pattern long seen in cloud intrusions.
“Strip off the AI branding and this is a cloud intrusion pattern we’ve been watching since at least 2018: SSH open to the internet, brute-force attempts, a commodity XMRig miner, and repeated connections to a mining pool,” Malone said.
Separate IAM Activity Raised Additional Concerns
Darktrace also observed a separate thread of suspicious IAM activity the next day involving an additional IAM user.
On June 13, the user attempted an AWS GetSendQuota action from an IP address geolocated in Vietnam. Darktrace said that location was unusual for the user, whose previous activity had mostly come from Amazon IP addresses. The activity also involved AWS CLI use, which was atypical for the account.
The same IAM user was later associated with failed InvokeModel and ListFoundationModels commands, suggesting attempted interaction with Amazon Bedrock services, including model invocation or model enumeration. The user also attempted a CreateUser action using what Darktrace described as a low-meaning username, which the company said could indicate an attempt to establish persistence.
Darktrace could not confirm that the IAM activity was connected to the LiteLLM-Proxy incident from the previous day.
Even without a confirmed link, the IAM activity expanded the scope of concern. The EC2 activity pointed to compute resource abuse, while the IAM activity suggested possible credential misuse and attempted interaction with cloud and AI services.
Security Takeaways
Security teams should treat AI gateways as privileged cloud infrastructure, Darktrace said.
The most immediate step is to limit administrative exposure. SSH should not be open to the public internet, and gateway permissions should be scoped to the work the system actually needs to perform. Organizations should also reduce reliance on long-term access keys where possible.
Darktrace said the case also points to the need for broader monitoring. A cryptomining alert on an EC2 instance may look like one problem, while unusual AWS CLI activity or failed Bedrock-related calls may look like another. In AI environments, those signals need to be reviewed together.
