Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
17 IOCs
From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage
Threat Actors
Malware Families
Excerpt
From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage | Wiz Blog Wiz Platform Solutions Pricing Resources Customers Company Sign in Under attack? Get a demo Blog From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage How a single Google Search ad click leads to credential theft, hijacking of cloud billing account, and hundreds of thousands of dollars incurred in unauthorized AI API usage Get a demo Contact…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(6)
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →17 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | groolg.com | High | Score 58/100 | First seen |
| Domain | gbrokl.xyz | High | Score 58/100 | First seen |
| Domain | gsoosl.xyz | High | Score 58/100 | First seen |
| Domain | gpoosl.com | High | Score 58/100 | First seen |
| Domain | gzoozl.com | High | Score 58/100 | First seen |
| Domain | gboogl.com | High | Score 58/100 | First seen |
| IP | 212.73.134.136 | Medium | Score 47/100 | First seen |
| Domain | groosl.com | High | Score 58/100 | First seen |
| Domain | gcslom.com | High | Score 58/100 | First seen |
| Domain | gsool.space | High | Score 58/100 | First seen |
| Domain | gbrokl.space | High | Score 58/100 | First seen |
| Domain | gsool.xyz | High | Score 58/100 | First seen |
| Domain | gcoalg.com | High | Score 58/100 | First seen |
| Domain | gprokl.com | High | Score 58/100 | First seen |
| Domain | groonl.com | High | Score 58/100 | First seen |
| Domain | gsoolg.com | High | Score 58/100 | First seen |
| Domain | gxoosl.com | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…