Recent investigations by Microsoft have uncovered a surge in cyberattacks targeting the infrastructure that underpins many AI-driven systems—gateways, retrieval services, and workflows—rather than end-user devices or standard cloud servers. By breaching exposed components of platforms like LiteLLM, RAGFlow, and Kestra, attackers are stealing sensitive credentials, maintaining ongoing access, and even hijacking computing resources for cryptocurrency mining. This shift signals a new, more strategic front in cybercrime.
How Gateways Became Goldmines
In the case of LiteLLM, attackers exploited two publicly known vulnerabilities (CVE-2026-42271 and CVE-2026-48710) to enter through an exposed gateway. Once inside, they extracted API keys, tokens, passwords, and database details by probing the container environment, then installed backdoors disguised as typical Linux services to ensure persistence. They also accessed PostgreSQL records and removed traces of competing miners, replicating tactics seen in past container-based breaches.
RAGFlow presented a different profile of compromise. Attackers conducted server-side request requests, later deploying a malicious Python hook nested in the AI model configuration path. Each time the system connected to a provider, the hook harvested such information as API keys, model types, endpoints, and provider metadata—all without raising suspicion.
Kestra’s Twist: Mining and Stealth
Kestra was targeted via CVE-2026-49869, a critical flaw that allowed authentication bypass. This allowed malicious workflows to execute shell commands, gather Docker socket data, environment settings, and ultimately deploy XMRig to mine Monero using victim machines. To stay hidden and survive reboots, attackers adjusted ssh keys, altered cron jobs, used apparently legitimate service names, set files immutable, and established restart loops controlling their foothold.
What To Do Now: Signals and Defenses
Microsoft advises organizations to immediately patch exposed AI services, rotate any credentials linked to breached gateways, and closely monitor unusual database and provider account usage. Suspicious activities—such as shell or Python processes spawned by AI tools, unexpected writes to service-oriented files, or outbound traffic to strange destinations—should be investigated.
Best practices stress treating AI gateways as custodians of high-value secrets. That means using managed secret stores for API keys instead of environment variables, limiting service account privilege, isolating admin interfaces from the public internet, and enforcing strict network segmentation. Monitoring should include DNS callbacks, changes to SSH authorized_keys or cron, execution from temporary directories, and raw IP traffic—any of which could give early warning of a breach.
Indicators of Compromise tied to these campaigns include specific IPv4 and IPv6 addresses, domains like those used for callback or mining pools, and ports associated with Monero mining. These technical fingerprints help to identify ongoing or past attacks.
Analytical Take: This wave of attacks marks a turning point in how threat actors approach AI environments: instead of attacking models or data directly, they’re targeting the plumbing—the systems that AI tools rely on for credential management, workflow orchestration, and compute resources. For organizations adopting AI, this underscores that securing models alone isn’t enough. Defenders must harden every layer—from gateways to containers—and take operational hygiene as seriously as model accuracy. Watch for emerging exploits tied to new vulnerabilities, and assume that any exposed surface in your AI stack can be weaponized if left unguarded.
