--- title: Attack on Amazon Bedrock-linked AI gateway highlights... description: A cloud intrusion targeting an AWS EC2 instance running a LiteLLM proxy connected to Amazon Bedrock ended with XMRig cryptomining malware deployment. Darktrace... canonical: https://daily.dev/posts/attack-on-amazon-bedrock-linked-ai-gateway-highlights-new-cloud-security-risk-dkjcaq787 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Attack on Amazon Bedrock-linked AI gateway highlights new cloud security risk | daily.dev og:description: A cloud intrusion targeting an AWS EC2 instance running a LiteLLM proxy connected to Amazon Bedrock ended with XMRig cryptomining malware deployment. Darktrace... og:url: https://daily.dev/posts/attack-on-amazon-bedrock-linked-ai-gateway-highlights-new-cloud-security-risk-dkjcaq787 og:image: https://api.daily.dev/og/posts/DkjCaq787.png og:image:alt: Attack on Amazon Bedrock-linked AI gateway highlights new cloud security risk og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Attack on Amazon Bedrock-linked AI gateway highlights new cloud security risk **[CSO Online](https://daily.dev/sources/csoonline)** · 4 min read · 0 upvotes · 0 comments ## Summary A cloud intrusion targeting an AWS EC2 instance running a LiteLLM proxy connected to Amazon Bedrock ended with XMRig cryptomining malware deployment. Darktrace researchers found the attack followed a familiar pattern: SSH exposed to the internet, brute-force access, and credential abuse to probe Bedrock model access — a technique known as LLMjacking. The deeper concern raised by security experts is that AI gateways increasingly centralize cloud identities, IAM permissions, and foundation model access into a single privileged system, making them high-value targets. Suspicious IAM activity including attempts to enumerate Bedrock models and create new IAM users was also observed. Recommended mitigations include closing public admin paths, scoping IAM permissions tightly, and monitoring model access patterns. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [AI Gateways Offer Attackers the Keys to the Kingdom](https://daily.dev/posts/ai-gateways-offer-attackers-the-keys-to-the-kingdom-rvnm2d9ql) · Dark Reading · 0 upvotes · 0 comments - [Compromised IAM Credentials Power a Large AWS Crypto Mining Campaign](https://daily.dev/posts/compromised-iam-credentials-power-a-large-aws-crypto-mining-campaign-84goyuz0s) · The Hacker News · 0 upvotes · 0 comments - [Crypto crooks co-opt stolen AWS creds to mine coins](https://daily.dev/posts/crypto-crooks-co-opt-stolen-aws-creds-to-mine-coins-1jnwvi7wk) · The Register · 1 upvotes · 0 comments - [When AI Remembers Too Much – Persistent Behaviors in Agents’ Memory](https://daily.dev/posts/when-ai-remembers-too-much-persistent-behaviors-in-agents-memory-glpnvqy1w) · Unit 42 · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#aws](https://daily.dev/tags/aws), [#amazon-bedrock](https://daily.dev/tags/amazon-bedrock) [View this post on daily.dev](https://daily.dev/posts/attack-on-amazon-bedrock-linked-ai-gateway-highlights-new-cloud-security-risk-dkjcaq787) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Attack on Amazon Bedrock-linked AI gateway highlights new cloud security risk","url":"https://daily.dev/posts/attack-on-amazon-bedrock-linked-ai-gateway-highlights-new-cloud-security-risk-dkjcaq787","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/attack-on-amazon-bedrock-linked-ai-gateway-highlights-new-cloud-security-risk-dkjcaq787"},"datePublished":"2026-07-09T13:02:35.662Z","dateModified":"2026-07-09T13:03:02.524Z","description":"A cloud intrusion targeting an AWS EC2 instance running a LiteLLM proxy connected to Amazon Bedrock ended with XMRig cryptomining malware deployment. Darktrace...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9cb8dc54625d1821adb16da3e0716ac3?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9cb8dc54625d1821adb16da3e0716ac3?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/attack-on-amazon-bedrock-linked-ai-gateway-highlights-new-cloud-security-risk-dkjcaq787","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,aws,amazon-bedrock","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"Attack on Amazon Bedrock-linked AI gateway highlights new cloud security risk"}]} ```