T1496.004, Cloud Service Hijacking, is the use of compromised SaaS applications to do resource intensive work. It applies to SaaS and falls under impact.
How attackers use it
MITRE gives two main examples. Adversaries may use email and messaging services, such as AWS Simple Email Service, AWS Simple Notification Service, SendGrid and Twilio, to send large volumes of spam or phishing emails and SMS messages. Or they may engage in LLMjacking, using reverse proxies to hijack the power of cloud hosted AI models.
In some cases they use services the victim already uses. In others, particularly when the service is part of a larger cloud platform, they may first enable the service. The effects are large financial cost, used up service quotas, and reduced availability.
MITRE cites reports on mass sending campaigns through cloud email and notification services and on LLMjacking.
How to detect it
MITRE's detection strategy describes an intruder gaining access to cloud hosted services such as AWS SES, AWS SNS or an AI model API, changing usage policies or settings, then running heavy actions such as mass email or SMS sends or model queries. Warning signs include activity from unexpected regions and identities that behave abnormally.
MITRE names no log sources. Useful data: cloud audit logs for service enablement and settings changes, per service usage and cost alerts, and sending reputation metrics.
How to reduce the risk
MITRE says prevention is difficult because the technique abuses normal system features. Limiting how keys leak and what they can do is the practical answer:
- Scan code and configuration for credentials before they are committed or shipped.
- Scope keys narrowly, so a messaging key cannot enable other services.
- Set hard quotas and budget alerts on each service.
- Rotate any key you cannot account for.
Click through it at your own pace, or open it full screen.
Quick check
What is LLMjacking?
Using reverse proxies to hijack the power of cloud hosted AI models.
