[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGBrxpuZtJECUgJ56Sa64bURGSraY__A88JR3WMExBrI":3},{"article":4,"iocs":53,"watch_terms":66,"solutions":67,"lesson":158},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"52eede9b-48bc-49ba-ba72-696ff04d96f4","When AI infrastructure becomes the target: Securing gateways and control points","when-ai-infrastructure-becomes-the-target-securing-gateways-and-control-points-1c8a51","Microsoft Threat Intelligence examines attacks on exposed AI workloads, including LiteLLM gateway exploitation, credential harvesting, persistence, and cryptomining activity. The post When AI infrastructure becomes the target: Securing gateways and control points appeared first on Microsoft Security Blog.","Microsoft Threat Intelligence reports on attackers exploiting exposed AI infrastructure, including LiteLLM gateways, RAGFlow, and Kestra workflows. The primary objectives are credential theft, establishing persistence, and monetizing compute resources through cryptomining. Attackers treat these AI platforms as control planes, highlighting the need for robust security measures similar to other critical enterprise infrastructure.","Attackers target exposed AI infrastructure like LiteLLM gateways for credential theft and cryptomining.","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F08\u002F26\u002Fwhen-ai-infrastructure-becomes-target-securing-gateways-control-points\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F03\u002FMS_Actional-Insights_AI-agents.jpg","2026-08-26T16:43:53+00:00","2026-08-26T20:00:30.387189+00:00",8,[17,20,22,24,27],{"name":18,"type":19},"LiteLLM","product",{"name":21,"type":19},"RAGFlow",{"name":23,"type":19},"Kestra",{"name":25,"type":26},"Microsoft","vendor",{"name":28,"type":29},"AI","technology","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":30,"icon":32,"name":33,"slug":34},null,"Threat Intelligence","threat-intelligence",[36,41,46,51],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":52},{"id":30,"icon":32,"name":33,"slug":34},[54,58,60,63],{"type":55,"value":56,"context":57},"cve","CVE-2026-42271","Exploited in LiteLLM gateway compromise",{"type":55,"value":59,"context":57},"CVE-2026-48710",{"type":55,"value":61,"context":62},"CVE-2026-49869","Relevant public vulnerability context for Kestra orchestration surface exploitation",{"type":50,"value":64,"context":65},"XMRig","Deployed in Kestra workflow environment compromise for cryptomining",[25,18,21],{"controls":68,"vendors":152},[69,98,126],{"slug":70,"name":71,"problem":72,"products":73},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[74,82,90],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":99,"name":100,"problem":101,"products":102},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[103,111,118],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":113,"url":116,"description":117},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"slug":127,"name":128,"problem":129,"products":130},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[131,139,147],{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-security-operations","Google Security Operations","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fsecurity-operations","Cloud SIEM and SOAR, formerly Chronicle.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":148,"product_name":149,"url":150,"description":151},"cortex-xsiam","Cortex XSIAM","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xsiam","AI-driven security operations platform that centralises security data, detection, automation and response for the SOC.",[153],{"slug":154,"name":25,"logo_path":155,"roles":156},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[157],"reported_by",{"slug":159,"title":160,"body":161,"framework_refs":162,"framework_notes":176},"ai-infrastructure-gateways-exploited-for-credential-theft-and-cryptomining","AI Infrastructure Gateways Exploited for Credential Theft and Cryptomining","Attackers are increasingly targeting exposed AI infrastructure components — such as LiteLLM gateways, RAGFlow, and Kestra workflows — treating them as high-value control planes rather than peripheral tooling. These systems often handle sensitive credentials, orchestrate workflows, and consume significant compute resources, making them attractive targets for credential harvesting and cryptomining. The root issue is that AI platforms are being deployed without the same security rigor applied to traditional enterprise infrastructure, leaving them internet-exposed with weak or default configurations. As AI adoption accelerates, security teams must recognize that every AI gateway or orchestration layer is a potential attack surface that demands hardening, access controls, and continuous monitoring.",[163,164,165,166,167,168,169,170,171,172,173,174,175],"CIS Control 1 – Inventory and Control of Enterprise Assets","CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 6 – Access Control Management","CIS Control 12 – Network Infrastructure Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 AC-3 – Access Enforcement","NIST SP 800-53 CM-6 – Configuration Settings","NIST SP 800-53 SI-2 – Flaw Remediation","NIST SP 800-53 AU-12 – Audit Record Generation","NIST CSF DE.CM-1 – Network Monitoring","NIST CSF PR.AC-5 – Network Integrity Protection","MITRE ATT&CK T1078 – Valid Accounts","MITRE ATT&CK T1496 – Resource Hijacking",{}]