XMRig

Darktrace reported on July 9, 2026, that an EC2 LiteLLM-Proxy AI gateway with Amazon Bedrock access was compromised and used for cryptomining, though the initial access path remains unconfirmed. The i…

Attackers compromised an AWS EC2 instance acting as a LiteLLM proxy for Amazon Bedrock, deploying XMRig cryptomining malware and attempting to abuse cloud identities and AI services. Cybersecurity fir…