Hackers Compromise AWS AI Gateway Connected to Amazon Bedrock to Deploy XMRig Cryptominer

A Darktrace-detected compromise of an AWS EC2 AI gateway (LiteLLM-Proxy) occurred after exposed SSH was brute-forced, enabling the download of XMRig cryptomining malware from an external IP and subsequent connections to a mining pool; the SOC escalated the detection and later observed anomalous IAM activity (suspicious Bedrock-related API calls and a CreateUser attempt) from an unusual IP, raising concerns about credential misuse and persistence in an environment that centralizes privileged model and cloud access.