Attackers Targeting LLMs in Widespread Campaign

Security researchers observed a large-scale reconnaissance campaign that probed over 73 LLM endpoints across major model families (OpenAI, Anthropic, Meta, Google, Mistral, Alibaba, xAI, etc.) to identify misconfigured proxies that could leak commercial API access, generating ~80,469 sessions from two primary IPs; a separate set of activity targeted SSRF vulnerabilities and webhook integrations. The report lists IOCs (IP addresses, ASNs, JA4 signature), assesses likely attacker intent to build exploitation target lists, and recommends hardening model pulls, egress filtering, rate-limiting suspicious ASNs, and detecting enumeration patterns.