Money for Nothing

Seventy-four keys in twenty-one days. All of them stolen from sites protected by MIRE/C³, all of them fake, and not one got further than “who am I?”.

Another One Bites the Dust covered the first forty. The point came where we understood what they actually came for, and what happened when they received it.

Canary keys 1–74 · 9–30 October 2026. All times are Swiss local time.

What they came for

15 October, 14:18. A Datacamp address in Madrid asked a site for fifty-one files in a minute. It got a key. Twenty-eight seconds later it asked Amazon which AI models the account could run and tried running it.

The next morning, a scanner went through another site’s AI-proxy configs: LiteLLM, Bedrock, OpenAI. MIRE handed out a key, and within three minutes 53 home connections in a dozen countries had each made one call with it. 31 more came back and asked for Claude (we don’t blame them, personally).

Two days confirmed the clear message. They didn’t want our servers but rather wanted some AI resources on somebody else’s bill.

So we rebuilt the shop.

Rebuilding the shop

2026.11 came out early, on 22 October. Impatient? Guilty. It brought:

• LiteLLM, OpenAI, Anthropic and Bedrock configs that look like the real thing;
• AWS files that agree with the canary inside them;
• one company per site, so the bait tells a consistent story;
• a git repository for those who dump .git;
• canaries in every handler, not just .env.

Three days later, 2026.11.1 added SQL dumps with a key in the settings table.

The numbers

Week	Keys handed out	Used	Hit rate	Calls
9–15 Oct	534	16	3.0%	347
16–22 Oct	733	19	2.6%	1’342
23–29 Oct	769	35	4.6%	2’777

Week two saw more keys snatched but proportionally fewer of them got used. This led to more fine-tuning.

Week three, after the fine-tune, had about the same number of keys but nearly twice as many got used and the calls went up eightfold.

The AI bait brought in a crew of its own, the Proxy Swarm: around ninety home lines in a residential proxy making one call each. The number of different tools doubled, from five to ten: Boto3, Go, Java, python-httpx, a script dressed as a browser, and the TruffleHog tool, run by a visitor we call the Truffle Farm. Most of them came in through thefts from plain .env files.

And everyone wanted AI anyway. Of the 5’374 calls made from 74 keys, 1’561 asked for Bedrock. Half of those keys had been stolen from plain .env files with no mention of AI anywhere, yet all were checked for AI capabilities.

What they tried

• 2’632 calls for mail and SMS. Can this account send spam? No.
• 1’561 for AI. Can it run Claude? No.
• 312 RunInstances. Can it start a server? No. That was mostly the Bedrock Mole, which now wants machines as well as models.
• 10 attempts to create a user or role. The Locksmith tries to cut a key of its own every visit. Ten blanks, zero keys.

408 calls worked, and every single one was GetCallerIdentity.

Hand to hand

One more thing turned up along the way. The address that steals a key often isn’t the one that uses it.

The Night Queue never visits the sites but rather works from Amazon’s data centres, sweeps seventeen regions and asks only about mail and SMS. All 13 of its keys were acquired from IPs in one French hosting network, Bucklog. Bucklog touched 3% of the keys stolen from 21 October. The Night Queue trying thirteen out of thirteen is no coincidence; this threat actor is collecting with one tool and testing with another.

Early on the Night Queue would test a key after five and a half hours. Then 32 minutes, then two. On 30 October at 06:06, a key collected by Bucklog was used in the same second by the Night Queue.

Is that two outfits trading keys, or one outfit with two kinds of rented machine? It’s not yet clear but what becomes crystal clear is that collecting and spending is happening on different networks, and the handover is getting quicker.

There are other pairs: a Dutch host feeding the Mole, a Berlin checker following DigitalOcean, a US home line testing keys from two hosting firms. A strong indication that needs more data to become a conclusion.

The small print

One caveat. Until 30 October, MIRE gave anyone who asked for something dull the newest key it already had and that key was often shared with another threat actor. Many keys passed through several hands, and only 39 of the 74 have a single collector, thus making attribution difficult. For the rest, “who stole it” is a shortlist. The Bucklog link is established: Bucklog was on the shortlist for all thirteen Night Queue keys, while it touched only 3% of keys overall. The other pairs aren’t that strong yet.

Three weeks is also not a controlled experiment. If the whole internet got hungrier at the same time, the outcome would be similar. The bait mix is the best evidence we have: in week three, about a third of the used keys came from bait that didn’t exist two weeks earlier.

Verdict

They came for AI. When we gave them a convincing reason to stay, they brought their friends. The lure works, and the shop’s busier than ever.

Seventy-four keys, 5’374 attempts, zero accounts. Money for nothing. Nobody gets the chips for free.

Come back and see what November brings…!