T1496 Resource Hijacking

2 threats tracked by Spectrum Delta use this technique.

T1496 on MITRE ATT&CK →

• Yoba signed-AI sideload

  XMRig mines via local Tor proxy

  Network flows can show the reported obfs4 bridge connections; EID 7045 may show conditional WinRing0 installation. These corroborate the reported stage but do not alone prove XMRig or reveal the onion destination. CPR describes the observed miner running injected into svchost.exe; a separate xmrig.exe creation event is not established.

  Seen in: Windows service install, DNS / proxy / flow

• GCP billing LLMjacking

  Resource hijacking: LLM inference billed to the victim

  Cloud Billing audit logs and cost/billing export telemetry: abnormal API-usage cost surges above established baseline; note the companion analysis warns billing-audit latency makes this a late signal (B/3) and that project-level budget caps do not cover the attacker's projects — billing-account-level budgets are required (B/3)

  Seen in: Cloud Billing audit logs / cost export