LLM Relay Infrastructure: Over 80,000 Nodes Obscure User Attribution and Regional Controls

1. Basic Information

• Original Title: Relaying to the Frontier
• Publisher: Team Cymru
• Published Date: 2026-09-22
• Collected Date: 2026-09-23T08:14:06+09:00
• Original: Team Cymru
• Severity: high
• Basis of Severity: Team Cymru initially identified 10,867 confirmed CRS/sub2api transfer stations during an eight-day scanning window. A later count covering a broader set of gateway and relay software tags exceeded 80,000 nodes. In a specific US relay cluster, approximately 14 TB of uploads and 7 TB of downloads were observed over eight days. However, not all credentials are confirmed to be stolen, and the traffic contents are not visible, meaning that uses such as model distillation remain inferred and have not been confirmed.
• Related Source: Dark Reading: LLM Relay Gateways Undermine AI Safety Controls
• Related Source: GitHub: Wei-Shaw/claude-relay-service
• Related Source: GitHub: Wei-Shaw/sub2api
• Related Malware: None
• Related Threat Group: Unattributed
• CVE: None
• Target Products and Services: Claude Relay Service (CRS), sub2api, OpenAI, Anthropic Claude, Google Gemini, xAI

2. Executive Summary

Gateways such as CRS and sub2api bundle multiple subscriptions, API keys, and session tokens, forwarding user requests to AI services via relays in other regions. While large-scale traffic has been observed, the origin of the credentials, prompt contents, and execution of model distillation have not been verified.

3. Attack Flow

The following outlines the mechanism of the relay infrastructure and public software observed by Team Cymru. This does not imply that all usage is malicious or that all credentials were stolen.

Credential Pools and Inter-Region Relays

1. Relay operators pool subscription accounts, API keys, OAuth tokens, and session tokens. These may be obtained through sharing, resale, promotion abuse, or theft, but the exact breakdown is unknown.
2. Users in locations such as China and Hong Kong send requests to relay gateways using CRS or sub2api.
3. The gateway selects credentials from the pool and forwards the traffic to relays established in locations like the US.
4. The relays connect to AI services such as OpenAI, Anthropic, Google, and xAI using valid credentials.
5. Responses are returned to the user via the same path. Because service providers see the relay IP addresses and shared accounts rather than the actual users, regional attribution, user attribution, and rate controls are weakened.

4. Attacker Location and Execution Point

• Relay gateway operators, account suppliers, and users attempting to bypass regional, contractual, and usage restrictions may be involved.
• Users connect to the gateways from locations such as China and Hong Kong, and some exit nodes observed in public research were located in the US.
• Final connections to the AI services are made using pooled valid credentials and the source IP addresses of the relays.

5. Perspective of Victims and Administrators

Victims

• Legitimate owners of the credentials may notice third-party use as increased billing, rate limiting, or unfamiliar usage history. The provenance of the credentials used by the relays is unknown; they should not be characterized collectively as stolen.

Administrators

• Indicators include the use of single accounts or API keys from numerous IPs and ASNs, geographically inconsistent access, abnormal token consumption, and connections from the same relay to multiple accounts.

6. Success and Failure Conditions

Success Conditions

• The gateway is able to use valid subscriptions, API keys, OAuth tokens, and session tokens on the AI service.
• Communication from the user to the gateway, the relay, and the AI service is permitted.
• The service provider accepts requests via shared credentials and relays as valid usage.

Failure and Prevention Conditions

• Separating API keys and session tokens by use case and user, shortening their lifespans, rotating them regularly, and revoking them immediately.
• Detecting and restricting the use of the same credentials across numerous IPs and ASNs, geographic inconsistencies, sudden token consumption, and connections from known relays.
• Prohibiting the entry of credentials into unauthorized gateways via terms of use and organizational policies, and controlling connections from corporate networks.

7. What Happens Upon Success

• Access to AI services is established through the relay infrastructure, which may weaken regional attribution, user attribution, and rate controls.
• If shared or improperly obtained credentials are used, it may lead to quota consumption, increased charges, or service suspension for the legitimate owner.
• While large volumes of inputs could potentially be used for model extraction or distillation, Team Cymru could not view the prompt contents and has not identified the actual purpose.

8. Observable Logs

• email: No email delivery vectors specific to this incident have been reported.
• proxy_swg_dns: Check if corporate devices are connecting to unauthorized CRS, sub2api, relay gateways, or known relays.
• endpoint_edr: Check for AI service API keys and session tokens stored in browsers, CLIs, extensions, or local settings, and verify transmissions to unauthorized gateways.
• identity_idp: Check for AI service OAuth consents, session issuances, token refreshes, and usage from unfamiliar regions or devices.
• saas_cloud: Check for the use of single accounts or API keys across numerous IPs and ASNs, token consumption volumes, failure rates, rate limits, and usage regions.
• network: Check for connections to known relays, high-frequency traffic from a single exit node to multiple AI services, and sudden spikes in uplink/downlink traffic.

9. Attack Success Assessment

Confirmed via Public Information

• Confirmed service access via relay: Team Cymru observed bidirectional traffic between relay nodes and AI services. This indicates established access to upstream services through the relay infrastructure, although the origin of individual credentials, presence of abuse, and prompt contents remain unconfirmed.
• Observation scale: Initial research identified 10,867 relay nodes over eight days, and a subsequent aggregation spanning broader target tags reported over 80,000. Approximately 4,000 China/Hong Kong IP addresses sent about 14 TB to 304 US-based transfer stations and received more than 7 TB back over eight days. These totals do not represent direct measurements of traffic to frontier-model providers.

Internal Assessment Criteria

• Confirm authentication success: Verify that organizational accounts or API keys were used from unknown relay IPs and that the activity consumed tokens or quota.
• Confirm credential compromise: Verify through separate evidence that credentials not shared by the owner were used in different regions or on different devices, involving unauthorized access to storage locations or external exfiltration.
• Confirm policy evasion: Confirm the use of unauthorized gateways, evasion of regional restrictions, and automated high-volume requests through service and network logs.

10. Investigation Playbook

Trigger

• Initiated by sudden spikes in AI service usage, use of identical credentials from numerous IPs and ASNs, or connections to unauthorized gateways.

Initial Verification

• Check target accounts, API keys, OAuth/session tokens, usage regions, source IPs, ASNs, token consumption, and timestamps.
• Cross-reference with legitimate sharing practices, contractor usage, and known exit IPs to isolate unknown usage.

Endpoints

• Check for traces of AI credentials being saved or transmitted in browsers, CLIs, extensions, environment variables, configuration files, and clipboard history.

Identity and Cloud

• Check sessions, API keys, OAuth consents, billing, quotas, and audit logs on the AI service side, and revoke/reissue affected credentials.

Follow-up Operations

• Track used models, APIs, token volumes, destination outputs, and credential reuse across other services. When prompt contents cannot be acquired, distinguish between inferences and confirmed facts.

Containment

• Revoke suspicious API keys, sessions, and OAuth tokens, and reissue separate credentials for each user and use case.
• Restrict connections to unauthorized gateways and known relays, consolidating legitimate access that requires exceptions to managed exit points.

Judgment Categories

• Evaluate gateway connections, successful authentication to upstream services, quota consumption, credential compromise, regional/usage restriction evasion, and model extraction separately.

11. Defense and Detection Ideas

Single Events

• Detect AI service usage by departed or inactive accounts, API key usage from unknown ASNs, and massive token consumption over short periods with high priority.

Time-Series Correlation

• Correlate credential issuance/storage, connections to unauthorized gateways, AI service usage from relay IPs, quota consumption, and revocation along the same timeline.

Hunting Perspectives

• Search for connection histories to CRS, sub2api, and known relays, and check for concurrent AI account usage, API key fan-out, and geographic inconsistencies.

Log Gaps

• Team Cymru's network observation cannot confirm encrypted prompt contents or the origins of credentials. Similarly, organizations cannot determine abuse without AI service audit logs and credential issuance ledgers.

Priority Mitigations

• Separate AI credentials by use case and user, applying short lifetimes, least privilege, and regular rotation.
• Monitor for usage across numerous IPs and ASNs, geographic inconsistencies, sudden token consumption, and access from known relays.

12. Facts / Inference / Hypothesis

Facts

• Team Cymru identified 10,867 LLM relay nodes during an eight-day scanning window, and later stated that an expanded aggregation exceeded 80,000 related relays.
• Approximately 4,000 China/Hong Kong IP addresses sent about 14 TB to 304 US-based transfer stations and received more than 7 TB back over eight days. These totals do not represent direct measurements of traffic to frontier-model providers.
• Among them, 17 relays connecting to Anthropic showed 81 GB of uploads and 1.4 GB of downloads.
• CRS and sub2api provide capabilities to pool and relay multiple subscriptions, API keys, and OAuth/session tokens.
• Team Cymru could not view encrypted prompt contents and did not identify the breakdown of how the credentials were obtained.

Inference

• Combining shared credentials with relays separates accounts and source addresses visible to AI service providers from actual users, weakening regional attribution, user attribution, and rate controls.

Hypothesis

• Uplink-heavy traffic directed toward Anthropic suggests the possibility of model distillation or large-scale automated processing, but actual prompts and objectives have not been confirmed.

13. MITRE ATT&CK Mapping

• T1090 Proxy (Confidence: high) — Mapping to configurations that hide the actual user's source from upstream AI services via relay gateways and relays such as those in the US.

14. Unknowns and Further Investigation

• The breakdown of credential acquisition vectors, such as sharing, legitimate resale, promotion abuse, and theft.
• Of the 80,000+ related relays, how many were active simultaneously, overlaps, and connection ratios to each AI service.
• The contents of encrypted prompts and actual use cases such as model distillation, data generation, or normal usage.
• The scale of users, relays, and affected accounts within Japan.

15. Impact on SOCs and Organizations

If organizations do not issue separate API keys and sessions for each user and use case, activity routed through relay infrastructure cannot be reliably attributed to the actual user. It is necessary to combine short-lived credentials, least privilege, usage limits, and source restrictions while monitoring for connections to unauthorized gateways and known relays, fan-out from numerous IPs and ASNs, and geographic inconsistencies.

16. Summary by Target Audience

• For SOCs: Correlate connections to unauthorized gateways, AI service usage from relay IPs, usage of the same credentials across numerous IPs and ASNs, and sudden token consumption along the same timeline.
• For Administrators: Separate AI credentials by user and use case, applying short lifespans, least privilege, source restrictions, and usage limits.
• For Users: Do not register corporate AI accounts or API keys with unauthorized relay services, and report unfamiliar usage or billing to administrators immediately.