TeamPCP LiteLLM Supply Chain Attack — Trojaned PyPI Packages (v1.82.7/1.82.8) with Multi-Stage C2 Payload

TeamPCP LiteLLM Supply Chain Attack (TL-2026-0304), also tracked as TeamPCP Campaign, is a critical-severity supply-chain compromise scored CVSS 9.8, first published 2026-03-31 and last reviewed 2026-09-08. It is attributed to TeamPCP with high confidence, affects BerriAI LiteLLM, references 6 CVEs (CVE-2026-33634, CVE-2025-55182, CVE-2026-45321), maps to at least 80 MITRE ATT&CK techniques (T1001, T1003, T1005), and is covered by 9 detection rules and 131 indicators of compromise.

Key facts for TL-2026-0304

Threat ID
TL-2026-0304
Also known as
TeamPCP Campaign, Operation Cascading Poison
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
SUPPLY_CHAIN
First published
2026-03-31
Last reviewed
2026-09-08
Attribution
TeamPCP
Attribution confidence
HIGH
Motivation
FINANCIAL
Target sectors
technology, financial, cloud-infrastructure, ai-ml, devops, security, telecommunications, cryptocurrency
Target regions
Global
Detection rules
9
Indicators of compromise
131
Updates
2026-09-08 · 12 updates · revalidated 12× · latest source

Malware and tooling in TeamPCP LiteLLM Supply Chain Attack

Malware and tooling: TeamPCP Credential Stealer, Custom RSA-4096 + AES-256-CBC hybrid C2

Threat actor TeamPCP compromised the LiteLLM PyPI package by publishing trojaned versions 1.82.7 and 1.82.8 on March 24, 2026. The attack originated from a cascading supply chain compromise that began with Aqua Security's Trivy scanner on March 19, expanded to Checkmarx KICS/AST on March 23, and culminated in credential theft of the LiteLLM maintainer's PyPI token. The malicious payload deploys a multi-stage credential stealer with systemd persistence and encrypted C2 communication to models.litellm.cloud, targeting cloud credentials, SSH keys, crypto wallets, and Kubernetes secrets.

How TeamPCP LiteLLM Supply Chain Attack works

TeamPCP executed a sophisticated cascading supply chain attack that weaponized trusted security tooling to compromise downstream software packages. The campaign began in February 2026 with an initial credential compromise in Aqua Security's repository, enabling the threat actor to poison Trivy—a widely-deployed open-source vulnerability scanner—on March 19, 2026. The attackers modified 76 of 77 version tags for the Trivy GitHub Actions (aquasecurity/setup-trivy versions 0.2.0–0.2.6), injecting credential-harvesting payloads that extracted CI/CD secrets from GitHub Actions runner environments, including cloud access tokens, SSH keys, and package registry credentials.

On March 21–23, TeamPCP leveraged stolen CI/CD secrets to compromise Checkmarx's GitHub Actions for infrastructure-as-code security scanning (kics-github-action v1.1, ast-github-action v2.3.28) and VS Code extensions (checkmarx.ast-results v2.53, checkmarx.cx-dev-assist v1.7.0), affecting 35 version tags. The Checkmarx wave used checkmarx.zone as its C2 domain.

The LiteLLM compromise on March 24, 2026 was the direct downstream consequence: the attackers used a stolen PyPI publishing token (PYPI_PUBLISH) exfiltrated from LiteLLM's CI/CD pipeline via the poisoned Trivy action. They bypassed the official GitHub CI/CD entirely, uploading malicious packages directly to PyPI. Version 1.82.7 was uploaded at 10:39:24 UTC and version 1.82.8 at 10:52:19 UTC.

The payload architecture differed between versions. In v1.82.7, a base64-encoded Python payload was injected into litellm/proxy/proxy_server.py, executing whenever the litellm.proxy module was imported. Version 1.82.8 escalated the attack surface by adding litellm_init.pth (34,628 bytes)—a Python path configuration file that executes automatically on every Python interpreter startup when litellm is installed, removing the requirement for explicit LiteLLM usage.

The first-stage payload consists of a single line of base64-decoded Python launched in a detached subprocess with stdout/stderr suppressed: import base64; exec(base64.b64decode(...)). The second stage downloads a follow-on payload to /tmp/pglog and establishes persistence via a systemd user service at ~/.config/systemd/user/sysmon.service with the main script at ~/.config/sysmon/sysmon.py. The service name 'sysmon' was deliberately chosen to mimic legitimate system monitoring tools.

The persistence mechanism implements a 5-minute delay before initial network activity, then beacons to the C2 server every 50 minutes. The C2 communication uses a hybrid RSA-4096 + AES-256-CBC encryption scheme with a hardcoded public key—the same RSA key was reused across multiple campaign payloads, providing a strong attribution link.

The credential stealer component aggressively harvests: SSH private keys (~/.ssh/), AWS credentials (~/.aws/credentials, AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY env vars), GCP Application Default Credentials, Azure tokens, Kubernetes configs (~/.kube/config), database passwords, .env files containing API keys, shell history, SSL/TLS private keys, CI/CD configuration files, and cryptocurrency wallet data. It also performs Instance Metadata Service (IMDS) exploitation and process memory extraction via /proc/<pid>/mem to bypass GitHub secret masking.

Collected data is compressed into tpcp.tar.gz and exfiltrated via HTTP POST to https://models.litellm.cloud/ with the header X-Filename: tpcp.tar.gz. The archive is encrypted with AES-256-CBC using a random session key, which is then wrapped with the RSA-4096 public key.

In Kubernetes environments, the malware deploys privileged DaemonSets: host-provisioner-iran (container: kamikaze) for destructive operations and host-provisioner-std for persistent backdoor access, both in the kube-system namespace using alpine:latest with hostPID, hostNetwork, and privileged security context.

The campaign expanded to Telnyx Python SDK on March 27, compromising versions 4.87.1 and 4.87.2 with a novel payload delivery mechanism using WAV file steganography—a crafted ringtone.wav downloaded from 83.142.209.203:8080 containing XOR-encrypted data with 8-byte keys embedded in 16-byte audio frames.

SentinelOne's AI EDR autonomously detected and blocked the attack within 44 seconds across 424 behavioral events, identifying the malicious pattern without a signature for the specific package. An AI coding assistant (Anthropic's Claude) running with unrestricted system permissions autonomously updated LiteLLM to the trojaned version without human review, highlighting the risk of AI-driven dependency management.

The malicious packages were available for approximately 5 hours and 21 minutes before PyPI quarantined the package. The Trivy compromise carries CVE-2026-33634 (CVSS 9.4). TeamPCP has claimed exfiltration of 300GB+ data and 500,000 credentials from infected endpoints.

MITRE ATT&CK techniques used in TL-2026-0304

Command and Control

T1001 Data Obfuscation; T1071.001 Application Layer Protocol; T1090 Proxy; T1095 Non-Application Layer Protocol; T1102 Web Service; T1102.001 Web Service

Credential Access

T1003 OS Credential Dumping; T1552.001 Unsecured Credentials; T1552.005 Unsecured Credentials

collection

T1005 Data from Local System; T1074 Data Staged

Discovery

T1016 System Network Configuration Discovery; T1083 File and Directory Discovery; T1518 Software Discovery; T1526 Cloud Service Discovery; T1580 Cloud Infrastructure Discovery

Exfiltration

T1020 Automated Exfiltration; T1048 Exfiltration Over Alternative Protocol; T1567.001 Exfiltration Over Web Service; T1567.004 Exfiltration Over Web Service

Lateral Movement

T1021 Remote Services; T1080 Taint Shared Content; T1210 Exploitation of Remote Services; T1550 Use Alternate Authentication Material

defense-evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1078 Valid Accounts; T1140 Deobfuscate/Decode Files or Information

Defense Evasion

T1027.003 Obfuscated Files or Information; T1036.005 Masquerading; T1055 Process Injection; T1480 Execution Guardrails

exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

execution

T1059 Command and Scripting Interpreter

Execution

T1059.004 Command and Scripting Interpreter; T1059.006 Command and Scripting Interpreter; T1204 User Execution; T1610 Deploy Container

command-and-control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1572 Protocol Tunneling; T1573 Encrypted Channel

Privilege Escalation

T1078.004 Valid Accounts; T1548 Abuse Elevation Control Mechanism

discovery

T1082 System Information Discovery; T1087 Account Discovery

Persistence

T1098 Account Manipulation; T1543.002 Create or Modify System Process; T1546 Event Triggered Execution; T1547.001 Boot or Logon Autostart Execution; T1547.013 Boot or Logon Autostart Execution; T1554 Compromise Host Software Binary

Collection

T1119 Automated Collection; T1560 Archive Collected Data

Initial Access

T1190 Exploit Public-Facing Application; T1195.001 Supply Chain Compromise; T1195.002 Supply Chain Compromise; T1566 Phishing

initial-access

T1195 Supply Chain Compromise; T1199 Trusted Relationship

impact

T1485 Data Destruction

Impact

T1486 Data Encrypted for Impact; T1496 Resource Hijacking; T1529 System Shutdown/Reboot

credential-access

T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1555 Credentials from Password Stores

persistence

T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution

defense-impairment

T1553 Subvert Trust Controls

lateral-movement

T1570 Lateral Tool Transfer

stealth

T1574 Hijack Execution Flow

Resource Development

T1583 Acquire Infrastructure; T1583.001 Acquire Infrastructure; T1584 Compromise Infrastructure; T1585 Establish Accounts; T1588 Obtain Capabilities; T1608 Stage Capabilities

Affected products and versions in TeamPCP LiteLLM Supply Chain Attack

  • BerriAI — LiteLLM
    Vulnerable versions: 1.82.7; 1.82.8
    Fixed in: 1.82.6; 1.83.0+
  • Aqua Security — Trivy
    Vulnerable versions: 0.69.4; 0.69.5; 0.69.6
    Fixed in: Patched releases
  • Aqua Security — setup-trivy GitHub Action
    Vulnerable versions: 0.2.0 to 0.2.6
    Fixed in: Verified clean tags
  • Checkmarx — kics-github-action
    Vulnerable versions: v1.1
    Fixed in: Verified clean versions
  • Checkmarx — ast-github-action
    Vulnerable versions: v2.3.28
    Fixed in: Verified clean versions
  • Checkmarx — VS Code Extensions (ast-results, cx-dev-assist)
    Vulnerable versions: ast-results v2.53; cx-dev-assist v1.7.0
    Fixed in: Verified clean versions
  • Telnyx — Telnyx Python SDK
    Vulnerable versions: 4.87.1; 4.87.2
    Fixed in: 4.87.0 or earlier

Remediation for TeamPCP LiteLLM Supply Chain Attack

Patches

  • Downgrade LiteLLM to v1.82.6 (last known-clean release)
  • Upgrade to LiteLLM v1.83.0+ (released through new CI/CD v2 pipeline)
  • Update Trivy to patched versions and verify GitHub Action integrity
  • Update Checkmarx GitHub Actions to verified clean versions

Immediate actions

  • Check if litellm versions 1.82.7 or 1.82.8 were installed: pip show litellm
  • Search filesystem for litellm_init.pth and remove if found
  • Check for persistence: ls -la ~/.config/systemd/user/sysmon.service ~/.config/sysmon/sysmon.py /tmp/pglog /tmp/.pg_state
  • Block outbound traffic to models.litellm.cloud and checkmarx.zone at perimeter
  • Block C2 IPs: 83.142.209.203, 83.142.209.11, 46.151.182.203, 23.142.184.129, 45.148.10.212, 63.251.162.11, 195.5.171.242, 209.34.235.18, 212.71.124.188
  • Kill any running sysmon.py processes and disable sysmon.service
  • Rotate ALL secrets, API keys, cloud credentials, SSH keys, and database passwords on affected systems
  • Audit Kubernetes clusters for unauthorized DaemonSets (host-provisioner-iran, host-provisioner-std, node-setup-*)

Workarounds

  • Use official LiteLLM Proxy Docker image (ghcr.io/berriai/litellm) which uses pinned dependencies
  • Manually verify PyPI package checksums against GitHub release artifacts before installation
  • Temporarily disable automated dependency updates in CI/CD pipelines

Longer-term hardening

  • Pin all CI/CD dependencies to specific commit SHAs, not version tags
  • Implement PyPI package integrity verification with hash pinning
  • Deploy EDR with behavioral detection capabilities for supply chain attacks
  • Implement secrets management solutions to avoid storing credentials in files
  • Enforce least-privilege for CI/CD tokens with short expiration
  • Monitor for anomalous PyPI package uploads outside normal CI/CD workflows
  • Restrict AI coding assistants from autonomously updating dependencies without human review
  • Implement network segmentation to limit blast radius of credential theft

CVEs associated with TeamPCP LiteLLM Supply Chain Attack

CVE-2026-33634, CVE-2025-55182, CVE-2026-45321, CVE-2023-48022, CVE-2025-29927, CVE-2026-48027

Weaknesses (CWE) in TeamPCP LiteLLM Supply Chain Attack

CWE-506, CWE-829, CWE-494, CWE-327, CWE-502, CWE-306, CWE-862, CWE-863, CWE-285, CWE-798

Timeline of TeamPCP LiteLLM Supply Chain Attack

Showing the 20 most recent tracked events.

  • TeamPCP publishes the Shai-Hulud malware source code on GitHub as "A Gift From TeamPCP" under an MIT license, forked 44+ times within hours, and launches a $1,000 XMR supply-chain-attack contest on BreachForums.
  • TeamPCP breaches GitHub's internal infrastructure via a trojanized Nx Console VS Code extension (v18.95.0, live 18 minutes), exfiltrating ~3,800 internal repositories via a stolen contributor PAT and an orphan commit to nrwl/nx; stolen data listed on Breached with a $50,000 floor price.
  • Mini Shai-Hulud hijacks the npm maintainer accounts 'atool' (318 packages) and 'prop' (6 packages), republishing 645 malicious artifacts across 323 AntV-ecosystem packages (jest-canvas-mock, size-sensor, echarts-for-react, @antv/util, timeago.js) and stamping 2,500+ marker repositories; secrets exfiltrated via a GitHub API dead-drop to a poisoned antvis/G2 reference and a fallback C2 (t.m-kosche.com) disguised as an OpenTelemetry endpoint.
  • durabletask PyPI package compromised, targeting Microsoft Azure customers.
  • As of 2026-05-29, the specific trojaned LiteLLM packages (1.82.7/1.82.8) were quarantined within hours and patched (1.83.0+), but actor TeamPCP is escalating: April-May waves hit TanStack, Bitwarden CLI, durabletask and others via the self-propagating "Mini Shai-Hulud" worm, whose source was open-sourced May 12 with no arrests. The actor and tooling remain actively exploited in the wild.
  • KrebsOnSecurity interviews a TeamPCP member using the handle 'Ellis' about the group's operations — a persona alias (EllisD25/LSD) later tied to arrested suspect Ruben Thomson.
  • Miasma worm Wave 1 compromises 32 official npm packages under @redhat-cloud-services using stolen Red Hat employee GitHub credentials from infostealer logs.
  • Miasma worm Wave 2 ("Phantom Gyp") introduces a novel 157-byte binding.gyp file to trigger code execution during npm install, bypassing preinstall-script monitoring; compromises 57 additional packages.
  • Miasma worm Wave 3 compromises the Microsoft Azure/durabletask repository; GitHub disables 73 repositories across 4 Microsoft organizations within 105 seconds. Miasma begins targeting AI coding assistant configs (.claude/settings.json, .cursor/rules) for persistent backdoors.
  • Miasma toolkit open-sourced via four previously compromised developer accounts.
  • FBI issues FLASH advisory FLASH-20260702-01 (coordinated with DHS/CISA), formally attributing the consolidated multi-wave campaign to TeamPCP and publishing IPs, domains, hashes, and exfiltration markers (tpcp-docs / docs-tpcp).
  • Infoblox's 2026 Threat Landscape Report is covered by Help Net Security, tying TeamPCP's OSS supply-chain compromises to a broader subscription-style cybercrime economy built on DNS/domain abuse.
  • A fresh npm wave poisons the keyv and cacheable packages using the same Mini Shai-Hulud worm toolkit, notably without the campaign's earlier self-identifying markers — evidence of continuing operational-security evolution post-exposure.
  • Oligo Security research (via CyberScoop) traces TeamPCP activity back to 2020 via shared infrastructure, linking the TA-NATALSTATUS and IronErn aliases to the group and substantially extending its known operational timeline.
  • Hudson Rock and CloudSEK independently analyze a leaked 153GB/433,909-file archive (118,829 distinct CI-runner credential dumps) and map the resulting exposure to 2,488 corporate domains — including NVIDIA, Volkswagen, Microsoft, Cisco, Samsung, Siemens, Salesforce, S&P Global, ServiceNow, Deloitte, Vodafone, X Corp, Zscaler, FedEx, Thales, and London Stock Exchange Group — launching public domain-lookup portals.
  • AFP, FBI, and WA Police Force execute search warrants in Perth, Australia, arresting two men allegedly linked to TeamPCP.
  • The second arrested suspect is publicly identified as Louis Michael Gaebler (23) of Mandurah; combined charges against Thomson and Gaebler total 14 offences carrying a combined maximum exposure of 82 years' imprisonment.
  • A 21-year-old Cottesloe man (publicly identified as Ruben Ian Thomson) is charged with 8 offences, including dealing with proceeds of crime valued at over $100,000; a 23-year-old Mandurah man is charged with 6 related offences. AFP estimates the campaign potentially compromised over 1,000 organisations globally.
  • Truesec assesses the Shai-Hulud/TeamPCP threat persists despite the Australian arrests because the worm's source code was already leaked to cybercrime forums, trojanized LiteLLM builds remained reachable via the PyPI CDN five months after removal, and the toolkit continued to be used in npm attacks (e.g., the August 4 keyv/cacheable wave).
  • The Hacker News republishes and expands on GTIG's findings on TeamPCP's autonomous credential-harvesting operation; DUSTMAKER, a second CI/CD-targeting credential stealer using AI-assistant workspace poisoning and prompt injection for defense evasion, is publicly attributed to TeamPCP alongside the previously documented SANDCLOCK stealer.

Update history for TL-2026-0304

Sources cited for TeamPCP LiteLLM Supply Chain Attack

Threats related to TeamPCP LiteLLM Supply Chain Attack

Detection coverage for TL-2026-0304

As of 2026-09-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0304 across Splunk SPL, Microsoft KQL and Sigma, covering 131 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats