Threat video1:00
LiteLLM 1.107.0 Credential Stealer: Detection & IOCs
A malicious LiteLLM 1.107.0 on PyPI and Docker carried a credential stealer and GitHub-based backdoor: 17 IOCs, 9 detection rules and a free Splunk SPL rule.
Read the full threat intel for LiteLLM 1.107.0 Credential Stealer: Detection & IOCs →
Chapters
- 0:00The hookAbout 49,000 trojanized downloads in one week.
- 0:04The storyStolen GitHub tokens published the trojanized package.
- 0:11Attack pathAccording to reports, stolen GitHub OAuth.
- 0:27AttributionNo threat actor is attributed.
- 0:31Indicators of compromise14 indicators to hunt: 2 IPs, 1 domain and 4 URLs, and more.
- 0:38MITRE ATT&CK techniques16 ATT&CK techniques, from resource development to command and control.
- 0:43Remediation16 remediation steps are listed, 5 of them immediate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About 49,000 trojanized downloads in one week.
0:05Stolen GitHub tokens published the trojanized package.
0:0950,000 downloaded the stealer.
0:12According to reports, stolen GitHub OAuth.
0:15Trojanized litellm shipped to PyPI.
0:17Stealer runs, harvests credentials.
0:20Exfiltrated encrypted to dead-drop.
0:23AWS access then tested.
0:27No threat actor is attributed. Confidence: low.
0:3214 indicators to hunt: 2 IPs, 1 domain and 4 URLs, and more.
0:3816 ATT&CK techniques, from resource development to command and control.
0:4416 remediation steps are listed, 5 of them immediate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.