Threat video1:00
TeamPCP Worms Hit AI Dev Tooling: Detection & IOCs
TeamPCP's worms take the credentials AI developer tools hold: 9 detection rules, 28 IOCs and 15 ATT&CK techniques, with a free Splunk SPL rule.
Read the full threat intel for TeamPCP Worms Hit AI Dev Tooling: Detection & IOCs →
Chapters
- 0:00The hook103 AI-involved malicious incidents.
- 0:04The storyMalicious LiteLLM shipped to PyPI.
- 0:11Attack pathThe report says Trivy leaked tokens.
- 0:24AttributionAttributed to TeamPCP.
- 0:28Indicators of compromise24 indicators to hunt: 3 domains, 3 URLs and 3 SHA-256 hashes, and more.
- 0:38MITRE ATT&CK techniques15 ATT&CK techniques, from initial access to exfiltration.
- 0:43Remediation5 steps now: Check all environments, including transitive dependencies, for litellm.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00103 AI-involved malicious incidents.
0:05Malicious LiteLLM shipped to PyPI.
0:08Then CanisterWorm spread.
0:11The report says Trivy leaked tokens.
0:13Then CanisterWorm reached Namastex packages.
0:17It stole wallet data, then exfiltrated it.
0:20Then it republished itself.
0:24Attributed to TeamPCP. Confidence: medium.
0:2924 indicators to hunt: 3 domains, 3 URLs and 3 SHA-256 hashes, and more.
0:3815 ATT&CK techniques, from initial access to exfiltration.
0:435 steps now: Check all environments, including transitive dependencies, for litellm.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.