cyber.hendryadrian.com
Security News · securityweek.com

SOCRadar Says Most LiteLLM-Linked Exposures Began With Trivy Compromise

· Original article ↗

Summary

SOCRadar says records for 2,188 organizations indicate 2,085 had data collection end before poisoned LiteLLM packages appeared, pointing to the earlier Trivy compromise. The figures measure exposure, not confirmed credential use or a complete census.

Key points

  • SOCRadar analyzed records for 2,188 organizations; it says data collection ended before the LiteLLM package release for 2,085 of them.
  • The earliest recorded collection began 18 minutes after a malicious Trivy build was published on March 19; activity continued through March 24.
  • Two poisoned LiteLLM package versions were published on March 24 and remained available for roughly 40 minutes; a Python .pth file executed at interpreter startup.
  • The malware harvested credentials and secrets, then used stolen developer secrets to modify accessible packages and spread malicious versions.
  • More than 1,000 organizations reportedly exposed JWT or authentication tokens, and over 1,100 had committer email addresses exposed.
  • SOCRadar describes the figures as exposure estimates from a reconstructed sample, not a complete census or confirmation that stolen credentials were used.
  • A threat actor is reportedly offering a collection of LiteLLM, Trivy, and CanisterWorm data on Telegram.

Article Details

Event Type
Open-source software supply-chain compromise
Impact
SOCRadar reports that most of the organizations associated with the reported LiteLLM incident were exposed through the earlier Trivy compromise. It identified records for 2,188 organizations; data collection reportedly ended before the poisoned LiteLLM packages were published for 2,085 of them. The exposed information included developer credentials, tokens, API keys, private keys, and committer email addresses. The figures are exposure estimates from a reconstructed sample, not a complete census or confirmation that every affected credential was used. The article reports that stolen information is being brokered.

MITRE ATT&CK

T1059.006 · PythonA .pth payload was automatically executed by the Python interpreter at startup.T1195.001 · Compromise Software Dependencies and Development ToolsMalicious versions of packages and repositories were pushed using stolen developer secrets, compromising software dependencies.

Threat Actors

TeamPCPThe compromise was blamed on and claimed by TeamPCP. The article also describes the group as behind multiple open-source supply-chain attacks involving the Shai-Hulud worm.

Malware

Shai-HuludThe compromise was blamed on and claimed by TeamPCP, the threat actor behind multiple open source software (OSS) supply chain attacks involving the Shai-Hulud worm.

Vendors

Aqua SecurityIt started with Aqua Security’s Trivy scanner and propagated downstream to multiple packages and repositories in a ripple effect fueled by the malware’s worm-like behavior and by the automated inclusion of the malicious

Products

BitbucketThe compromise involved six CI/CD platforms, namely GitHub Actions, GitLab CI, Jenkins, Bitbucket, CircleCI, and Buildkite, and impacted organizations worldwide, with Germany, Brazil, and France affected the most.BuildkiteThe compromise involved six CI/CD platforms, namely GitHub Actions, GitLab CI, Jenkins, Bitbucket, CircleCI, and Buildkite, and impacted organizations worldwide, with Germany, Brazil, and France affected the most.CircleCIThe compromise involved six CI/CD platforms, namely GitHub Actions, GitLab CI, Jenkins, Bitbucket, CircleCI, and Buildkite, and impacted organizations worldwide, with Germany, Brazil, and France affected the most.Docker HubThe activity surged on March 22 and March 23 when malicious Trivy images were live on Docker Hub, and closed on March 24 after PyPI quarantined the packages.GitHub ActionsThe compromise involved six CI/CD platforms, namely GitHub Actions, GitLab CI, Jenkins, Bitbucket, CircleCI, and Buildkite, and impacted organizations worldwide, with Germany, Brazil, and France affected the most.GitLab CIThe compromise involved six CI/CD platforms, namely GitHub Actions, GitLab CI, Jenkins, Bitbucket, CircleCI, and Buildkite, and impacted organizations worldwide, with Germany, Brazil, and France affected the most.JenkinsThe compromise involved six CI/CD platforms, namely GitHub Actions, GitLab CI, Jenkins, Bitbucket, CircleCI, and Buildkite, and impacted organizations worldwide, with Germany, Brazil, and France affected the most.LiteLLMMost of the 2,500 organizations believed to have been affected by the LiteLLM supply chain attack were actually exposed before, SOCRadar reports.PyPIThe activity surged on March 22 and March 23 when malicious Trivy images were live on Docker Hub, and closed on March 24 after PyPI quarantined the packages.

Tools

TrivyIt started with Aqua Security’s Trivy scanner and propagated downstream to multiple packages and repositories in a ripple effect fueled by the malware’s worm-like behavior and by the automated inclusion of the malicious

Countries

BrazilThe compromise involved six CI/CD platforms, namely GitHub Actions, GitLab CI, Jenkins, Bitbucket, CircleCI, and Buildkite, and impacted organizations worldwide, with Germany, Brazil, and France affected the most.FranceThe compromise involved six CI/CD platforms, namely GitHub Actions, GitLab CI, Jenkins, Bitbucket, CircleCI, and Buildkite, and impacted organizations worldwide, with Germany, Brazil, and France affected the most.GermanyThe compromise involved six CI/CD platforms, namely GitHub Actions, GitLab CI, Jenkins, Bitbucket, CircleCI, and Buildkite, and impacted organizations worldwide, with Germany, Brazil, and France affected the most.

Related Articles