{"name":"LITELLM_PRIVCOLLECT_OCT2026 - campaign","description":"# Executive Threat Brief - LITELLM_PRIVCOLLECT_OCT2026\n\n## Campaign Snapshot\n\nOn October 21, 2026, LiteLLM, the open source gateway many teams use to route traffic to OpenAI, Anthropic, Azure and Bedrock, published a malicious release (1.107.0) to PyPI and to its official Docker images, including the `latest` tag. The attacker drove LiteLLM's own release pipeline using three engineers' stolen GitHub tokens, which LiteLLM believes were scraped from the logs of an internet-exposed internal LiteLLM deployment. Any system that installed or ran the release had its cloud, developer, browser and AI provider credentials stolen; stolen AWS credentials were already being tested by the attacker within about 4.5 hours.\n\nThis is the second LiteLLM compromise in 2026 (March: 1.82.7/1.82.8, TeamPCP). No CVE exists, so CVE-driven vulnerability programs will not raise a ticket on their own. Attribution for the October wave is unconfirmed.\n\n## What Is Affected\n\n### Software\n\n| Software | Vulnerable Version | Safe Version | Action |\n|----------|--------------------|--------------|--------|\n| litellm (PyPI, all 7 wheels) | 1.107.0 | 1.106.2 | Delete payload files, rebuild env, pin with hashes |\n| litellm (PyPI sdist) | 1.107.0 | 1.106.2 | Tampered build config only; still replace |\n\n### Containers\n\n| Image | Vulnerable Tag | Safe Tag | Registry | Action |\n|-------|----------------|----------|----------|--------|\n| berriai/litellm | v1.107.0, latest, main-latest, main-stable (Oct 21 11:46-13:51 UTC) | v1.106.2 by digest | GHCR | Replace container, purge caches |\n| berriai/litellm-database | Same | v1.106.2 by digest | GHCR | Replace; rotate all proxy DB provider keys |\n| berriai/litellm-non_root | Same | v1.106.2 by digest | GHCR | Replace container |\n| litellm/litellm | v1.107.0, latest, main-latest, main-stable (Oct 21 11:46-14:20 UTC) | v1.106.2 by digest | Docker Hub | Replace container, purge caches |\n\n### Libraries\n\n| Package | Ecosystem | Vulnerable Range | Safe Version | Action |\n|---------|-----------|------------------|--------------|--------|\n| litellm | PyPI | ==1.107.0 (open-ended litellm>= constraints resolved to it during the window) | 1.106.2 | Pin exactly; add 72h package cooldown on internal proxy |\n\n## Business Impact\n\n- AI spend fraud: every upstream model provider key stored in the LiteLLM proxy database is exposed; attacker already enumerated Bedrock models (LLMjacking pattern).\n- Cloud foothold: AWS instance-role credentials from CI runners and Kubernetes nodes were validated and used for IAM and CloudTrail discovery.\n- Software supply chain: GitHub, PyPI and npm tokens on affected hosts are the same credential class that caused this incident; organizations that publish packages face onward compromise.\n- Persistence: a background loader polls an attacker-chosen GitHub location hourly; uncleaned hosts remain open to remote code execution if that location is revived.\n- Detection gap and compliance: no CVE means no automated ticket in CVE-driven programs; credential exposure may trigger breach-assessment duties (UK GDPR / NIS, US state breach laws, SEC 8-K materiality review for listed firms).\n\n## Immediate Actions (Next 24-72 Hours)\n\n| # | Action | Owner | Deadline |\n|---|--------|-------|----------|\n| 1 | Identify every repo, CI job, image and cluster that resolved litellm 1.107.0 or the listed digests | AppSec / Platform Engineering | 24h |\n| 2 | Kill loader daemon, delete payload files, rebuild on 1.106.2 pinned by hash/digest | Platform Engineering / SRE | 24h |\n| 3 | Rotate all LiteLLM proxy provider keys, master key, salt key, virtual keys, DB password | AI Platform owner | 24h |\n| 4 | Rotate cloud roles/keys, GitHub/PyPI/npm tokens, Vault/K8s tokens, CI secrets reachable from affected hosts | Cloud Security / DevOps | 48h |\n| 5 | Block litellm[.]dev; alert on letters9813 dead drop and /codepy requests | SOC / Network Security | 24h |\n| 6 | Review CloudTrail and provider billing for credential replay and LLMjacking | SOC / FinOps | 48h |\n| 7 | Take internal LiteLLM gateways off the public internet; redact tokens from gateway logs | AI Platform owner | 72h |\n| 8 | Remove admin bypass on release-workflow branch protection; alert on workflow run deletion | DevOps / AppSec | 72h |\n\n## Key IOCs (Fast Reference)\n\n| Type | Value | Context |\n|------|-------|---------|\n| Malicious Package | litellm==1.107.0 | All 7 wheels |\n| Domain | litellm[.]dev / www[.]litellm[.]dev | Exfiltration, registered Oct 13, 2026 |\n| URL | hxxp://www[.]litellm[.]dev/healthcheck | Exfil POST endpoint |\n| Credential / Token | X-Token: XWiA8gZNa7NcX2XRoAEb | Hardcoded exfil header |\n| URL | hxxps://raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain.txt | Loader dead drop |\n| Host Artifact | cook.pth, cook.py, sitecustomize.py in site-packages | Startup hooks |\n| Host Artifact | /tmp/.pc_once_72129118c59f5636c0bb | Exfil succeeded marker |\n| Process | holder of /tmp/remote_code_loader.lock | Loader daemon alive |\n| IP Address | 168[.]100[.]8[.]57, 165[.]227[.]201[.]8 | Stolen AWS credential validation |\n| Crypto Hash | 1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e | Compromised image index |\n\n## Risk Summary\n\n| Dimension | Rating | Rationale |\n|-----------|--------|-----------|\n| Exploitability | Critical | Executes on any Python start; no import or user action required |\n| Blast Radius | High | All wheels and floating Docker tags affected, but window limited to ~2.5 hours |\n| Persistence Risk | High | Detached hourly loader survives package removal until killed |\n| Remediation Complexity | High | Broad credential rotation across cloud, CI, developer and AI provider accounts |\n| Business Exposure | Critical | AI provider keys and cloud roles confirmed abused; package-publishing credentials exposed |\n"}