News and Analysis

More than 2,500 organizations were exposed in the LiteLLM supply chain attack earlier this year, according to CloudSEK, making it the biggest-ever supply chain attack.The company said a host of major organisations, including Nvidia, Samsung, Cisco, ServiceNow, Zscaler, and more were exposed. The company stressed that this isn’t proof they were actually compromised, however. Information exposed in the campaign included AWS, Google Cloud, and Microsoft Azure credentials, SSH keys, Kubernetes tokens, .env files and CI/CD secrets – including the values GitHub Actions tries to mask, scraped directly from /proc//mem. Meanwhile, in the case of AI builds, LLM API keys and gateway configuration – the credentials to an organization’s entire AI stack – were exposed.This could have allowed attackers to access corporate cloud environments, break into internal servers and systems, steal proprietary source code, and access or manipulate software development infrastructure.”For businesses, these credentials can be extremely sensitive because they are often what employees, applications and automated systems use to prove their identity. If attackers successfully obtained them, they may not need to hack the company again. They could simply log in using legitimate credentials,” CloudSEK said.”That creates a particularly serious risk because malicious activity performed through valid credentials can be much harder for security teams to detect.”What happened in the LiteLLM supply chain attack?The incident took place in March, when the Team PCP cybercriminal group breached LiteLLM, an open source tool widely used by organizations to connect applications with AI models.Malicious versions of LiteLLM were reportedly available through the Python software repository PyPI for just 40 minutes – but still saw the potential exposure of 434,000 CI/CD pipelines used to build, test and deploy software. The breach appeared to be linked to the earlier compromise of Trivy, in which the abuse of a trusted vulnerability scanner in CI/CD pipelines enabled credential theft that was apparently used to poison LiteLLM’s PyPI release chain.Because CI/CD pipelines can automatically download software packages without a developer manually reviewing every component, a malicious package can potentially spread across large numbers of corporate systems very quickly.Researchers noted that even when the original malicious package has been removed, the security risk may not have ended with it.”If attackers copied credentials while the compromised package was active, removing LiteLLM does not automatically invalidate those credentials,” the researchers said.”A cloud key, API token or server credential could remain valid until the organization itself changes or revokes it. This means organizations potentially exposed during the March incident could continue to face risk weeks or months later.”CloudSEK has since released a free exposure-checking tool to help organizations find out whether credentials or infrastructure associated with them appear in its dataset. If they do, it said, firms should check out the relevant systems, review access logs and immediately rotate or revoke potentially exposed credentials.FOLLOW US ON SOCIAL MEDIA