The cyberattack from March this year may have significantly greater consequences than originally expected. Security company CloudThe SEC now estimates that the attack on the open-source LiteLLM library could potentially affect more than 2500 organizations and approximately 434,000 CI/CD pipelines. This is not a typical attack on a single company. The hackers exploited the software supply chain, which allowed them to reach much further.
LiteLLM is an open-source tool used to work with various AI models and their APIs. Attackers according to CloudThe SEC first compromised the Trivy security tool and then used it to gain access to the LiteLLM build process, resulting in the release of malicious versions 1.82.7 and 1.82.8 to the PyPI repository.
You might be interested in
The biggest problem was what the malicious code did next. Once installed, it would automatically run when Python was started via a .pth file and attempt to extract sensitive information from the compromised environment. Attackers could have come across SSH keys, login credentials, etc. cloudto AWS, Google services Cloud and Azure, Kubernetes tokens, CI/CD secrets or API keys to AI services. Interestingly, the malicious packages themselves were CloudThe SEC was only available for about 40 minutes. However, that doesn't mean that the problem was solved after they were removed. Once the malware had obtained the credentials, the attackers could use them for a long time afterwards. CloudThe SEC therefore warns that removing the compromised package alone does not resolve the incident.
And the range of companies potentially affected is truly impressive. The list of organizations with a high level of compliance includes AWS, Samsung, Cisco, Salesforce, ServiceNow, Siemens, Volkswagen, Deloitte, Epic Games, and Vodafone.oneHowever, it is important to note that inclusion in the database alone does not confirm a successful attack. CloudThe SEC explicitly states that this is a potential exposure that individual organizations must verify for themselves.
You might be interested in
This is what makes the whole attack quite scary. The compromised library did not have to be used directly on a production server. It just had to get into a development or automated CI/CD environment, where it could have access to a whole host of other systems. The data obtained could then potentially open the way to cloudemail accounts, repositories, registries, Kubernetes clusters or AI services. CloudThe SEC therefore warns that organizations that may have been affected should first review their use of LiteLLM versions 1.82.7 and 1.82.8, isolate potentially compromised environments, and change all credentials that the compromised process may have had access to.
The whole case also points to a growing problem. AI infrastructure is becoming an attractive target for attackers because it is connected not only to the AI models themselves, but also to cloude-services, databases, internal tools and sensitive data. One compromised open-source computeronent can thus, in extreme cases, represent an entry gateway to a significantly larger part of the company's infrastructure.
