LiteLLM Compromised - TeamPCP Supply Chain Attack Exposed

What Happened

The TeamPCP hacking group has launched a significant supply chain attack by compromising the widely used LiteLLM Python package on PyPI. This package, which facilitates access to various large language model (LLM) providers, has seen over 3.4 million downloads daily. The attackers released malicious versions, specifically 1.82.7 and 1.82.8, which contain an infostealer that harvests sensitive data from infected devices. This incident is part of a broader trend of supply chain attacks, where hackers exploit trusted software sources to distribute malware.

The malicious code was embedded in the package's files, specifically in litellm/proxy/proxy_server.py, and executes upon import. The attack has been linked to TeamPCP, a group previously involved in the breach of Aqua Security's Trivy vulnerability scanner, indicating a pattern of targeting software supply chains.

Who's Being Targeted

The impact of this attack is widespread, with estimates suggesting that around 500,000 devices may have been compromised. This includes a range of users, from individual developers to large organizations that rely on LiteLLM for their applications. The malicious versions of LiteLLM not only steal data but also install persistent backdoors, allowing attackers to maintain access to infected systems.

The attackers have targeted various sensitive credentials, including SSH keys, cloud tokens, and Kubernetes secrets. This broad range of targets underscores the serious implications for organizations that utilize LiteLLM, as compromised credentials can lead to further breaches and unauthorized access to critical infrastructure.

Tactics & Techniques

The attack employs sophisticated tactics to maximize its impact. Upon execution, the payload initiates a three-stage attack process. First, it collects a variety of credentials and sensitive information. Next, it attempts to move laterally across Kubernetes clusters, deploying privileged pods to every node. Finally, it establishes a persistent backdoor that can fetch additional malicious payloads.

The malicious payload is designed to be stealthy, disguising itself as a legitimate service. It contacts a remote server to download further instructions, ensuring that the attackers can maintain control over the compromised devices. This method of operation reflects a growing trend among cybercriminals to leverage supply chain vulnerabilities for extensive data theft.

Defensive Measures

In response to this attack, it is crucial for organizations to take immediate action. Users of LiteLLM should:

• Check for installations of versions 1.82.7 or 1.82.8 and remove them.
• Rotate all secrets, tokens, and credentials that may have been exposed.
• Inspect systems for signs of the malicious payload, including persistence artifacts and unauthorized pods in Kubernetes.

Monitoring outbound traffic for connections to known malicious domains is also essential. If any compromise is suspected, all credentials on affected systems should be treated as potentially exposed and rotated without delay. This incident serves as a stark reminder of the importance of securing software supply chains and the need for vigilance against evolving cyber threats.