Affected Systems

LiteLLM versions 1.82.7 and 1.82.8 published on PyPI on March 24, 2026 (10:39-11:19 UTC, treat installs through 16:00 UTC as suspect). Any system that installed these versions or pulled them as transitive dependencies via agent frameworks or orchestration tools. Linked to broader TeamPCP/UNC6780 supply-chain campaign (CVE-2026-33634) targeting Aqua Trivy scanner. CloudSEK dataset indicates potential exposure of 2,100+ organizations including NVIDIA, Cisco, Deloitte, Volkswagen, FedEx, Siemens, and X Corp.

Exploitation Status

Active exploitation confirmed. Malicious packages were live on PyPI for approximately 40 minutes on March 24, 2026. CloudSEK obtained dataset of ~434,000 captured files containing stolen credentials. FBI issued advisory FLASH-20260702-01 on July 2, 2026 warning that exfiltrated credentials from TeamPCP campaign will likely be weaponized long-term. Payload exfiltrated environment variables, SSH keys, cloud credentials (AWS, Azure, GCP), Kubernetes tokens, database passwords, and AI model API keys (OpenAI, Anthropic) to attacker-controlled domain models.litellm[.]cloud.

Business Impact

Organizations that installed affected LiteLLM versions face credential compromise even if they did not directly depend on LiteLLM—transitive dependencies in CI/CD pipelines could have pulled malicious versions. The litellm_init.pth file executed at Python interpreter startup, running regardless of whether LiteLLM was imported. Long-lived secrets (static cloud keys, SSH keys, PyPI tokens) remain exploitable until rotated. FBI warns stolen credentials will be weaponized over extended timeframe. CloudSEK public lookup allows organizations to check exposure by domain. No CVSS score published; incident tracked under CVE-2026-33634 (added to CISA KEV March 26, 2026).

Urgency

🔴 Immediate

Recommended Actions

  • Check CloudSEK public lookup (https://cloudsek.com or referenced dataset) using your organization's domain to determine if you appear in the exposed dataset
  • Audit Python environments and CI/CD pipelines for LiteLLM 1.82.7 or 1.82.8 installations between March 24, 2026 10:39 UTC and 16:00 UTC; check pip logs, requirements files, and transitive dependencies
  • Immediately rotate all credentials accessible in affected environments: cloud provider keys (AWS, Azure, GCP), SSH keys, Kubernetes service account tokens, database passwords, PyPI publishing tokens, and AI model API keys (OpenAI, Anthropic, etc.)
  • Review outbound network logs for connections to models.litellm[.]cloud from March 24, 2026 onward to identify compromised hosts
  • Migrate from long-lived static credentials to short-lived tokens (OIDC for GitHub Actions, IAM roles for AWS, workload identity for Kubernetes) in CI/CD pipelines per FBI and Aqua guidance

---

# Threat Actor Context

Actor Profile

The threat actor behind this campaign is tracked by Google as UNC6780 and operates under the broader TeamPCP supply-chain operation. The actor's motivation centers on large-scale credential harvesting targeting software development and cloud infrastructure environments. The campaign originated from a compromise of Aqua Security's Trivy scanner infrastructure in March 2026, where attackers retained access after incomplete credential rotation. The actor leveraged this initial access to conduct a multi-stage supply chain attack, force-pushing malicious commits to Trivy repositories and subsequently weaponizing stolen PyPI publishing tokens to distribute compromised LiteLLM packages. The FBI has warned that affiliated actors are likely to weaponize exfiltrated credentials long after the initial compromise, indicating a sophisticated, persistent threat with strategic credential monetization objectives.

TTPs (Tactics, Techniques, Procedures)

The campaign demonstrates sophisticated supply chain attack techniques. Initial access was achieved through T1195.001 (Compromise Software Supply Chain) via the Trivy scanner breach (CVE-2026-33634). Attackers employed T1098 (Account Manipulation) by exploiting incomplete credential rotation to maintain persistence. For execution, the malware used T1059.006 (Python) via a litellm_init.pth file that executed at Python interpreter startup, ensuring code ran regardless of whether LiteLLM was explicitly imported. Credential access techniques included T1552.001 (Credentials In Files) targeting SSH keys, T1552.007 (Container API) for Kubernetes tokens, and T1087 (Account Discovery) through environment variable harvesting of OPENAI_API_KEY, ANTHROPIC_API_KEY, cloud credentials, and database passwords. Exfiltration occurred via T1041 (Exfiltration Over C2 Channel) to the attacker-controlled domain models.litellm[.]cloud after T1560.001 (Archive via Encryption) encrypted the stolen data. The attack chain also involved T1195.002 (Compromise Software Supply Chain) by uploading malicious packages to PyPI using stolen publishing tokens.

Targets & Patterns

The campaign primarily targeted organizations in the technology sector, cloud services providers, and software development environments. CloudSEK identified potential exposure to 2,100+ organizations from approximately 434,000 captured files, with high-profile victims including NVIDIA, Cisco, Deloitte, Volkswagen, FedEx, Siemens, and X Corp. The targeting pattern focuses on CI/CD pipelines and development environments where LiteLLM might be installed as a direct or transitive dependency. The actor specifically sought organizations using AI gateway infrastructure to connect applications with multiple model providers, as these environments typically contain high-value credentials including cloud API keys, SSH keys, Kubernetes tokens, and database passwords. The attack's design to execute via Python interpreter startup (litellm_init.pth) indicates targeting of automated build systems and continuous integration environments where Python processes run frequently. The focus on long-lived secrets (static cloud keys, SSH keys, publishing tokens) suggests the actor prioritizes persistent access to cloud infrastructure and software distribution channels for potential future exploitation or monetization.

Historical Context

This LiteLLM incident is a direct extension of the broader TeamPCP supply-chain campaign linked to the Aqua Security Trivy scanner compromise. On March 19, 2026, attackers force-pushed malicious commits to 76 of 77 trivy-action version tags and all seven setup-trivy tags while publishing a malicious Trivy 0.69.4 release. The Trivy ecosystem compromise is tracked as CVE-2026-33634 and was added to CISA's Known Exploited Vulnerabilities catalog on March 26, 2026. The malicious LiteLLM versions 1.82.7 and 1.82.8 were published on PyPI on March 24, 2026, from 10:39 UTC for approximately 40 minutes before quarantine. According to CloudSEK, Unit 42, and PyPA advisories, the attack chain progressed from the initial Trivy breach to credential harvesting, then weaponization of stolen PyPI publishing tokens to upload the compromised LiteLLM packages. The FBI issued advisory FLASH-20260702-01 on July 2, 2026, warning that affiliated actors are likely to weaponize credentials exfiltrated during the TeamPCP campaign long after the initial compromise, indicating ongoing threat activity and potential for future attacks using harvested credentials.

Defensive Recommendations

  • Immediately rotate all CI/CD secrets, PyPI publishing tokens, cloud credentials (AWS, Azure, GCP keys), SSH keys, Kubernetes tokens, and database passwords that were accessible in environments between March 19-24, 2026, regardless of whether malicious package installation is confirmed
  • Audit Python environments for LiteLLM versions 1.82.7 and 1.82.8 installed on March 24, 2026 (treat any install up to 16:00 UTC as suspect); check package manager logs and CI/CD pipeline dependencies including transitive dependencies from agent frameworks and orchestration tools
  • Implement detection for T1059.006 (Python execution) of .pth files at interpreter startup by monitoring Python site-packages directories for unauthorized litellm_init.pth or similar startup hooks; alert on unexpected network connections from Python processes to external domains during initialization
  • Monitor for T1552.001 and T1552.007 credential access by detecting bulk environment variable reads (OPENAI_API_KEY, ANTHROPIC_API_KEY, AWS_*, KUBECONFIG) and SSH key file access (~/.ssh/) from CI/CD runners; baseline normal access patterns and alert on anomalies
  • Transition from long-lived static credentials to short-lived, dynamically generated tokens for cloud services, publishing workflows, and CI/CD pipelines; implement OIDC-based authentication for GitHub Actions and similar platforms to eliminate static secrets
  • Deploy egress filtering and DNS monitoring to detect exfiltration attempts via T1041 to suspicious domains; specifically block or alert on connections to models.litellm[.]cloud and monitor for encrypted data transfers from build environments to unexpected external endpoints