Attack on Software Supply Chain Access Data from over 2000 Companies Stolen

Related Vendors

dataTec AG

Taiwan Machine Tool & Accessory Builders' Association (TMBA)

Through a compromised repository of the open-source tool LiteLLM, cybercriminals were able to capture the access data for build pipelines from over 2500 companies. The attack lasted only 40 minutes, during which the attackers extracted several terabytes of data.

Security researchers have released new findings about a supply chain attack on the open-source tool LiteLLM. According to IT security companies CloudSEK and Hudson Rock, the incident affected more than 2,500 organizations. The data reportedly includes access credentials from companies such as Amazon Web Services, Cisco, Samsung, Salesforce, Siemens, Volkswagen, and Deutsche Bahn.

LiteLLM is an open-source library that can be accessed via a proxy server or Python SDK. It provides a unified interface to call over 100 large language models, such as those from OpenAI or Anthropic.

The starting point of the attack was manipulated versions of LiteLLM, which were distributed via the official Python Package Index (PyPI) in March. According to researchers, the compromised packages were available for only about 40 minutes. However, during this time, they were downloaded and executed by automated development and build systems in numerous companies.

CloudSEK and Hudson Rock estimate that data from around 434,000 CI/CD pipelines is affected. CI/CD systems automate tasks such as building, testing, and deploying software, often requiring extensive access rights to source code repositories, cloud services, and other internal systems. The available data indicates that corresponding access credentials may have been exposed. However, it does not confirm in every single case that all included credentials were actually used by attackers.

According to Hudson Rock, the findings were obtained in part through the analysis of a dataset totaling 195 terabytes. Among other things, the researchers discovered cloud keys, repository tokens, SSH keys, Kubernetes secrets, credentials for publishing software packages, environment variables, and keys for AI services. Some of this information could be linked to specific companies, while other datasets could not be attributed due to a lack of distinct identifiers.

Malware Extracted Data from Build Systems

The compromised software packages contained malicious code capable of reading information from the memory of affected systems and transmitting it to attacker-controlled infrastructure. According to CloudSEK, the malware, referred to as "Sandclock" by Google, specifically targeted API keys for language models and configurations of AI gateways. The data was reportedly encrypted before transmission.

According to the researchers, the LiteLLM incident is part of a larger attack campaign targeting software supply chains. Previously, the widely used vulnerability scanner Trivy had also been compromised. The software KICS and the Python SDK of the telecommunications provider Telnyx are also said to have been affected. The group TeamPCP claimed responsibility for the campaign, and security researchers consider their involvement plausible based on the current findings.

The particular risk of such attacks lies in the automated processing of software dependencies. If a package in a central source is manipulated, build systems can retrieve and execute the altered version without manual intervention. As a result, even a relatively short time window can be sufficient for malicious code to spread across numerous independent development environments.

It remains unclear how many of the exposed credentials can still be used. According to the researchers, simply removing the compromised package versions is not sufficient. Access keys, tokens, and passwords may still be valid unless explicitly revoked or replaced. According to CloudSEK, the FBI warned in July that actors linked to TeamPCP could exploit stolen credentials even long after the original attack.

CRA, RED, and CS&R

Regulations to Secure the Connected World

Researchers Recommend a Comprehensive Exchange of Access Data

CloudSEK and Hudson Rock recommend that organizations using LiteLLM in their development environments specifically review versions 1.82.7 and 1.82.8. Potentially affected companies should assume, in their assessment, that secrets accessible to the respective LiteLLM environment may have been compromised. These include, among other things, cloud keys, Kubernetes service account tokens, as well as personal access tokens for GitHub and GitLab.

Additionally, the researchers advise examining log data for suspicious access and increasing control over outgoing network traffic from build systems. The incident also highlights the impact that compromised components can have in modern software supply chains: highly automated development processes can allow a single manipulated dependency to reach a large number of companies within a short time.

Organizations identified with high confidence as affected by CloudSEK and Hudson Rock

• Nvidia Corporation
• Amazon Web Services (AWS)
• Samsung Electronics
• samsung.com
• Salesforce, Inc.
• Cisco Systems, Inc.
• F. Hoffmann-La Roche AG
• ServiceNow
• Siemens AG
• S&P Global
• Airbus US Space & Defense
• John Deere
• Regeneron Pharmaceuticals, Inc.
• London Stock Exchange Group (LSEG)
• Thomson Reuters
• FedEx
• Munich Re munichre.com
• MediaTek Inc.
• Volkswagen AG
• Deloitte
• The Kroger Co.
• Siemens Energy
• Thales Group
• X Corp (Twitter)
• Zscaler, Inc.
• Epic Games
• Orange S.A.
• HP Inc.
• Philips
• Fortum Oyj
• Vodafone Group Plc
• Carl Zeiss AG
• Deutsche Bahn AG
• NGINX, Inc.
• BT Group
• Liebherr
• Krungthai Bank Public Company Limited
• Roku, Inc.