models.litellm[.]cloudDomain
Reported by 2 independent sources · first reported by Trend Micro Research · last reported
Last reported 4 months ago
What the reports say
4 reports, newest first · the exact sentence from each-
Shai-Hulud Campaign Evolution: Miasma, Hades, and AI Scanner Evasion“models.litellm[.]cloud”
-
TeamPCP’s Telnyx Attack Marks a Shift in Tactics Beyond LiteLLM“`https[://]models.litellm[.]cloud/`”
-
Your AI Gateway Was a Backdoor: Inside the LiteLLM Supply Chain Compromise“Stolen credentials are encrypted with a hybrid RSA-4096 and AES-256 scheme and exfiltrated via HTTPS POST to models.litellm[.]cloud, a domain registered just one day before the attack.”
-
Your AI Stack Just Handed Over Your Root Keys: Inside the litellm PyPI Breach“Ensure your network drops all egress attempts to checkmarx.zone and models.litellm[.]cloud.”
Indicators reported together
named in the same reports- checkmarx[.]zonein 3 reports
- npmjs[.]helpin 1 report
- scanning[.]inin 1 report
- fulcio.sigstore[.]devin 1 report
- dc48b09b2a5954f7…a923cb4c0efein 1 report
- e1342a80d4b5e83d…180c93a4b17din 1 report
- c539766062555d47…a668975e275cin 1 report
- hxxps://api.anthropic[.]com/v1/apiin 1 report
- 83.142.209[.]203in 1 report
- scan.aquasecurtiy[.]orgin 1 report
- 45.148.10[.]212in 1 report
- 83.142.209[.]11in 1 report
- mirror.gcr[.]ioin 1 report
- 46.151.182[.]203in 1 report
- litellm[.]cloudin 1 report
Copy these 15 indicators · defanged
Also named with it: CVE-2024-3400
Thanks — we review every report.