大规模供应链攻击泄露数太字节凭据

安全公司披露，攻击者通过 LiteLLM 的供应链攻击在40分钟内窃取数TB凭据，可访问超2500个组织。

• 受影响实体包括微软、亚马逊、思科、三星、Salesforce 等大型组织。
• 泄露内容涵盖云密钥、仓库令牌、SSH 密钥、Kubernetes 机密、包发布凭据、环境变量及 AI 提供商密钥。
• 攻击发生于3月份一个40分钟窗口，用户在 PyPI 官方仓库下载了被入侵的 LiteLLM 版本。
• Hudson Rock 在分析一个 195TB 文件时发现这些凭据。
• CloudSEK 称攻击者可借此访问超过 2,500 个组织。

• Terabytes worth of credentials, many belonging to the world’s biggest and most sensitive organizations, have been exposed in a supply-chain attack on LiteLLM
• CloudSEK said it found cloud keys, repository tokens, SSH keys, Kubernetes secrets, package publishing credentials, environment variables, and AI provider keys that could allow attackers to gain access to more than 2,500 organizations.
• The credentials were extracted during a 40-minute window in March while the victims used compromised versions of LiteLLM downloaded from the package’s official location in the Python Package Index repository.