Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
Hackers Target LiteLLM, RAGFlow and Kestra AI Infrastructure to Steal API Keys and Mine Crypto
Malware Families
Excerpt
Hackers are increasingly targeting AI infrastructure to steal API keys, gain access to backend systems, maintain persistence, and mine cryptocurrency . Microsoft has observed attacks against LiteLLM, RAGFlow, and Kestra three platforms that can hold sensitive model credentials, workflow permissions, database connections, and container access. AI gateways, retrieval platforms, and workflow orchestration tools have become high-value targets because they sit between…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-42271 | High | Score 66/100 | First seen |
| IP | 45.150.109.151 | Low | Score 34/100 | First seen |
| CVE | CVE-2026-48710 | Medium | Score 59/100 | First seen |
| CVE | CVE-2026-49869 | Medium | Score 54/100 | First seen |
| IP | 135.125.10.56 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…