Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
6 IOCs
LiteLLM 1.107.0 PyPI Wheel Contains a Credential Stealer and Persistent Python Backdoor
Excerpt
LiteLLM 1.107.0 PyPI Wheel Contains a Credential Stealer and Persistent Python Backdoor | OpenSourceMalware BLOG LiteLLM 1.107.0 PyPI Wheel Contains a Credential Stealer and Persistent Python Backdoor Startup hooks steal secrets on every interpreter launch, and the C2 appears to host an operator panel with victim data. By c0a15726-c5b1-4b0d-85e6-fe15553df9e2 · 2026-10-21T13:36:10.344Z The OpenSourceMalware team analyzed a wheel identifying itself as LiteLLM 1.107.0 and found…
Read the original report →Indicators of Compromise
Open the mindmap →6 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 20a59e5a285799e7cf7fa16cfba1c1414f1e84a8459e14207cfd4e998c2cd24b | Medium | Score 53/100 | First seen |
| SHA256 | 7f191632e7320705d154b85204f1ae546b543acbd7e8861229b76f5042b92bdb | High | Score 68/100 | First seen |
| SHA256 | 9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25 | High | Score 68/100 | First seen |
| SHA256 | 34bef04fe88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5968305fa | High | Score 68/100 | First seen |
| SHA256 | 7598727f209d717041db37f7dca271d3a7d328a279890e0e1d55375729aeb86d | High | Score 68/100 | First seen |
| SHA256 | 6ea3d8ef6cf73a72d8df24f663b7a31ce67494eeb9b0d707b93484e66675d2df | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…