Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
9 IOCs
LiteLLM supply chain compromise: What you need to know
Excerpt
LiteLLM supply chain compromise: What you need to know | Datadog Security Labs Security Labs ARTICLES CLOUD SECURITY ATLAS NEWSLETTER ABOUT ARTICLES CLOUD SECURITY ATLAS NEWSLETTER ABOUT emerging threats and vulnerabilities LiteLLM supply chain compromise: What you need to know October 21, 2026 software supply-chain security threat research application security twitter reddit on this page What happened Timeline Payload analysis Data exfiltration What to do if you are affected…
Read the original report →Diamond Model
Adversary
Infrastructure(1)
Capability
Victim
Indicators of Compromise
Open the mindmap →9 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 1bbce8caa94f01c0aaa0b7ddae51553a8a32e1ce53d96d44fe583272aff7ad00 | High | Score 64/100 | First seen |
| SHA256 | c2e32d0ce2548aa662c18bf5001911a79fe5b30cf8357132275add02fdcde054 | High | Score 64/100 | First seen |
| SHA256 | 0aaf7ba346d41ef2f40390436738b001180d5a1c03aa093f121078a9969d9a1a | High | Score 64/100 | First seen |
| SHA256 | 1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e | High | Score 64/100 | First seen |
| SHA256 | 12d4ccc5c6f8d35cf4f2cf233b7f3e418e863e657d81ff5f5fc9e210005b9484 | High | Score 64/100 | First seen |
| SHA256 | 462d0c9f67ca522d9e0e4acd245e90b36ce0d5353604a66bb7c43a1ec4a6fcf7 | High | Score 64/100 | First seen |
| Domain | litellm.dev | High | Score 64/100 | First seen |
| SHA256 | 668169d35b87bf51324080390b1b1c5ab12bd335cfe5f1a99e3689abd5e02ae6 | High | Score 64/100 | First seen |
| SHA256 | 7598727f209d717041db37f7dca271d3a7d328a279890e0e1d55375729aeb86d | High | Score 68/100 | First seen |
IOC Relationship Graph
Building graph…