From CI Pipeline to Ransomware Leak Site: 6 High-Profile Breaches in the LiteLLM Attack
By the Hudson Rock Threat Intelligence Team
Following our initial report detailing the largest AI supply chain breach of the year, Hudson Rock’s threat intelligence team has continued to analyze the catastrophic fallout of the LiteLLM and Trivy supply chain campaign. As part of our global ethical disclosure efforts, we have reconstructed the attack paths likely used by threat actors to compromise enterprise environments worldwide.
This blog serves as an urgent call to action. Our goal is not to point fingers, but to provide transparency and urge companies to claim their ethical disclosures and lock down their environments before this exfiltrated data begins to circulate more heavily among opportunistic cybercriminals.
The LiteLLM/Trivy data gives us rare and terrifying insight into how organizations suffered devastating ransomware attacks lately. By analyzing the compromised CI runner dumps, we can map exactly what the threat actors likely obtained before launching their extortion campaigns.
📊 The Blast Radius: By the Numbers
We disclosed compromised CI/CD pipelines, live cloud keys, and API tokens to over 250 global enterprises, including 30+ S&P 500 and Global Fortune 500 companies across every critical sector:
Below, we deep dive into the high-profile organizations compromised in this campaign and detail the exact secrets, tokens, and configurations that likely fueled downstream extortion by groups like Vect ransomware (TeamPCP).
1. Guesty
The Breach: The property management software company Guesty suffered a direct hit to their critical cloud infrastructure. As seen on the leak sites above, this data was quickly weaponized for extortion.
How Hackers Likely Got In: Based on our analysis of the compromised CI runner dumps and public reports, it is assessed that threat actors likely gained access to critical cloud infrastructure, specifically exposing dozens of AWS Access Keys and secrets directly from Guesty’s CI pipelines. The raw pipeline logs dumped the credentials in plain text, which likely granted the attackers administrative access to their cloud environments.
2. S&P Global
The Breach: For S&P Global, the blast radius of this supply chain attack is massive. Like Guesty, S&P Global’s harvested credentials directly fueled downstream extortion and resulted in them being listed on the Vect ransomware group’s leak site.
How Hackers Likely Got In: Evidence suggests threat actors likely intercepted temporary AWS STS session tokens and long-lived AWS keys during a terraform-actions workflow. The sheer volume of exposed data is staggering: judging by the telemetry, attackers likely accessed thousands of secrets, GitHub tokens, JWTs, and RSA private keys, fundamentally compromising their internal repository and cloud security architecture.
3. Cisco
The Breach: Cisco’s source code was stolen in a breach linked directly to a compromised development environment running a poisoned Trivy container. The attackers likely infiltrated critical repositories, including cisco-it-cloud-infrastructure.
How Hackers Likely Got In: Judging by the environment dumps, it appears the attackers likely scraped GitHub Personal Access Tokens (PATs) and highly sensitive API keys from the runner’s environment variables. The exposure of an Artifactory token likely allowed access to internal packages, while a Conjur API key appears to have provided a foothold into Cisco’s broader secret management infrastructure.
4. European Commission
The Breach: The European Commission suffered a severe cloud breach resulting from this campaign. The compromised runner was executing a Terraform deployment for AWS infrastructure.
How Hackers Likely Got In: Telemetry indicates attackers likely obtained AWS IAM credentials directly from the environment, granting administrative cloud access. Furthermore, a hardcoded SSH private key and GitLab CI tokens appear to have been exposed, which would likely allow the threat actors to pivot laterally across the European Commission’s GitLab infrastructure.
5. Mercor
The Breach: Mercor, a $10 billion AI startup, faced a catastrophic security incident impacting their AI annotation and RL Studio platform resulting from the LiteLLM supply chain attack.
How Hackers Likely Got In: Based on the data, it appears attackers likely exfiltrated local configuration files and runner environment variables. This would provide direct administrative access to Mercor’s AI models via Anthropic API keys, project management via Linear, and data pipelines via Datadog and Dagster.
6. Telnyx
The Breach: Telecom and communications platform Telnyx was breached through their internal infrastructure via malicious Python SDK packages tied to the broader campaign.
How Hackers Likely Got In: According to the data dumps, it is assessed that attackers likely recovered Docker configuration files containing base64-encoded basic authentication credentials and GitHub PATs. This would have allowed threat actors to pull and push directly to Telnyx’s internal production and development container registries.
🚨 Free Look-Up Tool for Affected Organizations
Because of the critical nature of this massive campaign, Hudson Rock is committed to performing ethical disclosures for affected organizations.
We have launched a dedicated portal where companies can verify if their domains are part of this compromised dataset. Following confirmation of impact, organizations can reach out directly through the tool to receive a full ethical disclosure regarding their exposure.
At Hudson Rock, we’ve wrapped up our direct ethical disclosures for affected enterprises and have just provisioned the intelligence data directly to our cybersecurity partners so they can immediately protect their own customers.
Search Your Domain Now
