Wiz says credentials tied to LiteLLM attack were used to probe Amazon Bedrock

Security firm Wiz reported that AWS credentials stolen through a compromised LiteLLM release were validated and used to call Amazon Bedrock's model-listing APIs between 11:20 a.m. and 12:01 p.m. CDT on Oct. 21, within hours of the compromise. Wiz said the attacker tested instance-role credentials harvested from compromised CI runners and Kubernetes nodes across multiple environments, an early sign of attempted AI-account abuse.

Wiz says credentials tied to LiteLLM attack were used to probe Amazon Bedrock Security firm Wiz says AWS credentials stolen through the compromised LiteLLM release were tested within hours. By Emerson Redding https://runtimewire.com/author/emerson-redding · Published · Updated Primary source: wiz.io https://www.wiz.io/blog/litellm-compromised-steals-credentials Why it matters Wiz's findings show AWS credentials stolen through LiteLLM being tested against Amazon Bedrock within hours, an early sign of attempted AI-account abuse. Credentials stolen through the compromised LiteLLM https://litellm.ai/?ref=runtimewire release were put to work within hours, according to security firm Wiz. Between 11:20 a.m. and 12:01 p.m. CDT on Oct. 21st, an attacker validated AWS instance-role credentials "harvested from compromised CI runners and Kubernetes nodes across multiple environments," then called Amazon Bedrock's model-listing APIs, Wiz said in an update to its research https://www.wiz.io/blog/litellm-compromised-steals-credentials?ref=runtimewire .… When you purchase through links in our articles, we may earn a small commission https://runtimewire.com/affiliate-monetization-standards . This doesn’t affect our editorial independence.