Cybercriminals are increasingly targeting artificial intelligence infrastructure as organizations deploy AI gateways, retrieval-augmented generation platforms, and workflow automation systems across cloud environments.
Microsoft has observed attacks involving LiteLLM, RAGFlow, and Kestra, showing how compromised AI infrastructure can expose API keys, database credentials, internal services, container environments, and computing resources.
Unlike traditional application attacks, these systems often sit at critical control points connecting users, models, applications, data repositories, and external AI providers.
Hackers Target AI Infrastructure
In attacks involving LiteLLM, threat actors appear to have targeted exposed gateway infrastructure and potentially chained multiple vulnerabilities to gain command execution.
Microsoft linked the activity to possible exploitation of CVE-2026-42271, a command-execution flaw affecting LiteLLM MCP stdio test endpoints, alongside CVE-2026-48710, a Starlette host-header validation bypass that could weaken authentication in vulnerable configurations.
Once execution was obtained, attackers accessed /proc/1/environ to harvest environment variables that may contain model-provider API keys, LiteLLM master keys, database connection strings, passwords, and authentication tokens.
The attackers also accessed a LiteLLM PostgreSQL database containing model configuration information and virtual-key records. This provided an additional source of sensitive credentials and infrastructure information.
After gaining access, the threat actors downloaded malicious payloads into temporary directories and used filenames designed to resemble legitimate Linux services.
Their activity ultimately included deployment of XMRig cryptocurrency-mining software, turning compromised AI infrastructure into a source of unauthorized computing revenue.
Persistence and defense evasion were also observed during the LiteLLM activity. The attackers attempted to remove competing cryptocurrency miners, modified SSH authorized_keys files, altered cron jobs, and used immutable file attributes to make malicious files more difficult to delete.
These techniques indicate that the objective was not limited to initial credential theft but also involved maintaining control of compromised systems and maximizing access to available computing resources.
The RAGFlow intrusion followed a different approach, focusing primarily on credential interception. Microsoft observed suspected SSRF-style reconnaissance followed by modifications to files inside the RAGFlow container.
Attackers created a concealed Python hook capable of intercepting API credentials when administrators added or updated large language model provider configurations.
The malicious code captured provider names, model information, API keys, and endpoint metadata before transmitting the collected information to attacker-controlled infrastructure while allowing legitimate configuration activity to continue.
Microsoft has not confirmed which vulnerability was responsible for the RAGFlow compromise, although several publicly disclosed vulnerabilities may provide relevant technical context.
The technique demonstrates the danger of compromising applications that legitimately process secrets. Rather than stealing credentials directly from a configuration file, attackers can intercept them during normal administrative operations, making malicious activity potentially harder to notice.
Kestra, a workflow orchestration platform, was targeted for its ability to execute shell commands through workflows. Microsoft assessed that attackers likely exploited CVE-2026-49869, a critical authentication-bypass vulnerability that could allow an unauthenticated attacker to create and execute a malicious workflow.
Such access can provide a direct path toward command execution, container discovery, credential collection, and further compromise of connected infrastructure.
The attacks demonstrate that AI infrastructure should be treated as critical control-plane technology rather than ordinary application software.
Organizations should immediately patch exposed AI platforms, restrict administrative interfaces, eliminate unnecessary test endpoints, protect secrets outside environment variables where possible, monitor container and workflow changes, and audit outbound connections.
Security teams should also monitor suspicious cryptocurrency-mining processes, unexpected SSH key modifications, cron changes, and unusual access to AI-provider credentials.
Indicators associated with the activity include 45.150.109[.]151, linked to scanning and reconnaissance against AI workloads, and 135.125.10[.]56:19888, associated with RAGFlow exploitation, command-and-control activity, and LLM API-key exfiltration.
These indicators should be treated as threat-intelligence leads and investigated within controlled security environments.
No Comment! Be the first one.