LiteLLM 1.107.0 Supply Chain Compromise Hunt

Goksel Atakan@gokselatakan

•updated 3 days ago•14•1•32

Detects artifacts of the compromised litellm 1.107.0 release: connections to the exfiltration host, installs of the affected version and the dropped stealer files. Needs Defender for Endpoint network, process and file events and covers only published indicators. The query ran without errors in a live tenant.