Full Report
Wiz honeypots uncover active campaigns targeting LiteLLM, MCP servers, and AI frameworks through RCE, blind prompt injection, and memory credential theft.
Analysis Summary
# Tool/Technique: AI Infrastructure Exploitation (LiteLLM & MCP Servers)
## Overview
This attack pattern involves the exploitation of AI-specific infrastructure, specifically the Model Context Protocol (MCP) and LiteLLM proxies. Attackers leverage vulnerabilities in how AI agents and proxies handle authentication and tool integration to achieve Remote Code Execution (RCE) and move laterally within cloud environments.
## Technical Details
- **Type:** Technique / Vulnerability Exploitation
- **Platform:** Linux-based cloud AI infrastructure, LiteLLM, MCP Servers
- **Capabilities:** Authentication bypass, Command Injection, Cryptomining, Credential Theft.
- **First Seen:** Early 2026 (based on CVE dates)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1190 - Exploit Public-Facing Application]
- **[TA0002 - Execution]**
- [T1059.006 - Command and Scripting Interpreter: Python]
- **[TA0006 - Credential Access]**
- [T1555 - Credentials from Password Stores]
- **[TA0040 - Impact]**
- [T1496 - Resource Hijacking]
## Functionality
### Core Capabilities
- **Authentication Bypass (CVE-2026-59822):** Exploits a flaw in LiteLLM's MCP Gateway where failed OAuth2 token validation returns an unrestricted `UserAPIKeyAuth()` object, allowing access with any bearer token (e.g., `Authorization: Bearer x`).
- **Command Injection (CVE-2026-42271):** Targets MCP server test endpoints. Because the `command` field is passed directly to subprocess execution without validation, attackers inject Python scripts.
- **Resource Hijacking:** Automatic deployment of cryptominers (`gmon`) via staging scripts that download ZIP files from remote servers.
### Advanced Features
- **AI-Native Post-Exploitation:** Attackers specifically target model provider keys (OpenAI, Anthropic, etc.) stored within LiteLLM proxies, enabling mass credential theft from a single point of compromise.
- **Evasion:** Use of `start_new_session=True` in Python to detach malicious processes and immediate self-deletion of staging directories using `shutil.rmtree`.
## Indicators of Compromise
- **File Hashes:**
- (SHA256 of `gmon` or `mon.zip` not provided in snippet, but referenced as `m.zip`)
- **File Names:**
- `/tmp/.dbus-cache/m.zip`
- `/tmp/.dbus-cache/gmon`
- **Network Indicators:**
- `http[:]//185[.]62[.]1[.]8/mon/mon.zip`
- **Behavioral Indicators:**
- `GET /v1/models` requests with single-character Bearer tokens.
- Python subprocesses spawning detached binaries from `/tmp`.
- Unexpected outbound connections from AI proxy services to known mining pools.
## Associated Threat Actors
- Unknown (Activity characterized by opportunistic exploitation of AI framework vulnerabilities).
## Detection Methods
- **Signature-based detection:** Monitor for the specific Python staging script patterns used in MCP configuration tests.
- **Behavioral detection:**
- Flagging `subprocess.Popen` calls originating from LiteLLM web worker processes.
- Monitoring for empty or single-character Authorization headers in AI API gateways.
- **YARA rules:** Target the MCP handshake JSON response (`protocolVersion`, `capabilities`) embedded within malicious Python scripts.
## Mitigation Strategies
- **Patching:** Immediately update LiteLLM to versions addressing CVE-2026-59822 and CVE-2026-42271.
- **Network Segmentation:** Place MCP servers in isolated networks; do not expose them to the public internet without robust, verified authentication.
- **Least Privilege:** Ensure AI proxies (like LiteLLM) run with minimal IAM permissions to limit the blast radius of a credential theft event.
- **Input Validation:** Sanitize all fields in AI framework UIs, especially those involving "test connection" or "tool configuration" features.
## Related Tools/Techniques
- **Blind Prompt Injection:** Indirectly related; used to trigger tools or extract data from AI agents.
- **MCP (Model Context Protocol):** The underlying protocol being abused for lateral movement.
- **Flowise / LangChain:** Other AI frameworks frequently targeted by similar infrastructure attacks.