TeamPCP LiteLLM Supply Chain Attack Persistence Indicators

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the creation of specific persistence files as observed in the LiteLLM PyPI supply chain attack. In March 2026, a supply chain attack was discovered involving the popular open-source LLM framework LiteLLM by Threat Actor TeamPCP. The malicious package harvests every credential on the system, encrypts and exfiltrates them, and installs a persistent C2 backdoor.

2026-03-30 00:00:00

None

81c0b7f5-81c9-435e-a291-bc32fc2b72cd

attack.persistence attack.privilege-escalation attack.t1543.002 attack.initial-access attack.t1195.002 detection.emerging-threats

Community Rule

Swachchhanda Shrawan Poudel

Merge PR #5923 from @swachchhanda000 - Add litellm Supply Chain Attack Related Rules

2026-04-01