Supply Chain
8 items across 3 sections
We Detonated the Real LiteLLM Malware on EC2: Here's What Happened
We obtained the actual compromised litellm packages, set up a disposable EC2 instance with honeypot credentials and mitmproxy, and detonated the malware. Full evidence: fork bomb, credential theft in under 2 seconds, IMDS queries, AWS API calls, and C2 exfiltration.
Anatomy of a Supply Chain Attack: How LiteLLM Was Weaponized in 6 Hours
A deep technical breakdown of how threat actor TeamPCP compromised Trivy, pivoted to LiteLLM, and turned a popular AI proxy into a credential-stealing weapon targeting AWS IMDS, Secrets Manager, and Kubernetes.
Week 12 - Mar 16-22, 2026
AWS issues four security bulletins in a single week, signaling fresh scrutiny on developer tooling and cryptographic libraries. Trivy CI/CD pipelines get backdoored by TeamPCP. Amazon publishes 36-day-old honeypot intel on Interlock ransomware exploiting Cisco Firewall Management Center.
Week 13 - Mar 23-30, 2026
Over 350 GB stolen from the European Commission's AWS environment, confirmed publicly March 27. AWS clarifies its services were not breached, this is shared-responsibility 101 played out at the highest level of EU government. LiteLLM packages get backdoored to steal IMDS credentials. RSAC 2026 happens in San Francisco.
Week 22 - May 25-31, 2026
AWS Network Firewall can now allow or block traffic by website category, including generative-AI services, with the matches visible in CloudWatch Logs Insights. AWS also published Well-Architected guidance for defending the software supply chain against attacks like Shai-Hulud, and a path to move centralized firewall inspection onto Transit Gateway attachments.
Week 24 - June 8-14, 2026
Four AWS bulletins land in a single week, all in the build and agent toolchain: AgentCore CLI code injection, CDK command injection, s2n-quic memory exhaustion, and a heap double-free in the HTTP client under the C++ and Java SDKs. Meanwhile the Klue breach shows again what stolen OAuth integration tokens are worth.
Week 31 - Jul 27 - Aug 2, 2026
AWS attributes the debug, chalk, and axios npm compromises to North Korea's SAPPHIRE SLEET group, with Wiz data showing roughly 1 in 10 cloud environments hit within a two-hour window. Shield Advanced begins migrating to the WAF Anti-DDoS managed rule group as its default Layer 7 protection. Four new AWS security bulletins land, including an unauthenticated DoS in aws-smithy-json.
Need Help with AWS Security?
Our AWS security experts can help you implement best practices across all these topics.
Contact Us