Loading story…
Microsoft observed intrusions targeting exposed LiteLLM, RAGFlow, and Kestra AI control-plane workloads to obtain credentials, establish persistence, access downstream data, and deploy cryptocurrency-mining tools. In the LiteLLM case, attackers likely exploited an exposed gateway, harvested runtime and PostgreSQL secrets, deployed XMRig-like tooling, and persisted through SSH keys, cron modifications, hidden files, and immutable file attributes.
In a RAGFlow environment, attackers conducted SSRF-style reconnaissance and modified the application to persistently intercept newly configured LLM-provider credentials; Microsoft did not confirm the code-execution vulnerability used. A Kestra intrusion was assessed as likely exploiting CVE-2026-49869 to bypass authentication, run malicious workflows, access Docker container environments, deploy XMRig, and collect data through Kestra's key-value interface. Microsoft advised treating AI gateways, retrieval platforms, and workflow orchestrators as critical control-plane infrastructure because they centralize privileged execution and high-value secrets.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
Researchers reported that the campaign targeting exposed LiteLLM, RAGFlow, and Kestra services leveraged CVE-2026-42271, CVE-2026-48710, and CVE-2026-49869. The report also published associated domains, IP addresses, and SHA-256 indicators linked to the activity.
Microsoft assessed with high confidence that attackers likely exploited CVE-2026-49869 to bypass Kestra authentication, create a malicious workflow, and obtain worker-side shell execution. They accessed the Docker socket and container environment data, deployed XMRig connected to a Monero mining pool, and later collected data through Kestra's key-value interface.
Microsoft observed an intrusion of an exposed RAGFlow application, preceded by SSRF-style reconnaissance and followed by code execution in the service context. Attackers installed a hidden Python hook that intercepted and exfiltrated newly configured LLM-provider credentials and endpoint metadata.
Microsoft observed an intrusion of an exposed LiteLLM gateway, likely through exploitation of its gateway surface. The attackers harvested runtime and PostgreSQL credentials, accessed the backing Azure Database for PostgreSQL, deployed XMRig-like mining tooling, and established multiple persistence mechanisms.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 18 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
6 references tracked. Mallory keeps watching after this page renders.
community.gurucul.com
Open sourcecybersecuritynews.com
Open sourcemalware.news
Open sourcemicrosoft.com
Open sourcecve.org
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and vendors reported a sharp rise in attacks targeting AI infrastructure, from exposed self-hosted LLM servers to commercial coding assistants used in real intrusions. A Kaspersky honeypot posing as a private AI server with services including **Ollama**, **LM Studio**, **LangServe**, **text-generation-webui**, OpenAI-compatible APIs, RAG databases, and an MCP server was indexed by Shodan within hours and drew more than **113,000 requests** in a month from thousands of IP addresses. Nearly a quarter of the traffic focused on discovering and exploiting AI capabilities, with attackers attempting to consume inference resources, analyze documents, generate content, process vulnerability data, proxy requests to external models, and steal secrets from exposed `.env` files using tooling such as **LLM-Scanner**. The broader threat has moved beyond opportunistic abuse into targeted operations. Anthropic said suspected Chinese state-linked operators misused **Claude Code** against **30 high-value organizations** across technology, finance, chemicals, and government, using the AI assistant to test systems, generate attack code, harvest credentials, identify privileged accounts and backdoors, and support deeper intrusion activity; the company said the tool performed **80% to 90%** of the work in some cases. Separately, defenders were urged to rapidly patch internet-exposed management infrastructure after **CVE-2026-41940** in **cPanel/WHM** was exploited in the wild, allowing pre-authentication root access in as few as four HTTP requests and reportedly being used in ransomware activity, underscoring how exposed services and AI-enabled tradecraft are converging into a faster, more scalable attack model.
Jun 29, 2026
Microsoft reported a large-scale cryptomining campaign targeting Kubernetes clusters running **Kubeflow**, where attackers gained access through dashboards exposed to the public internet. The activity affected **tens of clusters** and was frequently tied to deployments in which the **Istio ingress gateway** had been changed to a public load balancer, leaving Kubeflow management interfaces reachable without adequate protection. After accessing the environment, the attackers abused Kubeflow features including custom **Jupyter** notebook images and notebook code execution with mounted service accounts to deploy malicious containers. Microsoft said the campaign used public container images such as `ddsfdfsaadfs/dfsdf:99` and related images to run the **XMRIG** cryptocurrency miner, and noted the namespace name `anonymous` as a recurring indicator. The company urged defenders to check clusters for the malicious images and ensure the Kubeflow dashboard is not publicly exposed.
Aug 15, 2026
The **Kingminer** botnet has been repeatedly observed compromising publicly exposed **Microsoft SQL Server** instances by brute-forcing weak credentials on TCP port `1433`, then deploying cryptocurrency miners and follow-on tooling. Researchers linked these intrusions to opportunistic campaigns that install customized **XMRig** miners, use downloader scripts and fileless **PowerShell** execution, and in some cases deliver **Cobalt Strike** beacons for persistence and post-compromise control. Investigations also found payload staging through **GitHub**, abuse of legitimate Windows binaries including `MSBuild.exe`, `rundll32.exe`, `control.exe`, and `main.cpl`, and injection into trusted processes such as `wwanmm.dll` to reduce detection. Threat reports describe Kingminer as a moderately sophisticated criminal botnet that combines public offensive tools with custom malware components, including reflective loading, DLL side-loading, and credential theft capabilities derived from tools such as **Mimikatz**. In one investigated intrusion, `sqlservr.exe` launched an obfuscated VBScript that downloaded a standalone PowerShell binary and executed additional scripts in memory before starting a miner. The malware also checked systems for **BlueKeep**-related hotfixes `KB4499175` and `KB4500331` and disabled **RDP** on vulnerable hosts, apparently to block competing botnets from exploiting the same machines. Defenders were advised to enforce strong SQL passwords, restrict internet exposure, patch public-facing services, and improve logging and monitoring, as repeated attack attempts stopped once the underlying weakness was remediated.
Aug 14, 2026