The IT Nerd

Researchers at Rapid 7 have uncovered evidence of an advanced China-nexus threat actor, Red Menshen, placing stealthy digital sleeper cells in telecommunications networks to carry out high-level espionage, including against government networks.

Rapid 7 has a blog post on this here: https://www.rapid7.com/blog/post/tr-bpfdoor-telecom-networks-sleeper-cells-threat-research-report/

Lieutenant General Ross Coffman (U.S. Army, Ret.) who currently serves as President of Forward Edge-AI, provided the following comment:

“Chinese hackers caught deep in the backbone of telecommunications infrastructure are doing so for high-level espionage.

Anyone that’s surprised by this news should be embarrassed. This is not the end nor the beginning. We’re in a fight to protect our data. PWC technologies that protect data inflight need to be deployed across verticals to protect the US and the free world against China and other malicious actors.”

This shows how far threat actors are willing to go to execute whatever plans that they have. This is crafty and stealthy and dangerous. Defenders should bear that in mind.

According to researchers at Endor Labs, a supply chain attack has compromised the widely used LiteLLM Python library on PyPI, with malicious code introduced into versions 1.82.7 and 1.82.8, which have since been removed. The package is used in AI and developer environments and is estimated to see approximately 95 million downloads per month, significantly expanding the potential impact.

The malicious releases contained credential-stealing malware, including a .pth file that executes automatically when Python starts, allowing attackers to collect SSH keys, cloud credentials, API tokens, and environment variables from affected systems. In some cases, the malware also attempted to access Kubernetes secrets and deploy persistent backdoors on compromised machines.

The incident has been linked to the TeamPCP threat group, which previously targeted software supply chains, and is believed to be connected to earlier compromises involving developer tooling. Researchers reported that the attackers used compromised publishing credentials to distribute the malicious packages, with claims that data may have been collected from hundreds of thousands of affected devices.

Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:

   “Every third-party dependency is a trust decision. The LiteLLM compromise demonstrates what happens when that trust is granted by default and at scale.

   “TeamPCP did not need to attack LiteLLM directly. They compromised Trivy, a vulnerability scanner running inside LiteLLM’s CI pipeline without version pinning. That single unmanaged dependency handed over the PyPI publishing credentials, and from there the attacker backdoored a library that serves 95 million downloads per month. One dependency. One chain reaction. Five supply chain ecosystems compromised in under a month.

   “The pattern is instructive. TeamPCP has exclusively targeted security adjacent tools. A vulnerability scanner, an infrastructure as code analyzer, and now an LLM proxy that handles API keys by design. These tools run with broad access because that is how they function. Compromising one hands the attacker every credential and secret that tool was trusted to touch.

   “This incident forces a broader conversation about how organizations treat their dependency graph. Zero trust has been applied to users, devices, and networks. Dependencies deserve the same scrutiny. Every imported library, build tool, and CI plugin carries implicit trust that is rarely evaluated with the same rigor applied to a new network connection or user account. At enterprise scale, this creates compounding technical debt where a single compromised package can cascade across the entire environment.

   “The cost of building capability in house has dropped significantly. Organizations have more options to reduce their dependency surface than they did even two years ago. Dependencies that were once unavoidable are now choices. Where a third party library handles sensitive credentials, routes API traffic, or runs inside a build pipeline, organizations should be asking whether the risk of importing that dependency outweighs the cost of building and maintaining the capability internally. For the dependencies that remain, strict service level agreements, continuous verification, and the same zero trust posture applied to any other external input are the minimum standard.

   “The dependency graph is part of the attack surface. Treating it as anything less is how cascading compromises happen.”

Noelle Murata, Sr. Security Engineer, Xcape, Inc.:

   “The LiteLLM incident is a textbook example of “blind-trust” engineering, where the convenience of a one-line install command outweighs basic cryptographic integrity. The business impact here is a complete loss of environment isolation, as a single unverified pip install can transition an attacker from a developer’s terminal to the core of a Kubernetes cluster in seconds.

   “We should care because the industry’s reliance on public repositories without local hash verification or “lockfiles” has effectively turned the Internet into an unvetted production dependency. This breach succeeded because many organizations treat PyPI as a trusted internal mirror rather than a public, high-risk source of untrusted code.

   “To remediate this, defenders must move beyond reactive patching and enforce the use of signed software bills of materials (SBOMs) and private package registries that require mandatory hash pinning and pre-install scanning. If your CI/CD pipelines are pulling directly from the public Internet without validating a requirements.txt against known-good hashes, you have effectively outsourced your root access to anyone who can phish a single package maintainer.

   “Installing unvetted packages from the Internet is essentially the digital equivalent of eating a sandwich you found on the subway and being surprised when you get food poisoning.”

Rajeev Raghunarayan, Head of GTM, Averlon:

   “The LiteLLM compromise reflects an accelerating pattern: attackers using compromised publishing credentials to inject malicious code into widely used libraries, turning trusted dependencies into distribution mechanisms for credential-stealing malware.

   “What makes incidents like this dangerous is the scope of access they expose. Cloud credentials, API tokens, and Kubernetes secrets don’t just represent a single point of compromise. They create pathways into the broader infrastructure those credentials connect to.

   “This is the pattern organizations need to plan for. The initial compromise is rarely where the real damage happens. It’s where the attack chain begins.”

Ryan McCurdy, VP of Marketing, Liquibase:

   “Incidents like this are a reminder that in the AI era, software supply chain risk is expanding faster than most control models. When widely used developer and AI tooling is compromised, the blast radius can move quickly across credentials, cloud environments, and production systems.

   “The lesson for enterprise teams is bigger than any one package: governance has to extend across how change is introduced, validated, promoted, and audited. Speed without control is not modernization. It is exposure.”

Blind trust in anything is a bad thing. This is example of why that is a bad thing. And why companies need to trust but verify. Or simply not trust at all.

A supply chain attack targeting Aqua Security’s Trivy vulnerability scanner has expanded, with researchers from Socket identifying at least 141 malicious artifacts across more than 66 packages following the initial compromise.

The campaign began with unauthorized access to Trivy’s GitHub Actions environment, where attackers used stolen credentials to publish malicious code into trusted components used in CI/CD pipelines.

The attack involved replacing legitimate package contents with credential-stealing malware, which is designed to extract sensitive data such as API keys, cloud credentials, SSH keys, and authentication tokens from affected environments.

The malicious code executes within automated workflows, allowing it to collect secrets from CI/CD runners and transmit them to attacker-controlled infrastructure.

Researchers also observed that the campaign exhibits self-propagating behavior, where stolen publishing tokens are reused to compromise additional packages and distribute malicious updates, enabling the attack to spread across development ecosystems as compromised pipelines unknowingly publish infected code to downstream users.

Damon Small, Board of Directors, Xcape, Inc.:

   “This incident is a masterclass in why “trust but verify” is dead in CI/CD. By force-pushing malicious commits to existing version tags (e.g., @v0.34.2), the threat actor – identified as TeamPCP – turned a trusted security tool into a weaponized delivery vehicle without changing a single line of a user’s workflow file. This highlights the fatal flaw of relying on mutable Git tags rather than immutable commit SHAs.

   “The risk here is a “wormable” supply chain: the malware scrapes runner memory for GitHub PATs and cloud keys, which it then uses to compromise any other repositories that the infected pipeline has write access to. For defenders, the priority isn’t just updating Trivy; it is a scorched-earth credential rotation.

   “If your pipelines ran a Trivy scan between March 19 and March 23, 2026, you must assume every secret accessible to that runner -AWS keys, NPM tokens, and SSH keys – has been exfiltrated. Moving forward, security teams must enforce the pinning of all third-party GitHub Actions to full 40-character commit hashes to prevent this “silent” tag-swapping from recurring.

   “It takes a special kind of irony for a vulnerability scanner to become the primary infection vector for your entire cloud environment.”

Rajeev Raghunarayan, Head of GTM, Averlon:

   “Incidents like the Trivy compromise show how modern attacks move through trusted development pipelines by combining weaknesses across code, infrastructure, and identity.

   “The real risk isn’t just how attackers get in. It’s what that access allows them to reach. Once CI/CD systems are involved, attackers can inject malicious code into trusted artifacts, then use automation to access sensitive credentials and spread downstream.

   “This is why organizations need to focus on attack pathways, not just individual issues. Understanding how exposures connect, and prioritizing the ones that lead to critical systems, is what ultimately limits blast radius.”

Denis Calderone, CTO, Suzu Labs:

   “This is the inherited trust problem we’ve been tracking all month, but this one takes it to a completely different level. The other incidents, VMware, Cisco, Stryker’s MDM, n8n, were all management tools that carry deep access in your environment. Trivy is an example where the actual tool you run to find vulnerabilities is the vulnerability. The scanner was harvesting the most sensitive credentials before the legitimate scan even executed.

   “This is the same pattern we saw with SolarWinds back in 2020, where the security monitoring platform became the attack vector. When the tool you trust to establish trust is the one that’s been turned against you, you’ve got an inherited trust problem at the deepest level there is.

   “The technical execution here is worth paying attention to. Stolen credentials from a misconfigured GitHub Actions workflow gave the attackers access to push malicious code into 75 of 76 version tags. The payload ran inside CI/CD pipelines, silently collecting GitHub tokens, cloud credentials, SSH keys, Kubernetes tokens, database passwords, and crypto wallets from every pipeline that pulled the compromised version. CI/CD runners hold the keys to everything, so compromising the pipeline is effectively compromising every environment that pipeline touches.

   “What really has our attention going forward though is the CanisterWorm component. This is the first documented malware to use blockchain for command and control. Instead of traditional C2 servers that can be seized or sinkholed, the attackers are using Smart Contracts as a decentralized dead-drop. There’s no single server to take down, no domain to block. The operator can rotate payloads on-chain without ever touching an infected host. This is a fundamental shift in how attackers maintain persistence and control, and if this model proves out, it’s going to change how we think about disrupting campaigns.

   “Traditional takedown playbooks don’t work when the command infrastructure is immutable by design.”

Well, this illustrates how dangerous supply chain attacks are. Consider this a teachable moment for defenders in order to make sure their organizations are not affected by the next one.

Healthcare management services provider QualDerm is notifying more than 3.1 million people that their personal, medical, and health insurance information was stolen in a December 2025 data breach.

Brian Bell, CEO at FusionAuth had this to say: 

“Healthcare keeps struggling with identity because the industry has treated access management as a compliance exercise rather than a security architecture decision. The problem isn’t just that someone got in, it’s that once inside, there was nothing limiting what they could reach. Authorization controls, audit trails, isolated infrastructure; that’s what turns a catastrophic breach into a contained incident. Without it, you’re doing forensics on a disaster instead of preventing one.”

Chris Hauk, Consumer Privacy Champion at Pixel Privacy adds this:

“This is a concerning development for QualDerm patients, as the breach exposes quite a bit of personal, medical, and identification-related information, leaving them open to possible phishing and identity theft schemes. Affected patients should keep an eye out for phishing schemes using the gleaned info and should also immediately take advantage of the free identity theft and credit monitoring services offered by the company.”

Once again the heathcare sector gets pwned. The fact that this sector keeps getting pwned should be a wakeup call that something needs to be done to change the direction of travel. But sadly that does not seem to be happening.

Researchers have uncovered a new iOS devices exploit kit dubbed “DarkSword” used to steal data from potentially millions of iPhones running iOS 18.4 through 18.6.2. The attack is linked to the Russian hacking group UNC6353 which recently used the Coruna exploit chain reported by Google and iVerify. 

Brian Bell, CEO of customer identity and access management platform FusionAuth, provided the following comments:

“When a device can be silently compromised when visiting a website, perimeter-based and device-based security collapse. That’s not a future risk, it’s the current reality for anyone with a mobile user base.

The right response isn’t to wait for your users to patch. It’s to build authentication that assumes the device is already compromised. Short-lived tokens, step-up authentication before sensitive actions, forced re-authentication when signals change. Design for the breach, not against it.

And here’s the piece that most teams miss: most authentication platforms are SaaS; your token policies, session controls, and audit logs live in someone else’s cloud, under someone else’s access controls. But when authentication runs inside your own infrastructure, isolated from external dependencies, a compromised device doesn’t cascade into a compromised system. Identity is your last defense, so make sure you own it.”

If you are worried about this new exploit, the fix is simple. Which is to update to iOS 26 as that apparently is not affected. The most recent version of iOS 18 which at the time of this article is 18.7.3 is also not affected. But I would just go straight to iOS 26 as it is likely to protect you from more than this single exploit.