Back to Intelligence

k0t Edge Credential Harvesting + LiteLLM Supply Chain Infostealer Wave: OTX Pulse Analysis — Enterprise Detection Pack

SA
Security Arsenal Team
October 22, 2026
10 min read

Five concurrent pulses published to AlienVault OTX on 2026-10-22 paint a coherent picture: credential theft is the dominant adversary objective this cycle, and attackers are achieving it through three distinct, converging vectors.

Vector 1 — Edge device exploitation (k0t / AdaptixC2). Group-IB and NyxLab attributed a large-scale campaign to threat actor k0t, an initial access broker exploiting FortiGate, FortiWeb (CVE-2025-64446), and Palo Alto GlobalProtect (CVE-2026-0257) appliances. The actor brute-forces edge services with custom tooling, plants AdaptixC2 beacons, and uses MeshCentral (meshcentral.girydsfsggvb.com) for legitimate-tool remote access persistence. Over 70,000 exposed credentials were recovered — these are already circulating in criminal markets and will be resold to ransomware affiliates. The presence of CVE-2021-42278/42287 (AD sAMAccountName spoofing/Kerberos) and CVE-2019-6693 (FortiGate config decryption) indicators shows the pivot path: edge access → credential dump → domain escalation.

Vector 2 — Supply chain infostealer (LiteLLM / privcollect). On 2026-10-21, attackers used stolen GitHub CLI OAuth tokens from three engineers to publish malicious LiteLLM 1.107.0 (≈23M weekly downloads) to PyPI and official Docker images for roughly two hours. The payload — tracked by Socket as privcollect — abuses Python startup files (sitecustomize/.pth-style auto-execution) to harvest cloud credentials (AWS/Azure/GCP), SSH private keys, browser stores, and AI-tooling auth tokens, beaconing to litellm.dev infrastructure. Socket's scanner caught it in seven minutes; most enterprises were not so lucky. Any developer machine, CI runner, or container that initialized LiteLLM 1.107.0 in the exposure window must be treated as credential-compromised.

Vector 3 — ClickFix social engineering (Doina → Lumma/NetSupport). A sponsored Google result for "amazon business" redirected victims to a spoofed Amazon login page on Google Sites. A fake CAPTCHA (ClickFix) coerced users into running a malicious command via Windows' obsolete finger.exe LOLBin, launching a chain that delivers Doina loader, Lumma Stealer, and NetSupport RAT.

Vector 4 — Mass WordPress/CMS exploitation (Red Heron). A UTC+8, suspected Chinese-speaking actor linked to Red Heron ran May–September 2026 exploitation of WordPress, ZyXEL, and enterprise platforms, exfiltrating 18,000+ government records — including via CVE-2022-0847 (Dirty Pipe) for privilege escalation.

Collective objective: bulk credential and identity-material acquisition — edge device creds, cloud/AI tokens, browser/session data, and government records — feeding initial-access markets and downstream espionage. Assume harvested credentials are already for sale or in use.

Threat Actor / Malware Profile

k0t (Initial Access Broker) — AdaptixC2

  • Distribution: Exploitation of internet-facing FortiGate/FortiWeb/Palo Alto GlobalProtect; custom brute-force tooling against VPN portals.
  • Payload behavior: AdaptixC2 beacon deployment post-exploitation; credential extraction from device configs and memory; staging for resale to ransomware operators.
  • C2: AdaptixC2 teamserver infrastructure (62.60.131.43, 193.149.187.81); TLS beacons with configurable malleable profiles.
  • Persistence: Rogue accounts on edge devices, MeshCentral agent (legitimate RMM) at meshcentral.girydsfsggvb.com — blending into admin traffic.
  • Anti-analysis: Living-off-the-land via RMM tooling; exploitation of deserialization/auth-bypass CVEs requiring no dropped malware on the appliance itself.

privcollect (LiteLLM supply chain payload)

  • Distribution: Trojanized PyPI wheel and Docker Hub images (litellm==1.107.0), two-hour exposure window.
  • Payload behavior: Python startup hooks execute on interpreter initialization — no user import required. Scrapes ~/.aws/credentials, ~/.azure, ~/.config/gcloud, ~/.ssh, browser Login Data/Cookies, and LLM API keys (OpenAI, Anthropic, etc.) from environment and dotfiles.
  • C2: HTTPS exfil to litellm.dev (including a /healthcheck lure endpoint).
  • Persistence: Startup-file implant survives until package downgrade; container images remain poisoned if pinned.
  • Anti-analysis: Malicious code gated behind Python-init execution to evade static package scanning; short publication window limits sample collection.

Doina → Lumma Stealer / NetSupport

  • Distribution: Malvertising (sponsored Google result) → spoofed Amazon page on Google Sites → ClickFix fake CAPTCHA.
  • Payload behavior: User is tricked into pasting a command that abuses finger.exe to retrieve staged payloads; Doina loader pulls Lumma Stealer (browser creds, crypto wallets, cookies, 2FA tokens) and NetSupport Client for hands-on access.
  • C2: Rotating consumer-brand domains (grillmasterchef.com, grillrecipespro.com, ashevilleroofingcontractor.com) over 167.148.201.106.
  • Persistence: NetSupport RAT service/Run key installation; Lumma exfiltrates and typically does not persist.
  • Anti-analysis: ClickFix shifts execution to the user (bypassing email/web gateways); finger.exe is a signed Microsoft binary that many allowlists ignore.

Red Heron (WordPress/CMS exploitation)

  • Distribution: Mass scanning/exploitation from a single static IP (104.225.153.141) against WordPress plugins/themes, ZyXEL switches, and enterprise platforms; CVE-2026-34908/34909/34910, CVE-2026-60137, CVE-2026-63030, CVE-2026-7273, CVE-2022-0847.
  • Persistence: Webshells on compromised CMS hosts; cron/systemd implants post-Dirty Pipe escalation.

IOC Analysis

Indicator composition across the five pulses:

  • CVEs (most numerous): Treat as exposure indicators, not blocklist entries. Operationalize by cross-referencing your asset inventory: FortiWeb CVE-2025-64446, GlobalProtect CVE-2026-0257, FortiGate CVE-2019-6693, AD CVE-2021-42278/42287, Linux CVE-2022-0847, and the WordPress CVE cluster. Any internet-facing match = emergency patch + retro-hunt.
  • IPv4 (C2 / attacker infrastructure): 62.60.131.43, 193.149.187.81 (AdaptixC2/MeshCentral staging), 167.148.201.106 (Lumma chain), 104.225.153.141 (Red Heron scanner). Push to firewall/proxy/EDR network blocklists with 90-day TTL; hunt retroactively 180 days for the Red Heron IP given the May–Sept campaign window.
  • Domains/hostnames: litellm.dev (including the healthcheck URL), meshcentral.girydsfsggvb.com, grillmasterchef.com, grillrecipespro.com, ashevilleroofingcontractor.com. DNS-sinkhole and alert on any resolution — the MeshCentral hostname is especially high-fidelity since legitimate MeshCentral would use your own domain.
  • File hashes (SHA256/MD5/SHA1): LiteLLM malicious wheel artifacts and Lumma/Doina payloads. Load into EDR blocklists and run retroactive file-creation hunts. For LiteLLM, hashes are per-build — also hunt by package version rather than hash alone.

Tooling: Decode/detotate URLs with CyberChef; pivot on IPs/ASNs via GreyNoise (104.225.153.141 is documented GreyNoise-sourced) and AbuseIPDB; detonate hashes in ANY.RUN/Hybrid Analysis; query all indicators in bulk via the OTX DirectConnect API or MISP sync. Feed everything into your TI platform with pulse-level tagging for attribution tracking.

Detection Engineering

YAML
---
title: ClickFix Finger.exe LOLBin Payload Retrieval
id: 3f7a1c2e-9b4d-4e1a-a5c8-2d6f0e9b1a11
status: experimental
description: Detects abuse of Windows finger.exe as a living-off-the-land download cradle, as seen in the Amazon-themed ClickFix campaign delivering Doina loader and Lumma Stealer.
author: Security Arsenal
references:
    - https://www.huntress.com/blog/amazon-clickfix-finger
date: 2026/10/22
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\finger.exe'
    selection_args:
        CommandLine|contains:
            - '@'
            - '|'
            - 'http'
            - 'cmd'
            - 'powershell'
    filter_legit:
        CommandLine|contains: 'finger.exe -l'
    condition: selection_img and selection_args and not filter_legit
falsepositives:
    - Legacy network diagnostics (extremely rare on modern endpoints)
level: high
tags:
    - attack.defense_evasion
    - attack.t1218
    - attack.t1105
---
title: AdaptixC2 or Rogue MeshCentral RMM Network Beacon
id: 8a2d4f61-7c3b-4d92-b1e6-5f0a3c8d2e44
status: experimental
description: Detects outbound connections to known k0t AdaptixC2 teamservers and the rogue MeshCentral instance used for persistent access after FortiGate/FortiWeb/GlobalProtect compromise.
author: Security Arsenal
references:
    - https://www.group-ib.com/blog/stray-cat-network-edge/
date: 2026/10/22
logsource:
    category: network_connection
    product: windows
detection:
    selection_ip:
        DestinationIp:
            - '62.60.131.43'
            - '193.149.187.81'
            - '167.148.201.106'
            - '104.225.153.141'
    selection_dns:
        DestinationHostname|contains:
            - 'meshcentral.girydsfsggvb.com'
            - 'litellm.dev'
            - 'grillmasterchef.com'
            - 'grillrecipespro.com'
            - 'ashevilleroofingcontractor.com'
    condition: 1 of selection_*
falsepositives:
    - Unlikely; these are high-fidelity campaign indicators
level: critical
tags:
    - attack.command_and_control
    - attack.t1071
    - attack.t1219
---
title: Trojanized LiteLLM privcollect Credential Access
id: c41e9a07-2b8f-4d63-9a1c-6e5d8f0b3a77
status: experimental
description: Detects Python interpreter processes accessing cloud credential stores, SSH keys, or browser credential databases consistent with the privcollect payload in compromised LiteLLM 1.107.0.
author: Security Arsenal
references:
    - https://socket.dev/blog/litellm-compromise
    - https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-docker
date: 2026/10/22
logsource:
    category: file_event
    product: windows
detection:
    selection_proc:
        Image|endswith:
            - '\python.exe'
            - '\pythonw.exe'
            - '\python3.exe'
    selection_target:
        TargetFilename|contains:
            - '\.aws\credentials'
            - '\.ssh\id_'
            - '\.azure\'
            - '\gcloud\credentials'
            - 'Login Data'
            - '\Cookies'
            - 'Web Data'
    condition: selection_proc and selection_target
falsepositives:
    - Legitimate cloud SDK developer workflows; baseline by developer host groups and investigate outliers
level: high
tags:
    - attack.credential_access
    - attack.t1552
    - attack.t1555
KQL — Microsoft Sentinel / Defender
// Hunt: LiteLLM supply-chain compromise artifacts + k0t/ClickFix C2 beacons (last 14 days)
let C2Ips = dynamic(["62.60.131.43", "193.149.187.81", "167.148.201.106", "104.225.153.141"]);
let C2Domains = dynamic(["litellm.dev", "meshcentral.girydsfsggvb.com", "grillmasterchef.com", "grillrecipespro.com", "ashevilleroofingcontractor.com"]);
let NetworkHits = DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteIP in (C2Ips) or RemoteUrl has_any (C2Domains)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, ActionType;
let FingerAbuse = DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where FileName =~ "finger.exe"
    | where ProcessCommandLine has_any ("@", "http", "|", "cmd", "powershell")
    | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName;
let CredAccess = DeviceFileEvents
    | where TimeGenerated > ago(14d)
    | where InitiatingProcessFileName startswith "python"
    | where FolderPath has_any (".aws\\credentials", ".ssh\\id_", "Login Data", "\\Cookies", "Web Data", ".azure", "gcloud")
    | project TimeGenerated, DeviceName, InitiatingProcessCommandLine, FolderPath, SHA256;
union NetworkHits, FingerAbuse, CredAccess
| sort by TimeGenerated desc
PowerShell
# Security Arsenal - OTX Pulse IOC Hunt (2026-10-22)
# Checks: LiteLLM malicious version, MeshCentral rogue agent, NetSupport persistence,
#         Lumma artifacts, and connections to campaign C2 infrastructure.
$ErrorActionPreference = 'SilentlyContinue'
$findings = @()

# 1) LiteLLM 1.107.0 (privcollect) installed anywhere on the system
$pipPaths = @("$env:LOCALAPPDATA\Programs\Python", "C:\Python*", "$env:USERPROFILE\AppData\Roaming\Python")
foreach ($p in $pipPaths) {
    Get-ChildItem -Path $p -Recurse -Filter "litellm-1.107.0*" -Directory -ErrorAction SilentlyContinue | ForEach-Object {
        $findings += "[CRITICAL] Trojanized LiteLLM 1.107.0 found: $($_.FullName)"
    }
}
$pipShow = (pip show litellm 2>$null) | Select-String "Version: 1.107.0"
if ($pipShow) { $findings += "[CRITICAL] Active pip environment has litellm==1.107.0 - rotate ALL credentials on this host" }

# 2) Rogue MeshCentral agent / unexpected RMM persistence
Get-Service | Where-Object { $_.Name -match 'mesh|netsupport|client32' } | ForEach-Object {
    $findings += "[HIGH] Suspicious RMM service: $($_.Name) - $($_.DisplayName)"
}
$runKeys = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
foreach ($rk in $runKeys) {
    (Get-ItemProperty $rk).PSObject.Properties | Where-Object { $_.Value -match 'meshagent|netsupport|client32|finger' } | ForEach-Object {
        $findings += "[HIGH] Persistence Run key: $rk -> $($_.Name) = $($_.Value)"
    }
}

# 3) Scheduled tasks referencing campaign LOLBin/payload names
Get-ScheduledTask | Where-Object { $_.TaskName -match 'mesh|finger|doina|lumma|update.*amazon' } | ForEach-Object {
    $findings += "[HIGH] Suspicious scheduled task: $($_.TaskName)"
}

# 4) Live/recent connections to campaign C2
$c2 = @('62.60.131.43','193.149.187.81','167.148.201.106','104.225.153.141')
Get-NetTCPConnection | Where-Object { $c2 -contains $_.RemoteAddress } | ForEach-Object {
    $proc = (Get-Process -Id $_.OwningProcess).ProcessName
    $findings += "[CRITICAL] Active C2 connection: $($_.RemoteAddress):$($_.RemotePort) by $proc (PID $($_.OwningProcess))"
}

# 5) DNS cache evidence of campaign domains
Get-DnsClientCache | Where-Object { $_.Entry -match 'litellm\.dev|girydsfsggvb\.com|grillmasterchef|grillrecipespro|ashevilleroofingcontractor' } | ForEach-Object {
    $findings += "[HIGH] DNS cache hit for campaign domain: $($_.Entry)"
}

if ($findings.Count -eq 0) { Write-Output "[CLEAN] No indicators from 2026-10-22 OTX pulses detected on $env:COMPUTERNAME" }
else { $findings | Sort-Object | ForEach-Object { Write-Output $_ } }

Response Priorities

Immediate (0–4 hours):

  • Block all campaign IPs, domains, and file hashes at firewall, proxy, DNS, and EDR; sinkhole litellm.dev and meshcentral.girydsfsggvb.com.
  • Inventory and isolate any host with litellm==1.107.0 installed (including CI runners, Docker builds, and developer laptops). Query your artifact registry and image scanner for poisoned container layers built on 2026-10-21.
  • Hunt for finger.exe execution and Run-key/service persistence per the detections above.
  • Audit edge devices (FortiGate/FortiWeb/GlobalProtect) for rogue admin accounts, unexpected MeshCentral agents, and config changes; if unpatched against CVE-2025-64446 or CVE-2026-0257 and internet-exposed, assume breach.

24 hours:

  • Rotate every credential that touched a LiteLLM 1.107.0 host: cloud IAM keys, SSH keys, LLM provider API tokens, browser-saved passwords, and session cookies. Revoke active sessions, not just passwords.
  • Force password resets for any VPN/edge-device accounts; k0t's 70,000-credential haul means your org's VPN creds may already be for sale — check dark web credential markets and haveibeenpwned-style feeds for your domains.
  • Enable/enforce phishing-resistant MFA (FIDO2) on VPN, cloud consoles, and GitHub; the LiteLLM compromise began with stolen OAuth tokens — review GitHub audit logs for anomalous gh CLI token use and workflow dispatch events against forks.
  • Review WordPress/CMS estates for webshells and unpatched plugins given the Red Heron campaign; check for connections to 104.225.153.141 going back to May 2026.

1 week:

  • Remove or restrict LOLBins: block finger.exe via WDAC/AppLocker; it has no legitimate role on modern endpoints.
  • Harden the software supply chain: pin dependencies by hash, require Sigstore/provenance verification, gate PyPI/Docker pulls through an internal proxy with malware scanning, and alert on newly published package versions before broad deployment.
  • Segment edge management interfaces off the internet; deploy device-posture checks on VPN login so stolen credentials alone are insufficient.
  • Add ClickFix-style user simulation to security awareness training — teach users that no legitimate CAPTCHA ever asks them to press Win+R and paste a command.
  • Subscribe your TI platform to the OTX pulses referenced here and operationalize continuous IOC sync with automated TTL-based expiry.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

darkwebotx-pulsedarkweb-credentialscredential-harvestingsupply-chain-attacklumma-stealeradaptixc2edge-device-exploitation

Is your security operations ready?

Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.

Book a SOC AssessmentSee AlertMonitor in Action