When AI infrastructure becomes the target: Securing gateways and control points

1. Executive summary

Microsoft Threat Intelligence reports active exploitation targeting three distinct AI infrastructure workloads: LiteLLM, RAGFlow, and Kestra. Attackers compromised these systems to steal credentials, establish persistence, and deploy cryptominers, treating AI infrastructure as a control plane. The campaign leveraged known vulnerabilities, including CVE-2026-42271 (CVSS 8.7 HIGH, in CISA KEV) and CVE-2026-49869 (CVSS 10.0 CRITICAL). EMEA financial services deploying AI gateways, retrieval platforms, or orchestration services are exposed to credential theft and downstream data access if these control points are internet-exposed.

2. Regulatory framing

3. Technical analysis & attack chain

Microsoft observed three distinct intrusion sets targeting AI infrastructure. No named threat actor is identified in the source material; attribution is unconfirmed. The campaign is single-sourced to Microsoft Threat Intelligence.

LiteLLM Gateway Compromise

Initial access: Assessed with high confidence as exploitation of the exposed LiteLLM gateway surface. The chain involves CVE-2026-42271 (CVSS 8.7 HIGH, in CISA KEV, CWE-77/CWE-78), an authenticated command-execution issue in LiteLLM MCP stdio test endpoints, chained with CVE-2026-48710 (CVSS 6.5 MEDIUM, not in CISA KEV, CWE-444/CWE-1289), a Starlette host-header validation bypass that weakens the authentication boundary, enabling unauthenticated remote code execution.

Attack chain

1. Credential harvesting: Payload read /proc/1/environ (gateway runs as PID 1 in containers), filtering for master, API key, token, password, and UI-related fields. Exfiltration used urllib, curl, and wget sequentially for fallback.
2. Payload delivery: Inline Python command retrieved a masqueraded ELF binary from attacker infrastructure, staged under a temporary path, marked executable, and launched with service-style arguments. Second path used a shell-stage downloader with randomized temp paths.
3. Host discovery: Silent passwordless-sudo check, listening-port inspection, process sweeps for miners and remote-access tooling.
4. Mining preparation: XMRig deployment with RandomX tuning. Loaded Linux MSR module with write access (modprobe msr allow_writes). Crontab rewrite removed competing miner entries.
5. Database access: Python one-liner parsed DATABASE_URL from PID 1 environment, connected to PostgreSQL (<name>.postgres.database.azure.com), dumped LiteLLM_ProxyModelTable and LiteLLM_VerificationToken records. Output base64-encoded and exfiltrated in chunks.
6. Persistence: SSH authorized_keys write under a service account, hidden-file relay execution, masqueraded systemd service names, chattr +i immutable flags on payload directories.

RAGFlow Compromise

Initial access: Assessed with high confidence as exploitation of the exposed RAGFlow application surface. Telemetry showed the RAGFlow server process retrieving an attacker-supplied URL via the application's HTTP client, producing an outbound Burp Collaborator callback. RCE followed days later. Microsoft assesses with low confidence the specific vulnerability. Public research describes CVE-2026-45312, CVE-2026-28797, CVE-2026-24770, and CVE-2025-68700 as plausible paths but does not attribute the intrusion to a specific CVE.

Attack chain

1. Discovery: Payload located the RAGFlow installation inside the container and identified the tenant LLM model-configuration path.
2. Hook installation: Created a hidden runtime hook under the application tree; modified application startup/import path (referenced as api/__init__.py) so the hook loads with the RAGFlow service.
3. Credential interception: Hook wrapped TenantLLM.insert() to capture provider type, model name, API key material, and endpoint metadata during credential setup. Exfiltrated via outbound HTTP; errors suppressed.
4. Persistence marker: Local marker written indicating installation completion. SSH key planted inside the container.

Kestra Compromise

Initial access: Assessed with high confidence as exploitation of CVE-2026-49869 (CVSS 10.0 CRITICAL, not in CISA KEV, CWE-78/CWE-184), an authentication-bypass vulnerability. Unauthenticated remote attacker bypasses login, defines a malicious workflow using the Process runner, and triggers worker-side shell execution.

Attack chain

1. Workflow-origin execution: Two closely timed workflow-origin shell sessions. First produced shell initialization; second performed Docker socket access, container-environment enumeration, miner deployment, and defence-evasion file operations.
2. Docker socket access: Queried container metadata and inspected Config.Env arrays across running containers, exposing environment-backed secrets from other containers.
3. Mining: XMRig v6.26.0 retrieved from a public release source, archive extracted, binary renamed, background execution. Mining-pool communication to auto.c3pool[.]org:443. RandomX MSR tuning observed.
4. Follow-on collection: curl-pipe-shell pattern retrieved remote script content directly into a shell. Output encoded and stored through Kestra's own key-value interface.
5. Defence evasion: Restrictive permissions and immutable-file attributes on temporary paths. nohup used for miner persistence.

4. Mitigation & containment

P1 — Within 24 hours

• Isolate exposed AI workloads: Move LiteLLM, RAGFlow, and Kestra instances behind VPN or zero-trust network access. Remove internet exposure for management surfaces immediately.
• Patch CVE-2026-42271 (LiteLLM, CVSS 8.7 HIGH, in CISA KEV): Update LiteLLM to a version that remediates the MCP stdio test endpoint command injection. If patching is not immediately possible, disable or restrict access to MCP stdio test endpoints.
• Patch CVE-2026-49869 (Kestra, CVSS 10.0 CRITICAL): Update Kestra to a version that remediates the authentication bypass. If patching is not possible, restrict network access to the Kestra orchestration surface.
• Block known C2 infrastructure: Egress-block all IOCs listed in §5 at firewall and proxy layers.
• Rotate credentials: If LiteLLM, RAGFlow, or Kestra deployments are or were exposed, rotate all model-provider API keys, LiteLLM master keys, virtual keys, and database connection strings.
• Hunt for persistence: Check service-account authorized_keys files for unauthorised entries. Inspect crontabs for miner-related entries. Search for chattr +i immutable flags on /tmp and payload paths.

P2 — Within 72 hours

• Patch CVE-2026-48710 (Starlette host-header validation bypass, CVSS 6.5 MEDIUM): Update Starlette to a version that fixes host-header validation. This prevents the authentication-boundary weakening that enables the unauthenticated RCE chain with CVE-2026-42271.
• Restrict Docker socket access: Ensure Kestra worker containers do not mount the Docker socket (/var/run/docker.sock) unless explicitly required. If required, apply read-only access or use socket-level authorization.
• Audit RAGFlow installations: Inspect api/__init__.py and the application tree for hidden hook files. Check for unauthorised SSH keys inside RAGFlow containers.
• Deploy EDR detection rules: Enable Linux endpoint detection for: child processes spawned by gateway/orchestration processes, /proc/1/environ access, modprobe msr allow_writes, chattr +i on temp directories, and curl-pipe-shell patterns.

P3 — Within 7 days

• Inventory AI management surfaces: Conduct a full inventory of all AI gateways, retrieval platforms, orchestration services, and containerized runtimes. Document credential concentration, execution privileges, and network exposure for each.
• Implement network segmentation: Place AI workloads on isolated network segments with strict egress filtering. Restrict outbound traffic to known model-provider endpoints and databases only.
• Review RAGFlow public CVEs: Assess CVE-2026-45312, CVE-2026-28797, CVE-2026-24770, CVE-2025-68700, and CVE-2025-69286 against deployed RAGFlow versions. Patch where applicable.
• Deploy KQL hunting queries: Deploy the Microsoft Defender XDR advanced hunting queries from the source blog post to detect gateway-originated execution, secret access, payload staging, MSR tuning, and persistence activity.

5. Indicators of compromise

ipv4  45.150.109[.]151
ipv4  135.125.10[.]56
ipv4  172.232.38[.]92
domain  45.150.109.151.sslip[.]io
domain  auto.c3pool[.]org
ipv6  2001:41d0:701:1100::adfd
ipv4  47.86.197[.]116
domain  yosemite[.]jp
domain  gobygo[.]net
domain  oast[.]me
domain  oast[.]pro
domain  oast[.]fun
ipv4  194.213.18[.]133
sha256  f64b88e9318bdf23f2dd119a0ce1dd1bdb3c8cd2e0e1e23ba3ef2e19072b79cc
sha256  49fdcf32bfe837899a84e8938f0d07ae96ddd218a280a09eb60df8d64597bd8f
sha256  3af9f25a4d45bb4f1ec5627cdbc6703cf3b4be75a892162d299d80ddfb266f42
sha256  3d24ac736635e0fa0c5c459c9e18ca09d1ec9a1751a4503130934395609bd7e0

6. Detection

rule LiteLLM_Gateway_Implant_Aug2026 {
    meta:
        author = "Adverse Trace"
        date = "2026-08-26"
        reference = "https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/"
        description = "Detects LiteLLM gateway compromise artifacts including bridge script paths and supervisord masquerading"
    strings:
        $bridge_standalone = "BRIDGE_STANDALONE" ascii
        $anon_bins = "/anonymus/bins_s" ascii
        $private_python = "/private/python3" ascii
        $supervisord_tmp = "/tmp/python3" ascii
        $env_filter_master = "master" ascii
        $env_filter_token = "token" ascii
        $env_filter_password = "password" ascii
        $proc_environ = "/proc/1/environ" ascii
        $db_url = "DATABASE_URL" ascii
        $litellm_table1 = "LiteLLM_ProxyModelTable" ascii
        $litellm_table2 = "LiteLLM_VerificationToken" ascii
        $psycopg2 = "psycopg2" ascii
    condition:
        3 of them
}

rule Kestra_XMRig_Miner_Aug2026 {
    meta:
        author = "Adverse Trace"
        date = "2026-08-26"
        reference = "https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/"
        description = "Detects XMRig miner artifacts observed in Kestra and LiteLLM compromises"
    strings:
        $c3pool = "auto.c3pool.org" ascii
        $xmrig_ver = "XMRig v6.26.0" ascii
        $modprobe_msr = "modprobe msr allow_writes" ascii
        $randomx = "RandomX" ascii
    condition:
        2 of them
}

title: AI Gateway Process Spawning Shell or Interpreter
id: AT-2026-08-26-655-001
status: experimental
description: Detects AI gateway or orchestration processes (LiteLLM, RAGFlow, Kestra) spawning shell, Python, or download utilities — high-signal indicator of gateway-origin compromise
author: Adverse Trace
date: 2026/08/26
references:

    - https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/
logsource:
    product: linux
    category: process_creation
detection:
    selection_parent:
        ParentCommandLine|contains:

            - "litellm"
            - "litellm-proxy"
            - "litellm_proxy"
            - "ragflow"
            - "kestra"
    selection_child:
        Image|endswith:

            - "/bash"
            - "/sh"
            - "/dash"
            - "/curl"
            - "/wget"
            - "/python"
            - "/python3"
    filter_legitimate:
        CommandLine|contains:

            - "pip install"
            - "npm install"
    condition: selection_parent and selection_child and not filter_legitimate
falsepositives:

    - Legitimate gateway maintenance or deployment scripts
    - Application startup sequences that invoke shell wrappers
level: high

---
title: Access to PID 1 Environment in Container
id: AT-2026-08-26-655-002
status: experimental
description: Detects processes accessing /proc/1/environ, a high-signal credential harvesting behavior in containerized AI workloads where the service runs as PID 1
author: Adverse Trace
date: 2026/08/26
references:

    - https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/
logsource:
    product: linux
    category: process_creation
detection:
    selection_target:
        CommandLine|contains:

            - "/proc/1/environ"
    selection_tool:
        Image|endswith:

            - "/cat"
            - "/bash"
            - "/sh"
            - "/python"
            - "/python3"
            - "/grep"
    condition: selection_target and selection_tool
falsepositives:

    - Container debugging or forensics activity
    - Legitimate configuration validation scripts
level: critical

---
title: MSR Module Load with Write Access for RandomX Tuning
id: AT-2026-08-26-655-003
status: experimental
description: Detects loading the Linux MSR kernel module with write access enabled, strongly associated with RandomX/XMRig CPU mining optimization
author: Adverse Trace
date: 2026/08/26
references:

    - https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        CommandLine|contains|all:

            - "modprobe"
            - "msr"
            - "allow_writes"
    condition: selection
falsepositives:

    - Legitimate low-level performance testing or benchmarking
level: high

---
title: Persistence via SSH Authorized Keys Modification
id: AT-2026-08-26-655-004
status: experimental
description: Detects writes to SSH authorized_keys files, used for durable access in LiteLLM and RAGFlow compromises
author: Adverse Trace
date: 2026/08/26
references:

    - https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        CommandLine|contains:

            - "authorized_keys"
        CommandLine|contains:

            - ">>"
    condition: selection
falsepositives:

    - Legitimate SSH key deployment automation
level: high

---
title: Immutable Flag Set on Payload Directories
id: AT-2026-08-26-655-005
status: experimental
description: Detects use of chattr +i to set immutable flags on files or directories, used for defence evasion to resist cleanup
author: Adverse Trace
date: 2026/08/26
references:

    - https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        CommandLine|contains:

            - "chattr"
    selection_flag:
        CommandLine|contains:

            - "+i"
    condition: selection and selection_flag
falsepositives:

    - Legitimate file protection on critical system files
level: medium

CVE assessment

3 referenced CVEs — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

7. Sources

• Microsoft Security Blog, "When AI infrastructure becomes the target: Securing gateways and control points," https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/, 2026-08-26

8. Adverse Trace position

This advisory describes a significant campaign targeting AI infrastructure control points with confirmed exploitation of CVE-2026-42271 (CVSS 8.7 HIGH, in CISA KEV) and CVE-2026-49869 (CVSS 10.0 CRITICAL). The attack patterns are technically detailed and represent a credible threat to EMEA financial services running AI gateways, retrieval platforms, or workflow orchestration in production. The credential concentration in these workloads — model-provider keys, database connection strings, virtual keys — creates blast radius beyond a standard application compromise. Attribution is unconfirmed; the campaign is single-sourced to Microsoft Threat Intelligence — verify before enforcement. We are prioritising client outreach to identify exposed AI workloads, deploying the detection rules in §6 to client SIEMs, and monitoring for the IOCs in §5 across monitored environments. Clients running LiteLLM, RAGFlow, or Kestra with internet-exposed management surfaces should treat this as an active incident and execute P1 actions immediately.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.