IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE22 IOCs

LiteLLM Compromised, Steals Credentials

WI
Wiz
Published October 21, 2026Original Report

Threat Actors

Malware Families

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYPlayINFRASTRUCTURE168.100.8.57litellm.dev165.227.201.8CAPABILITYMETA StealerPlayVICTIMunknown
Adversary(1)
Infrastructure(3)
Capability(2)
Victim

Indicators of Compromise

22 indicators

TypeIndicatorConfidenceScoreFirst Seen
SHA256bd1aeee419ea36da9aa2b657288da4101887be468f020ac63d22ba6ed84a3ea5MediumScore 53/100First seen
SHA256f75c8edae59b72b1ebfd617295833f465c85bb2fab9c1d60f21b496db86cb8daMediumScore 53/100First seen
SHA2567f191632e7320705d154b85204f1ae546b543acbd7e8861229b76f5042b92bdbMediumScore 54/100First seen
IP168.100.8.57HighScore 58/100First seen
SHA25612d4ccc5c6f8d35cf4f2cf233b7f3e418e863e657d81ff5f5fc9e210005b9484MediumScore 53/100First seen
SHA256c2e32d0ce2548aa662c18bf5001911a79fe5b30cf8357132275add02fdcde054MediumScore 53/100First seen
SHA25603ac2a8b752605d1d7710979c17ff18b03dd978203ba23ba97fd8ce3d6f897eaMediumScore 53/100First seen
SHA25624581ddc30767f16ecb69d2b0517556f2cd7dea56971adb42a3d1beb97d69523MediumScore 53/100First seen
SHA2560aaf7ba346d41ef2f40390436738b001180d5a1c03aa093f121078a9969d9a1aMediumScore 53/100First seen
SHA2561bbce8caa94f01c0aaa0b7ddae51553a8a32e1ce53d96d44fe583272aff7ad00MediumScore 53/100First seen
Domainlitellm.devHighScore 58/100First seen
IP165.227.201.8HighScore 58/100First seen
SHA256668169d35b87bf51324080390b1b1c5ab12bd335cfe5f1a99e3689abd5e02ae6MediumScore 53/100First seen
SHA256827dd893c74cf621a860a66a3a447a5c732533f087589ce905573e285c0a239cMediumScore 53/100First seen
SHA2569dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25HighScore 56/100First seen
SHA25684dc8c82c0a4a4a62552ef826b49fcc86d1a5c4a5d0f2c06665723f93d129d7dMediumScore 53/100First seen
SHA25656b74573eed6e4aafe4b50603dbe7853e0345f188c8e44a09f1098caf1f4bcdfMediumScore 53/100First seen
SHA256645a67d810628252d63df85dcc8824c58bcc77cf8383f4d3e6321f0ccc3ce9e4MediumScore 53/100First seen
SHA25634bef04fe88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5968305faHighScore 56/100First seen
SHA256b6122440d0d9cb1eb1ade9933f49214da8c31288de7710c076c2680dfa528465MediumScore 53/100First seen
SHA2567598727f209d717041db37f7dca271d3a7d328a279890e0e1d55375729aeb86dHighScore 56/100First seen
SHA256462d0c9f67ca522d9e0e4acd245e90b36ce0d5353604a66bb7c43a1ec4a6fcf7MediumScore 53/100First seen

IOC Relationship Graph

22 total IOCs
SHA256IPDomain
SHA25610IP2Domain1Actors1Malware2LiteLLM Compromised, Steals CredentialsREPORTbd1aeee419ea36da9aa2…f75c8edae59b72b1ebfd…7f191632e7320705d154…12d4ccc5c6f8d35cf4f2…c2e32d0ce2548aa662c1…03ac2a8b752605d1d771…24581ddc30767f16ecb6…0aaf7ba346d41ef2f403…1bbce8caa94f01c0aaa0…668169d35b87bf513240…168.100.8.57165.227.201.8litellm.devPlayMETA StealerPlay
scroll to zoom · drag to pan · click IOC to open