ET MALWARE Observed LiteLLM Backdoor Domain (litellm .dev in TLS SNI)

7.0.35.0SID: 2072565Rev: 1Enabled2 views
Sourceet/open
Fileemerging-malware.rules
CreatedOctober 23, 2026
UpdatedOctober 23, 2026
Classificationdomain-c2
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Observed LiteLLM Backdoor Domain (litellm .dev in TLS SNI)"; reference:url,www.wiz.io/blog/litellm-compromised-steals-credentials; classtype:domain-c2; sid:2072565; rev:1; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2026_10_23, deployment Perimeter, performance_impact Low, confidence High, signature_severity Major, tag Backdoor, tag InfoStealer, updated_at 2026_10_23, mitre_tactic_id TA0037, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
Detection details are hidden.

References

urlwww.wiz.io/blog/litellm-compromised-steals-credentials

Metadata

affected productAny
attack targetClient_Endpoint
created at2026_10_23
deploymentPerimeter
performance impactLow
confidenceHigh
signature severityMajor
tagInfoStealer
updated at2026_10_23
mitre tactic idTA0037
mitre tactic nameCommand_And_Control
mitre technique idT1041
mitre technique nameExfiltration_Over_C2_Channel

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!