When AI Infrastructure Becomes the Target: Attacks Observed on LiteLLM, RAGFlow, and Kestra

When AI infrastructure becomes the target, such as LiteLLM, RAGFlow, and Kestra, attackers often compromise central control points. These points hold model keys, database credentials, and container permissions, enabling credential theft, persistence, and cryptomining. LiteLLM compromises occur via command execution through an exposed gateway, reading environment variables to gather keys and exfiltrate configurations.

Persistence is maintained through service accounts and hidden files. RAGFlow compromises involve an OAST callback that executes code within the same service context, altering startup routes and stealing API keys. Kestra compromises involve an authentication bypass vulnerability allowing a worker to spawn a shell and harvest cloud keys and API tokens.

Threat actors target AI management planes and APIs, often operating within application and worker contexts. Symptoms of compromise include shell and process execution, Docker socket access, and outbound traffic. Success leads to theft of keys, persistent access, and cryptomining. Logs indicate shell spawning, process execution, Docker socket enumeration, and XMRig deployment.