From RuntimeWire · RuntimeWire · · 40s
Wiz Finds AWS Credentials Used to Test Amazon Bedrock
Security firm Wiz reports stolen AWS credentials from LiteLLM attack were used to probe Amazon Bedrock within hours.
In brief
Security firm Wiz reports stolen AWS credentials from LiteLLM attack were used to probe Amazon Bedrock within hours. Wiz says credentials stolen via compromised LiteLLM were tested against Amazon Bedrock within hours of theft. Originally reported by RuntimeWire.
Wiz security update
Wiz reports credentials stolen through compromised LiteLLM were tested against Amazon Bedrock within hours.
“harvested from compromised CI runners and Kubernetes nodes across multiple environments”
Attack timeline
Between 11:20 a.m. and 12:01 p.m. CDT on Oct. 21st, an attacker validated AWS instance-role credentials.
Attack action
The attacker called Amazon Bedrock's model-listing APIs using harvested credentials.
The takeaway
Wiz says credentials stolen via compromised LiteLLM were tested against Amazon Bedrock within hours of theft.
