Attackers breach LiteLLM, RAGFlow, Kestra gateways for credential theft
Attackers are treating AI middleware as a credential control plane while defenders still treat it as experimental infrastructure.
TL;DR
Microsoft's threat research team observed three distinct compromise campaigns targeting AI infrastructure, a LiteLLM gateway, a RAGFlow deployment, and a Kestra orchestration environment. In each case, attackers harvested API keys, database connection strings, and virtual-key records, then established persistence and deployed cryptocurrency miners. The common thread: AI middleware concentrates credentials at a level most organizations haven't secured, and attackers have noticed. None of the intrusions involved prompt injection or model poisoning, these were straightforward infrastructure compromises aimed at the control plane where trust aggregates.
Microsoft's threat research team has observed something that should make every organization running AI infrastructure pause: three distinct compromise campaigns, targeting three different AI platforms, all pursuing the same objectives. The targets were a LiteLLM gateway, a RAGFlow retrieval-augmented generation deployment, and a Kestra workflow orchestration environment. In each case, attackers sought credentials (model-provider API keys, database connection strings, virtual-key records, and tenant configuration) then established persistence and deployed cryptocurrency miners to monetize the compromised compute.
None of these were prompt-injection attacks. None were model-poisoning attempts. They were straightforward infrastructure compromises targeting the layer where AI applications concentrate trust.
A LiteLLM gateway sitting between applications and model providers holds API keys for every service it routes to. A RAGFlow instance processing tenant credential configurations is a single collection point for every downstream credential passing through it. Attackers have figured this out. Organizations often haven't, AI middleware tends to be treated as experimental infrastructure, stood up by a data science team, not hardened like a production database server. But the credential concentration in these systems often exceeds what a typical application server holds.
Microsoft's remediation guidance is practical: inventory exposed AI management surfaces and restrict administrative access while monitoring for gateway-originated execution and anomalous secret access. The harder problem is organizational. NIST's draft SP 800-239 on AI data center security, open for public comment through September 25, addresses the data-center level but doesn't close the middleware control-plane gap between infrastructure security and application security. Until organizations close that gap themselves, AI gateways will remain what attackers already treat them as: high-value targets hiding in plain sight.
Published ·Deep Fathom