# Check Your CloudTrail for the LiteLLM Attacks

Two LiteLLM attacks stole credentials this year. CtrlB is a unified telemetry platform for observability and security. Connect your CloudTrail bucket and it checks every event back to March for signs the attacker used your keys. Free under 150 GB a month.

## Metadata

- **Canonical HTML**: https://ctrlb.ai/litellm-attack-detection
- **Last updated**: 2026-08-26

## Affected versions

| Date | Version | Exfiltration endpoint |
|------|---------|-----------------------|
| March 24 | litellm 1.82.7 and 1.82.8 | models.litellm.cloud |
| October 21 | litellm 1.107.0 | www.litellm.dev |

CtrlB keeps 365 days searchable by default, long enough to check both attacks.

## What the check looks for

1. **Calls from the attacker's addresses**: any call from `168.100.8.57` or `165.227.201.8`, the two addresses named in the October write-ups.
2. **Machine keys used outside your network**: AWS names an EC2 instance's keys after the instance ID. When the same key calls AWS from an address you don't own, it left that machine.
3. **The calls an attacker makes first**: `sts:GetCallerIdentity` to test the key, then listing calls such as `bedrock:ListFoundationModels` to see what it can reach.

## What you get back

- Each AWS key the attacker used, by access key ID (`userIdentity.accessKeyId`)
- The machine each key came from, by instance ID (`userIdentity.principalId`)
- Every call made with that key, the addresses it came from, and when (`eventName`, `sourceIPAddress`, `eventTime`)
- If nothing matches, the searches run and the dates they covered

## How the check runs

1. Give CtrlB read-only access (`s3:GetObject`, `s3:ListBucket`) to the S3 bucket your CloudTrail trail writes to.
2. CtrlB reads the log files (`*.json.gz`) and indexes them.
3. CtrlB runs the check across every month you have and sends you the results.

## What CloudTrail can't tell you

- **Use, not theft**: CloudTrail shows keys being used, not taken. If you ran an affected version, rotate your keys anyway.
- **AWS keys only**: model provider keys, GitHub tokens and SSH keys don't appear in CloudTrail.
- **90-day default**: without a trail in S3, AWS keeps 90 days of event history. That covers October, not March.

## Next steps

- [Check my CloudTrail](https://flow.ctrlb.ai/playground)
- [Talk to an engineer](https://ctrlb.ai/contact)