Meta 暫停與 Mercor 合作因資料外洩

增強重點摘要

• •The breach originated from a supply chain attack on the open-source LiteLLM library, where threat actor TeamPCP injected a malicious backdoor into versions 1.82.7 and 1.82.8 to harvest credentials.
• •The hacking group Lapsus$ has claimed responsibility for exfiltrating 4TB of Mercor data, including source code, internal databases, Slack communications, and sensitive KYC/identity verification documents.
• •Mercor, a $10 billion valuation startup, serves as a critical infrastructure provider for AI labs by managing a network of over 30,000 expert contractors used for model evaluation and training.

技術深入

• •Attack Vector: Supply chain compromise of the LiteLLM Python library via unauthorized PyPI package publishing.
• •Malware Mechanism: Three-stage malicious backdoor designed for credential harvesting and establishing persistent system access.
• •Exfiltrated Data: Allegedly includes 939GB of source code, a 211GB user database, and 3TB of storage buckets containing video interviews and identity verification passports.
• •Infrastructure Impact: Attackers reportedly leveraged access to the company's Tailscale VPN to facilitate the large-scale data exfiltration.

前景展望基於引用來源的 AI 分析

時間線