Skip to content
NewA calmer, faster ZeroHour
RansomwarecriticalExploited in the wild

Great responsibility, without great power

Cisco Talos ()6 min read2
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-42208
SQL Injection in BerriAI LiteLLM Proxy Exploited in the Wild
9.389%KEVPoC
KEV

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
md52915b3f8b703eb744fc54c81f4a9c67fd393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Talos Rep: https://talosintelligence.com/talos_file_reputat
md541444d7018601b599beac0c60ed1bf83dceaef0abb8296f3b0bf6114b25e10e6fa1bb8050aeecec4ba8f55 MD5: 41444d7018601b599beac0c60ed1bf83 Talos Rep: https://talosintelligence.com/talos_file_reputat
md57bdbd180c081fa63ca94f9c22c45737683227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91 MD5: 7bdbd180c081fa63ca94f9c22c457376 Talos Rep: https://talosintelligence.com/talos_file_reputat
md5aac3165ece2959f39ff98334618d10d9670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974 MD5: aac3165ece2959f39ff98334618d10d9 Talos Rep: https://talosintelligence.com/talos_file_reputat
md5c2efb2dcacba6d3ccc175b6ce1b7ed0ae6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59 MD5: c2efb2dcacba6d3ccc175b6ce1b7ed0a Talos Rep: https://talosintelligence.com/talos_file_reputat
md5dbd8dbecaa80795c135137d69921fdba05ee27ee09ea64ed8eb46d8edc92ee37f039dbc3e2bb9f587a33ba MD5: dbd8dbecaa80795c135137d69921fdba Talos Rep: https://talosintelligence.com/talos_file_reputat
sha25638d053135ddceaef0abb8296f3b0bf6114b25e10e6fa1bb8050aeecec4ba8f55APQ9305.dll Detection Name: Auto.90B145.282358.in02 SHA256: 38d053135ddceaef0abb8296f3b0bf6114b25e10e6fa1bb8050aeecec4ba8f55 MD5: 41444d7018601b599beac0c60ed1bf83 Talos Rep: https://ta
sha25690b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59_Exe.exe Detection Name: W32.Injector:Gen.21ie.1201 SHA256: 90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59 MD5: c2efb2dcacba6d3ccc175b6ce1b7ed0a Talos Rep: https://ta
sha25696fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974VID001.exe Detection Name: Win.Worm.Coinminer::1201 SHA256: 96fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974 MD5: aac3165ece2959f39ff98334618d10d9 Talos Rep: https://ta
sha2569f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507lware files from Talos telemetry over the past week SHA256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Talos Rep: https://ta
sha256a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91content.js Detection Name: W32.38D053135D-95.SBX.TG SHA256: a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91 MD5: 7bdbd180c081fa63ca94f9c22c457376 Talos Rep: https://ta
sha256e60ab99da105ee27ee09ea64ed8eb46d8edc92ee37f039dbc3e2bb9f587a33ba.exe Detection Name: Win.Dropper.Miner::95.sbx.tg** SHA256: e60ab99da105ee27ee09ea64ed8eb46d8edc92ee37f039dbc3e2bb9f587a33ba MD5: dbd8dbecaa80795c135137d69921fdba Talos Rep: https://ta

From the original article

6 min read at blog.talosintelligence.com

Welcome to this week’s edition of the Threat Source newsletter. As I’m writing this, today (April 28) is International Superhero Day. If you don’t know the origin story behind this, perhaps you would assume that this day was dreamed up by Marvel.

Cisco Talos

blog.talosintelligence.com

Read the full article at Cisco Talos

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.