AI infrastructure as the new control plane: Microsoft confirms three separate intrusions against a LiteLLM gateway, a RAGFlow deployment and a Kestra orchestration environment, converging on credential theft and persistence, with compute monetisation in two of the three

AI gateways, retrieval platforms and workflow orchestrators have become a new layer of enterprise infrastructure sitting between users, applications, data and models, and that position concentrates credentials, data access and execution privilege in one runtime. Microsoft Threat Intelligence confirms three separate real-world intrusions exploiting exactly that concentration: a LiteLLM gateway, a RAGFlow retrieval-augmented-generation deployment, and a Kestra workflow orchestration environment. The initial-access paths differed by product, and credential theft and durable persistence recur across all three, but resource monetisation was specific to two of them: Microsoft states the LiteLLM and Kestra objectives each included compute monetisation, while the RAGFlow intrusion's objective was narrower, intercepting newly configured LLM provider credentials and model metadata, with no miner deployment observed (Microsoft Threat Intelligence, 2026-08-26). The June 2026 disclosure of the LiteLLM chain itself is already tracked in this store; what is new here is confirmation that the chain reached real production environments, alongside two further distinct AI-workload intrusions with no vulnerability overlap.

Case 1: LiteLLM gateway, credential harvesting to database exfiltration to cryptomining

Microsoft assesses with high confidence that initial access exploited the exposed LiteLLM gateway surface via CVE-2026-42271 (CVSS 8.7, affecting LiteLLM >= 1.74.2 and < 1.83.7, fixed in 1.83.7, BerriAI GHSA-v4p8-mg3p-g94g), a command-execution flaw in LiteLLM's MCP stdio test endpoints, chained with CVE-2026-48710 (CVSS 6.5, affecting Starlette <= 1.0.0, fixed in 1.0.1, Starlette GHSA-86qp-5c8j-p5mr), a host-header validation bypass that can strip the authentication requirement in vulnerable configurations, the combination yields unauthenticated remote code execution in the gateway process itself. From that foothold, the observed chain ran six stages. First, the payload read /proc/1/environ (the environment block of the gateway's PID-1 process in its container) filtering for provider API keys, the LiteLLM master key, database connection strings and other credential-shaped values, and exfiltrated them using whichever of Python's urllib, curl or wget was available. Second, a masqueraded ELF binary was retrieved and launched with Linux-service-style arguments; a parallel shell-based delivery path provided redundancy. Third, the payload fingerprinted the host, checked for passwordless sudo, and swept for competing miners or remote-access tooling. Fourth, it loaded the Linux MSR kernel module with write access (RandomX/XMRig CPU-tuning behaviour) and rewrote crontab entries to remove rival miners before installing its own. Fifth, using the harvested DATABASE_URL, it connected directly to the LiteLLM-backed Azure Database for PostgreSQL instance and dumped the LiteLLM_ProxyModelTable and LiteLLM_VerificationToken tables (model configuration, upstream provider keys and proxy-issued virtual keys) base64-encoding and exfiltrating the output in chunks to an out-of-band endpoint. Sixth, it established durable access via an SSH key written to a service account, immutable-flag protection on its payload directories, and periodic callbacks confirming continued execution.

Case 2: RAGFlow, a persistent hook inside the application itself

Microsoft assesses with high confidence that the RAGFlow intrusion also began with exploitation of the exposed application surface, but states explicitly it has only low confidence in which specific vulnerability enabled the resulting code execution; telemetry could not isolate the precise execution sink from inside the RAGFlow Flask service process. Several publicly documented RAGFlow vulnerabilities provide plausible technical context without being confirmed as the cause. What followed exploitation was distinctive: the payload located the RAGFlow install from inside the container, identified the tenant LLM configuration code path, and modified the application's own startup/import sequence so a hidden hook would load every time the service started, persistence implemented as a backdoored application component rather than a separate process, surviving container restarts as long as the modified filesystem state remains. The hook then wrapped the tenant LLM configuration flow itself, capturing provider type, model name, API key material and endpoint metadata every time a user configured a new LLM connection from that point forward, and exfiltrated it over outbound HTTP with errors suppressed so the application kept functioning normally. Unlike the LiteLLM case, Microsoft observed no miner deployment or interactive shell here; the objective was narrowly future-credential interception.

Case 3: Kestra, workflow execution as the shell-access primitive

Microsoft assesses with high confidence that the Kestra intrusion exploited CVE-2026-49869 (CVSS 10.0 Critical, affecting Kestra prior to 1.0.45 and 1.3.21, fixed in those releases, Kestra GHSA-5vc5-wxxq-3fjx via the CVE Program), a pre-authentication bypass that lets an unauthenticated, network-reachable attacker skip the login mechanism entirely, define a malicious workflow using Kestra's Process runner, and trigger shell-script execution on a worker node. Two closely timed workflow-origin shell sessions followed: the first performed shell initialisation, the second executed the main follow-on actions. Because the worker had access to the mounted Docker socket, the attacker queried container metadata and enumerated the Config.Env arrays of every other container reachable through that socket, a single compromised orchestration worker exposing the environment-embedded cloud keys, database passwords and API tokens of unrelated containers on the same host. A cryptominer (XMRig, RandomX-tuned) was then deployed, and a later workflow-origin event retrieved and executed a remote script via a curl-pipe-shell pattern with no file ever written to disk, storing its output through Kestra's own key-value interface rather than a standalone file.

The pattern that matters more than any single product

Initial access differed (command execution from a gateway process, SSRF-then-RCE against a web application, and workflow-engine authentication bypass) but credential collection and durable access converged in all three; resource monetisation converged in two of the three (LiteLLM's cryptomining, Kestra's XMRig deployment on the compromised worker), while the RAGFlow intrusion pursued only future-credential interception with no miner or interactive shell observed (Microsoft Threat Intelligence, 2026-08-26). Microsoft's own framing is the operational takeaway: these platforms should be monitored according to their control-plane role, not as isolated applications, because a gateway, retrieval or orchestration service can concentrate credentials, database access, workflow execution and container privileges in one runtime. Correlating an unexpected shell or interpreter spawned from an AI-workload process with subsequent secret access, application-file modification, Docker-socket use, outbound callbacks and resource-hijacking activity exposes this class of attack earlier than any single product-specific indicator (Microsoft Threat Intelligence, 2026-08-26).