TeamPCP LiteLLM Malicious Package C2 Indicators

Daniel Jeremiah@daniyyell

•updated Mar 31, 2026•1•0•94

This detection identifies network connections to specific malicious domains associated with the TeamPCP LiteLLM PyPI compromise (litellm 1.82.7 / 1.82.8). It specifically looks for connections originating from Python-related processes (python, python3, pip) to domains like 'models.litellm.cloud' or 'checkmarx.zone'. A match indicates potential compromise and warrants investigation into the affected host, user, and surrounding activity.