---
id: 6190
title: "33K Exposed LiteLLM Deployments and the C2 Servers Behind TeamPCP's Supply Chain Attack"
source_domain: hunt.io
source_url: "https://hunt.io/blog/33k-exposed-litellm-teampcp-c2-supply-chain-attack"
published_at: "2026-03-27T00:00:00Z"
tags: ["supply-chain", "kubernetes", "credential-theft", "pypi", "litellm", "adaptixc2", "havoc"]
phying_url: "https://phying.com/item/6190"
lang: en
---

# 33K Exposed LiteLLM Deployments and the C2 Servers Behind TeamPCP's Supply Chain Attack

## Summary

After TeamPCP trojanized LiteLLM's PyPI packages, Hunt.io counted 33,688 exposed deployments and traced dual C2—AdaptixC2 and Havoc—plus a third server tied to the exfiltration domain.

## Intelligence Metadata

- **Sources:** hunt.io
- **Published:** 2026-03-27T00:00:00Z
- **Original:** https://hunt.io/blog/33k-exposed-litellm-teampcp-c2-supply-chain-attack
- **Phying News:** https://phying.com/item/6190