Miguel Hernandez

3 weeks ago | sysdig.com | Miguel Hernandez |Miguel Hernández |Alessandra Rizzo

The Sysdig Threat Research Team (TRT) recently observed a malicious threat actor targeting a misconfigured system hosting Open WebUI, a popular application (95k stars on GitHub) that provides an extensible, self-hosted AI interface used to enhance large language models (LLMs). With access, the attacker was able to inject malicious code and download cryptominers. In this blog, we explore the detailed analysis of the attack and provide multiple means of behavioral and IoC-based detection.