Ethical Hacking News
A highly sophisticated supply chain attack has compromised the Trivy vulnerability scanner, allowing threat actors to steal sensitive authentication secrets. The breach is believed to be linked to TeamPCP, a documented cloud-native threat actor known for exploiting vulnerabilities in various environments.
The Trivy vulnerability scanner was compromised in a high-profile supply chain attack. The attackers exploited misconfigured credentials and vulnerabilities in the GitHub Actions build process. Aqua Security confirmed the incident, which involved the use of stolen credentials from an earlier breach. The attackers published malicious releases, including compromised container images and GitHub releases, to steal sensitive authentication secrets. The attack had significant implications for organizations that use Trivy, highlighting the importance of properly containing incidents and rotating sensitive credentials.
The Trivy vulnerability scanner, a popular tool used to identify vulnerabilities and exposed secrets across various environments, has been compromised in a high-profile supply chain attack. The breach was carried out by threat actors known as TeamPCP, who exploited a combination of misconfigured credentials and vulnerabilities in the GitHub Actions build process.
According to Aqua Security, which confirmed the incident, the attackers compromised Trivy's environment using credentials from an earlier March breach that was not fully contained. This allowed them to publish malicious releases, including compromised container images and GitHub releases, which were then used to steal sensitive authentication secrets.
The attack began when threat actors published malicious versions of the trivy-action repository in GitHub Actions, which affected nearly all version tags of the Trivy Action repository. The attackers abused a compromised credential with write access to the repository, allowing them to publish malicious releases that acted as infostealers across the main scanner and related GitHub Actions.
The malicious script used by the attackers performed several functions, including reconnaissance data collection, scanning for credentials in various locations, and enumerating network interfaces. It also scanned memory regions used by the GitHub Actions Runner process for additional authentication secrets.
The collected data was then encrypted and stored in an archive named tpcp.tar.gz, which was exfiltrated to a typosquatted command-and-control server at scan.aquasecurtiy[.]org. If exfiltration failed, the malware created a public repository within the victim's GitHub account and uploaded the stolen data there.
To persist on a compromised device, the malware dropped a Python payload that checked a remote server for additional payloads to drop, giving the threat actor persistent access to the device. The attack is believed to be linked to TeamPCP, a documented cloud-native threat actor known for exploiting misconfigured Docker APIs and other vulnerabilities.
The breach has significant implications for organizations that use Trivy, as it highlights the importance of properly containing incidents and rotating sensitive credentials. Aqua Security recommends that affected organizations treat their environments as fully compromised and take immediate action to rotate all secrets, such as cloud credentials, SSH keys, API tokens, and database passwords.
The incident also underscores the need for developers to stay vigilant and monitor their systems regularly for signs of malicious activity. It is essential to keep software up-to-date and use reputable security scanners to identify vulnerabilities and exposed secrets.
In conclusion, the Trivy vulnerability scanner compromise highlights the importance of supply chain security and the need for organizations to take proactive measures to protect themselves against high-profile attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/Trivy-Vulnerability-Scanner-Compromised-in-High-Profile-Supply-Chain-Attack-ehn.shtml
https://www.bleepingcomputer.com/news/security/trivy-vulnerability-scanner-breach-pushed-infostealer-via-github-actions/
https://thehackernews.com/2026/03/trivy-security-scanner-github-actions.html
https://thehackernews.com/2026/02/teampcp-worm-exploits-cloud.html
https://flare.io/learn/resources/blog/teampcp-cloud-native-ransomware
Published: Sat Mar 21 13:34:48 2026 by llama3.2 3B Q4_K_M
