Clarissa Hana
The sophisticated cyber threat actor known as TeamPCP has escalated its supply-chain attack, moving beyond the initial compromise of Aqua Security’s Trivy vulnerability scanner to directly target the company’s Docker Hub presence and aggressively tamper with numerous repositories within Aqua Security’s GitHub organization. This latest development signifies a significant broadening of the attack’s scope, demonstrating the attackers’ persistence and their intent to maximize disruption and potential data exfiltration.
Initially, the attack vector involved the compromise of Trivy’s GitHub build pipeline, a critical tool used by developers worldwide to identify vulnerabilities, misconfigurations, and exposed secrets in software artifacts and infrastructure. Trivy, boasting over 33,800 stars on GitHub, is a widely adopted open-source project, making its compromise a high-impact event for the broader software development community. The breach allowed TeamPCP to inject infostealing malware, which was then distributed via Docker Hub, a central registry for Docker images.
The expanded operation, detailed in a report by supply-chain security firm Socket on Sunday, revealed that malicious Trivy artifacts, specifically new image tags 0.69.5 and 0.69.6, were pushed to Docker Hub on March 22. Crucially, these images lacked corresponding releases or tags on GitHub, a deviation from normal development practices that immediately raised red flags for security researchers. Socket’s analysis confirmed that these compromised images contained indicators of the same infostealer that TeamPCP deployed after initially gaining access to Aqua Security’s GitHub organization. This highlights the attackers’ ability to leverage compromised infrastructure to propagate their malicious payloads.
A key concern raised by Socket researchers is the mutable nature of Docker Hub tags. "Docker Hub tags are not immutable, and organizations should not rely solely on tag names for integrity," they warned. This underscores a fundamental challenge in supply-chain security: the inherent trust placed in repositories can be exploited if not rigorously validated. The implication is that even if older Trivy images or binaries were not demonstrably altered post-publication, the integrity of newer, untagged releases is now in question.
Chronology of the Escalating Attack
The timeline of this evolving attack provides critical context for understanding its progression and the challenges faced by Aqua Security in containing it.
- Early March: The initial incident targeting Trivy’s GitHub build pipeline occurs. This breach leads to the injection of infostealing malware, subsequently distributed via Docker Hub.
- March 20: Aqua Security publicly acknowledges the initial compromise of Trivy’s build pipeline. They report that the threat actor gained access due to "incomplete containment" of a previous incident affecting the same tool earlier in the month. The company states they rotated secrets and tokens, but admits the process may not have been atomic, potentially exposing refreshed tokens to the attackers. Aqua Security releases new, safe versions of Trivy and engages the incident response firm Sygnia.
- March 22: Suspicious activity is detected within Aqua Security’s GitHub organization. Aqua Security reports that the same threat actors have re-established unauthorized access, performing "unauthorized changes and repository tampering." Despite this new development, Aqua states that Trivy itself was not impacted at this specific moment.
- March 24 (Sunday): Supply-chain security firm Socket publishes a report detailing the compromise of Trivy artifacts on Docker Hub, specifically highlighting the suspicious image tags 0.69.5 and 0.69.6 pushed on March 22.
- March 24 (Sunday/Monday): Analysis from OpenSourceMalware, a community-driven malware intelligence platform, sheds light on how TeamPCP gained access to Aqua Security’s GitHub organizations.
This chronological breakdown illustrates a pattern of persistent and adaptive adversary behavior, where initial containment measures were evidently circumvented, leading to further breaches and malicious activities.
Deep Dive into the GitHub Breach
The ability of TeamPCP to re-enter Aqua Security’s environment and tamper with repositories points to a critical vulnerability in the organization’s access control and secret management. Aqua Security themselves attributed the initial breach to "incomplete containment" of a prior incident, suggesting that not all compromised credentials or access tokens were successfully revoked or rotated. They noted in a GitHub discussion that while secrets and tokens were rotated, "the process wasn’t atomic and attackers may have been privy to refreshed tokens." This highlights a common pitfall in incident response: a failure to comprehensively isolate all potential points of compromise.
The subsequent unauthorized access on March 22, as detailed by Aqua Security, involved "unauthorized changes and repository tampering." This was not merely a passive presence but an active manipulation of the code repositories. While Aqua Security stated that Trivy itself was not impacted at that moment, the act of tampering with repositories is a severe security breach, potentially affecting other projects or introducing subtle, hard-to-detect modifications.
Further analysis from OpenSourceMalware provided a granular view of how the attackers operated within Aqua Security’s GitHub infrastructure. They identified that TeamPCP gained access to the aquasec-com GitHub organization, which hosts Aqua Security’s proprietary code, distinct from the aquasecurity organization used for public repositories. This suggests a targeted approach, potentially aiming for sensitive intellectual property.
The attackers reportedly utilized an automation script to systematically alter the repositories. Within approximately two minutes, they prepended the prefix tpcp-docs- to all 44 repositories in the aquasec-com organization and modified their descriptions to read "TeamPCP Owns Aqua Security." This act, while seemingly a defacement, serves multiple purposes: it demonstrates control, creates psychological impact, and potentially confuses legitimate users about the status of the code.
The researchers expressed high confidence that the attackers’ entry point was the compromise of a service account named Argon-DevOps-Mgt. This service account possessed administrative access to both of Aqua Security’s GitHub organizations. The crucial vulnerability lay in how this service account was authenticated. According to OpenSourceMalware, the account authorized actions based on a Personal Access Token (PAT) of a standard user, rather than a more secure GitHub App.
Vulnerabilities in Authentication and Access Control
The reliance on a PAT for a service account presents significant security risks. Unlike GitHub Apps, which offer finer-grained permissions and token lifecycles, PATs function akin to passwords, are often valid for extended periods, and are less granularly controlled. Furthermore, service accounts are typically designed for automated tasks and often lack the crucial security layer of multi-factor authentication (MFA). This combination of factors created a persistent and potent access vector for TeamPCP.
To confirm their administrative privileges within Aqua Security’s GitHub organizations, TeamPCP executed a test maneuver. They created a new branch named update-plugin-links-v0.218.2 within the public aquasecurity/trivy-plugin-aqua repository and then deleted it "at the exact same second." This rapid create-and-delete operation is a common tactic to quickly verify the ability to perform administrative actions on a repository without leaving a lasting trace.
The likely method by which TeamPCP obtained the PAT for the Argon-DevOps-Mgt service account is through the TeamPCP Cloud stealer. This malware is designed to exfiltrate sensitive information, including GitHub tokens, SSH keys, cloud credentials, and environment variables from CI/CD runners. As the Argon-DevOps-Mgt service account was configured to trigger workflows on trivy-plugin-aqua, its token would have been present in the runner environment, making it a prime target for the stealer.
OpenSourceMalware has provided a set of Indicators of Compromise (IoCs) to aid defenders in identifying potential impact within their own environments. These IoCs are critical for organizations that may be using Trivy or have integrated with Aqua Security’s tools.
Broader Implications and Official Responses
The implications of this multi-pronged supply-chain attack are far-reaching. For developers and organizations relying on Trivy, the compromise casts a shadow of doubt over the integrity of the software supply chain. The ability of attackers to inject malicious code into widely used security tools and then propagate it through major platforms like Docker Hub represents a significant threat to software security globally.
Aqua Security has emphasized that there is no evidence suggesting that the Trivy version used in their commercial products has been compromised. They stated, "By design, the forked version of Aqua’s commercial platform lags Trivy open source with a controlled integration process." This suggests a deliberate architectural separation, where commercial offerings are not directly exposed to the same rapid release cycles and potential vulnerabilities as their open-source counterparts. However, the incident still raises questions about the security of the integration processes themselves.
In response to the ongoing situation, Aqua Security has committed to providing further updates as new details emerge. They have also pledged to publish additional findings, indicating a transparent approach to addressing the incident and informing their user base and the wider security community. The company’s engagement with an external incident response firm like Sygnia underscores the seriousness of the attack and the need for specialized expertise in forensic investigation and remediation.
The attack also highlights the inherent risks associated with service accounts and the improper use of Personal Access Tokens in CI/CD pipelines. The lack of MFA on service accounts, combined with the long-lived nature of PATs, creates an attractive target for attackers. This incident serves as a stark reminder for organizations to rigorously review their access control policies, implement strong authentication mechanisms for all accounts, including service accounts, and adopt principles of least privilege. The practice of using atomic secret rotation and comprehensive validation of all changes within development pipelines is paramount in preventing such sophisticated supply-chain attacks from succeeding. As the cybersecurity landscape continues to evolve, the resilience and integrity of the software supply chain remain a critical battleground.
