**

Hackers Strike Again: Trivy Vulnerability Scanner Compromised in Devastating Data Breach

A recent supply-chain attack has left the cybersecurity community reeling, as the popular vulnerability scanner Trivy was compromised by threat actors known as TeamPCP. The breach allowed malicious container images and GitHub releases to be published to users, compromising sensitive authentication secrets and exposing developers and security teams to risk.

Trivy is a widely used security tool that helps identify vulnerabilities, misconfigurations, and exposed secrets across containers, Kubernetes environments, code repositories, and cloud infrastructure. Its popularity makes it a high-value target for attackers looking to steal sensitive data. The breach was first disclosed by security researcher Paul McCarty, who warned that Trivy version 0.69.4 had been backdoored.

**The Attack: A Detailed Analysis**

Further analysis by Socket and later by Wiz determined that the attack affected multiple GitHub Actions, compromising nearly all version tags of the trivy-action repository. Researchers found that threat actors compromised Trivy's GitHub build process, swapping the entrypoint.sh in GitHub Actions with a malicious version and publishing trojanized binaries in the Trivy v0.69.4 release.

The attackers abused a compromised credential with write access to the repository, allowing them to publish malicious releases. These compromised credentials are from an earlier March breach, in which credentials were exfiltrated from Trivy's environment and not fully contained. The threat actor force-pushed 75 out of 76 tags in the aquasecurity/trivy-action repository, redirecting them to malicious commits.

As a result, any external workflows using the affected tags automatically executed the malicious code before running legitimate Trivy scans, making the compromise difficult to detect.

**Infostealer Payload: What Did It Do?**

The malicious script collected reconnaissance data and scanned systems for a wide range of files and locations known to store credentials and authentication secrets. This included:

* Environment variables * Local files for credentials * Network interfaces

The trojanized Trivy binary performed similar data collection on developer machines, gathering environment variables, scanning local files for credentials, and enumerating network interfaces.

Collected data was encrypted and stored in an archive named tpcp.tar.gz, which was then exfiltrated to a typosquatted command-and-control server at scan.aquasecurtiy[.]org. If exfiltration failed, the malware created a public repository named tpcp-docs within the victim's GitHub account and uploaded the stolen data there.

To persist on a compromised device, the malware would also drop a Python payload at ~/.config/systemd/user/sysmon.py and register it as a systemd service. This payload would check a remote server for additional payloads to drop, giving the threat actor persistent access to the device.

**Follow-up Attack: CanisterWorm via npm**

Researchers at Aikido have linked the same threat actor to a follow-up campaign involving a new self-propagating worm named "CanisterWorm," which targets npm packages. The worm compromises packages, installs a persistent backdoor via a systemd user service, and then uses stolen npm tokens to publish malicious updates to other packages.

**Conclusion**

The Trivy vulnerability scanner breach is a stark reminder of the importance of cybersecurity in today's threat landscape. With the rise of supply-chain attacks, it's essential for developers and security teams to stay vigilant and regularly review their tools and dependencies.

Organizations that used affected versions during the incident should treat their environments as fully compromised. This includes rotating all secrets, such as cloud credentials, SSH keys, API tokens, and database passwords, and analyzing systems for additional compromise.

As we continue to navigate the complexities of cybersecurity, it's crucial to stay informed about emerging threats and vulnerabilities. Stay tuned to "Hacker Pranks" for more updates on the latest security research and trends.