Trivy Breach - Infostealer Malware Distributed via GitHub
Basically, hackers used a trusted tool to spread malware that steals passwords.
A supply-chain attack compromised the Trivy vulnerability scanner, distributing infostealer malware via GitHub Actions. Developers using affected versions are at risk. Immediate action is required to secure environments and rotate credentials.
What Happened
In a significant breach, the Trivy vulnerability scanner was compromised by a group known as TeamPCP. This supply-chain attack involved distributing credential-stealing malware through both official releases and GitHub Actions. Trivy, widely used by developers and security teams to identify vulnerabilities, became a high-value target for attackers aiming to steal sensitive authentication secrets.
The breach was first reported by security researcher Paul McCarty, who identified that version 0.69.4 of Trivy had been backdoored. Malicious container images and GitHub releases were published, affecting multiple GitHub Actions and nearly all version tags of the trivy-action repository. The attackers exploited compromised credentials to swap the legitimate build scripts with malicious versions, allowing the malware to execute undetected.
Who's Affected
The attack impacts a broad range of developers and organizations that rely on Trivy for security scanning. Given Trivy's popularity, the potential exposure of sensitive data is extensive. The compromised version was available for approximately three hours, but the malicious GitHub Action tags remained active for up to 12 hours, increasing the risk of widespread exploitation.
Organizations that utilized affected versions during this window should treat their environments as fully compromised. This includes those who integrated Trivy into their CI/CD pipelines, as the malware could automatically execute during legitimate scans, making detection challenging.
What Data Was Exposed
The infostealer malware collected a variety of sensitive information, including:
- SSH keys and configurations
- Cloud credentials for platforms like AWS, GCP, and Azure
- Database credentials for systems like PostgreSQL and MySQL
- Environment files containing sensitive tokens
- Webhooks for services like Slack and Discord
Additionally, the malware scanned memory regions for secrets and harvested data from local files on developer machines. The stolen data was encrypted and exfiltrated to a command-and-control server, or uploaded to a public repository in the victim's GitHub account if exfiltration failed.
What You Should Do
Organizations should take immediate action to mitigate the impact of this breach. Here are key steps to follow:
- Rotate all secrets: Change cloud credentials, SSH keys, API tokens, and database passwords.
- Analyze systems: Conduct thorough investigations to identify any further compromises.
- Monitor for suspicious activity: Keep an eye on GitHub accounts for unauthorized repositories or changes.
Aqua Security, the company behind Trivy, acknowledged the incident and noted that the attack was a follow-up to a previous breach where credentials were exfiltrated but not adequately contained. This emphasizes the importance of robust security practices in managing credentials and responding to breaches effectively.
BleepingComputer