Trivy Supply Chain Compromise by TeamPCP — Credential-Stealing Malware in v0.69.4, trivy-action, and setup-trivy GitHub Actions
Trivy Supply Chain Compromise by TeamPCP (TL-2026-0256), also tracked as Trivy Supply Chain Attack March 2026, is a critical-severity supply-chain compromise scored CVSS 9.8, first published 2026-03-20. It is attributed to TeamPCP (Russia) with high confidence, affects Aqua Security Trivy, maps to 23 MITRE ATT&CK techniques (T1003, T1005, T1016), and is covered by 9 detection rules and 21 indicators of compromise.
Key facts for TL-2026-0256
- Threat ID
- TL-2026-0256
- Also known as
- Trivy Supply Chain Attack March 2026, TeamPCP Cloud Stealer, Trivy v0.69.4 Compromise
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N)
- Status
- MONITORING
- Category
- SUPPLY_CHAIN
- First published
- 2026-03-20
- Last reviewed
- 2026-03-20
- Attribution
- TeamPCP
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- technology, devops, cloud-infrastructure, financial, healthcare, government, software-development
- Target regions
- Global, North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 21
Malware and tooling in Trivy Supply Chain Compromise by TeamPCP
Malware and tooling: TeamPCP Cloud Stealer, CloudFlare Tunnel, ICP (Internet Computer Protocol) canister hosting, aqua-bot (compromised GitHub service account)
On March 19, 2026, threat actor TeamPCP compromised Aqua Security's Trivy vulnerability scanner (v0.69.4), trivy-action (75 of 76 tags), and setup-trivy GitHub Actions by force-pushing malicious versions via the compromised aqua-bot service account. The three-stage payload harvests CI/CD secrets from Runner.Worker process memory, sweeps filesystem credentials across 16+ categories, encrypts with AES-256-CBC/RSA-4096 hybrid encryption, and exfiltrates to typosquatted C2 infrastructure at scan.aquasecurtiy.org, with fallback exfiltration via victim GitHub repositories.
How Trivy Supply Chain Compromise by TeamPCP works
On March 19, 2026 at 17:43:37 UTC, the threat actor group TeamPCP (also known as DeadCatx3, PCPcat, PersyPCP, and ShellForce) executed a sophisticated supply chain attack against Aqua Security's widely-used Trivy vulnerability scanner ecosystem. This marks the second distinct compromise of the Trivy supply chain in March 2026, following the hackerbot-claw incident on February 28.
The attackers compromised the aqua-bot service account and used it to force-push a malicious v0.69.4 release to the trivy repository, triggering automated release workflows. Simultaneously, they force-pushed malicious commits to 75 of 76 version tags in the aquasecurity/trivy-action repository and 7 tags in aquasecurity/setup-trivy. The only untouched trivy-action tag was 0.35.0 (base commit 57a97c7e). The tag poisoning technique cloned original commit metadata including author names, timestamps, and messages while replacing only the entrypoint.sh payload, making detection through casual inspection extremely difficult.
The malicious payload operates as a three-stage credential stealer:
Stage 1 — Collection: On GitHub-hosted runners, the malware exploits passwordless sudo access to locate the Runner.Worker process and read its memory via /proc/<pid>/mem, searching for the JSON pattern {"value":"<secret>","isSecret":true} to extract all GitHub Actions secrets. On self-hosted runners and developer machines, a comprehensive filesystem credential stealer (self-identified in code comments as 'TeamPCP Cloud stealer') systematically searches 50+ sensitive file paths for SSH keys (~/.ssh/id_*), AWS credentials (~/.aws/credentials), GCP service account keys, Azure tokens, Kubernetes service account tokens and kubeconfig files, Docker configs, database credentials, Terraform state files, VPN configurations, shell histories, and cryptocurrency wallets (Bitcoin, Solana, Ethereum, Cardano). The malware also enumerates network interfaces and harvests all environment variables from the runner process.
Stage 2 — Encryption: Collected credentials are bundled into tpcp.tar.gz, then encrypted using AES-256-CBC with PBKDF2 key derivation, with the session key wrapped using RSA-4096 OAEP. The resulting bundle contains payload.enc and session.key.enc.
Stage 3 — Exfiltration: The encrypted bundle is sent via HTTPS POST to the typosquatted C2 domain scan.aquasecurtiy.org (note the transposed 'i' and 'y' in 'security') at IP 45.148.10.212 (TECHOFF SRV LIMITED, Amsterdam), with a custom X-Filename header. If the primary C2 is unreachable and a GitHub PAT is available, the malware falls back to creating a public repository named tpcp-docs on the victim's GitHub account and uploading stolen data as a release asset.
On developer machines (detected via GITHUB_ACTIONS != 'true'), the malicious Trivy binary deploys a Python dropper to ~/.config/systemd/user/sysmon.py with systemd unit integration for persistence. This dropper polls a secondary C2 at tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io (ICP-hosted) after a 5-minute sleep interval, enabling arbitrary payload execution on compromised developer workstations.
A third C2 endpoint, plug-tab-protective-relay.trycloudflare.com, was identified via Cloudflare Tunnel infrastructure.
The blast radius is significant: over 10,000 GitHub workflow files reference aquasecurity/trivy-action, and any pipeline that ran using a compromised version tag between March 19-20 executed the credential stealer before the legitimate Trivy scan. The Homebrew project performed an emergency downgrade (PR #273304). Detection artifacts include missing GPG signatures on compromised commits, impossible commit timestamps (2020-era dates with 2026 parents), and the distinctive 'tpcp-docs' repository creation on victim accounts.
TeamPCP is a cloud-native threat group active since at least November 2025, known for exploiting misconfigured Docker APIs, Kubernetes clusters, Ray dashboards, and Redis servers using automated worm-driven campaigns. The group has compromised at least 60,000 servers worldwide and operates a Telegram channel with 700+ members where they publish stolen data. Their motivation spans financial gain through ransomware, cryptomining, data theft, and extortion.
MITRE ATT&CK techniques used in TL-2026-0256
credential-access
T1003 OS Credential Dumping; T1528 Steal Application Access Token; T1552 Unsecured Credentials
collection
T1005 Data from Local System; T1074 Data Staged; T1560 Archive Collected Data
discovery
T1016 System Network Configuration Discovery; T1057 Process Discovery; T1083 File and Directory Discovery
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal
exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
execution
T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter
command-and-control
T1071 Application Layer Protocol; T1090 Proxy; T1573 Encrypted Channel
initial-access
persistence
T1543 Create or Modify System Process
resource-development
Affected products and versions in Trivy Supply Chain Compromise by TeamPCP
- Aqua Security — Trivy
Vulnerable versions: 0.69.4
Fixed in: 0.69.3; latest clean release - Aqua Security — trivy-action (GitHub Action)
Vulnerable versions: 0.0.1 through 0.34.2 (75 of 76 tags)
Fixed in: 0.35.0 (commit 57a97c7e) - Aqua Security — setup-trivy (GitHub Action)
Vulnerable versions: All tags except v0.2.6
Fixed in: v0.2.6
Remediation for Trivy Supply Chain Compromise by TeamPCP
Patches
- Trivy v0.69.4 tag deleted by maintainer — use v0.69.3 or latest clean release
- setup-trivy v0.2.6 is the verified clean release
- trivy-action tag 0.35.0 (commit 57a97c7e) is the only uncompromised tag
Immediate actions
- Stop using aquasecurity/trivy-action with version tags immediately
- Pin trivy-action to clean commit SHA 57a97c7e7821a5776cebc9bb87c984fa69cba8f1 or tag 0.35.0
- Upgrade setup-trivy to clean v0.2.6 release
- Rotate ALL credentials accessible to affected CI/CD workflows — cloud keys, SSH keys, API tokens, database credentials
- Search GitHub organizations for tpcp-docs repositories indicating successful exfiltration
- Block C2 domain scan.aquasecurtiy.org and IP 45.148.10.212 at perimeter firewall
- Block tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io and plug-tab-protective-relay.trycloudflare.com
- Audit all GitHub Actions workflow runs from March 19-20 for connections to C2 infrastructure
Workarounds
- Run Trivy as a standalone binary downloaded from verified release checksums rather than via GitHub Actions
- Use container-based Trivy scanning with pinned image digests
- Temporarily disable Trivy scanning in CI/CD until clean versions are confirmed
Longer-term hardening
- Pin ALL GitHub Actions to full commit SHAs rather than version tags
- Deploy GitHub Actions workflow monitoring (e.g., StepSecurity Harden-Runner)
- Implement network egress controls for CI/CD runners to prevent unauthorized outbound connections
- Enable Compromised Actions policy to auto-cancel workflows using known malicious actions
- Audit self-hosted runner security posture and credential exposure
- Review and minimize secrets available to CI/CD pipelines (principle of least privilege)
- Implement artifact signing and verification for CI/CD dependencies
Weaknesses (CWE) in Trivy Supply Chain Compromise by TeamPCP
CWE-94, CWE-200, CWE-506, CWE-829
Timeline of Trivy Supply Chain Compromise by TeamPCP
- TeamPCP first observed active in cloud-native threat landscape, with earliest Telegram activity dating to July 30, 2025
- Flare publishes detailed threat profile on TeamPCP cloud-native worm campaigns targeting Docker, Kubernetes, Ray, and Redis
- First Trivy compromise: hackerbot-claw incident results in repository takeover via GitHub Actions PWN request vulnerability
- 23:13 UTC — Trivy maintainer knqyf263 deletes malicious v0.69.4 tag from trivy repository
- 21:07 UTC — Aqua maintainer nikpivkin deletes compromised setup-trivy v0.2.5 tag; clean v0.2.6 published at 21:43 UTC
- ~19:15 UTC — Socket.dev identifies 182 malicious GitHub Actions threat feed entries; StepSecurity Harden-Runner detects anomalous outbound connections to scan.aquasecurtiy.org
- 18:30 UTC — Malicious helm chart bump PR #10416 opened against Trivy repository
- Attacker force-pushes 75 of 76 version tags in aquasecurity/trivy-action with credential-stealing entrypoint.sh; setup-trivy action.yaml injected with base64-encoded Python credential stealer
- 17:43:37 UTC — Compromised aqua-bot account pushes malicious v0.69.4 tag to aquasecurity/trivy, triggering release workflow and documentation deployment
- Multiple security vendors (Wiz, StepSecurity, Socket.dev, ZEST Security) publish detailed analyses of the compromise; Homebrew performs emergency downgrade (PR #273304)
- 00:01 UTC — 17 spam bot accounts flood discussion #10420 with generic praise messages in a single second, attempting to obscure incident discussion
- As of 2026-05-29, the Trivy v0.69.4 compromise itself is contained—Aqua removed all malicious artifacts within ~4h on Mar 19, republished clean versions (v0.69.3, trivy-action 0.35.0, setup-trivy 0.2.6), and the typosquat C2 is down. But actor TeamPCP stays active (Checkmarx, TanStack, ~170 npm/PyPI packages through May 17), with stolen CI/CD secrets still requiring rotation.
Sources cited for Trivy Supply Chain Compromise by TeamPCP
- Wiz: Trivy Compromised — Everything You Need to Know about the Latest Supply Chain Attack
- StepSecurity: Trivy Compromised a Second Time — Malicious v0.69.4 Release
- Socket.dev: Trivy Under Attack Again — Widespread GitHub Actions Tag Compromise
- Aqua Security: Trivy Security Incident 2026-03-19 Discussion
- GitHub Issue: aquasecurity/trivy-action is compromised
- Flare: TeamPCP — An Emerging Force in the Cloud Native and Ransomware Landscape
- The Hacker News: TeamPCP Worm Exploits Cloud Infrastructure
- Cyble: TeamPCP Threat Actor Profile
- ZEST Security: Trivy Supply Chain Attack — When Your Scanner Gets Hacked
- Dark Reading: TeamPCP Turns Cloud Infrastructure Into Crime Bots
Threats related to Trivy Supply Chain Compromise by TeamPCP
- Trivy Supply Chain Attack — Credential Theft Infostealer via Malicious GitHub Actions Tags (GHSA-69fq-xp46-6x23)
- Checkmarx KICS GitHub Action Supply Chain Compromise by TeamPCP (kics-github-action Tag Hijacking)
- TeamPCP Partners With Vect Ransomware Group to Escalate Cross-Ecosystem Open Source Supply Chain Attacks
- LiteLLM Supply Chain Compromise — TeamPCP Multi-Ecosystem Campaign via Trojanized PyPI Packages
- TeamPCP Supply Chain Campaign: LiteLLM PyPI Compromise, CanisterWorm npm Propagation, and Multi-Ecosystem Attack (CVE-2026-33634)
- Trivy Supply Chain Compromise — TeamPCP Credential-Stealing Malware Injected into CI/CD Pipelines (CVE-2026-33634)
Detection coverage for TL-2026-0256
As of 2026-03-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0256 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.