# Trivy Supply Chain Compromise by TeamPCP — Credential-Stealing Malware in v0.69.4, trivy-action, and setup-trivy GitHub Actions

> On March 19, 2026, threat actor TeamPCP compromised Aqua Security's Trivy vulnerability scanner (v0.69.4), trivy-action (75 of 76 tags), and setup-trivy GitHub Actions by force-pushing malicious versions via the compromised aqua-bot service account. The three-stage payload harvests CI/CD secrets from Runner.Worker process memory, sweeps filesystem credentials across 16+ categories, encrypts with AES-256-CBC/RSA-4096 hybrid encryption, and exfiltrates to typosquatted C2 infrastructure at scan.aquasecurtiy.org, with fallback exfiltration via victim GitHub repositories.

- **Published:** 2026-03-20T12:00:00Z
- **Last reviewed:** 2026-03-20T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0256
- **ID:** TL-2026-0256
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Actor:** TeamPCP (Russia)
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On March 19, 2026 at 17:43:37 UTC, the threat actor group TeamPCP (also known as DeadCatx3, PCPcat, PersyPCP, and ShellForce) executed a sophisticated supply chain attack against Aqua Security's widely-used Trivy vulnerability scanner ecosystem. This marks the second distinct compromise of the Trivy supply chain in March 2026, following the hackerbot-claw incident on February 28.

The attackers compromised the aqua-bot service account and used it to force-push a malicious v0.69.4 release to the trivy repository, triggering automated release workflows. Simultaneously, they force-pushed malicious commits to 75 of 76 version tags in the aquasecurity/trivy-action repository and 7 tags in aquasecurity/setup-trivy. The only untouched trivy-action tag was 0.35.0 (base commit 57a97c7e). The tag poisoning technique cloned original commit metadata including author names, timestamps, and messages while replacing only the entrypoint.sh payload, making detection through casual inspection extremely difficult.

The malicious payload operates as a three-stage credential stealer:

Stage 1 — Collection: On GitHub-hosted runners, the malware exploits passwordless sudo access to locate the Runner.Worker process and read its memory via /proc/<pid>/mem, searching for the JSON pattern {"value":"<secret>","isSecret":true} to extract all GitHub Actions secrets. On self-hosted runners and developer machines, a comprehensive filesystem credential stealer (self-identified in code comments as 'TeamPCP Cloud stealer') systematically searches 50+ sensitive file paths for SSH keys (~/.ssh/id_*), AWS credentials (~/.aws/credentials), GCP service account keys, Azure tokens, Kubernetes service account tokens and kubeconfig files, Docker configs, database credentials, Terraform state files, VPN configurations, shell histories, and cryptocurrency wallets (Bitcoin, Solana, Ethereum, Cardano). The malware also enumerates network interfaces and harvests all environment variables from the runner process.

Stage 2 — Encryption: Collected credentials are bundled into tpcp.tar.gz, then encrypted using AES-256-CBC with PBKDF2 key derivation, with the session key wrapped using RSA-4096 OAEP. The resulting bundle contains payload.enc and session.key.enc.

Stage 3 — Exfiltration: The encrypted bundle is sent via HTTPS POST to the typosquatted C2 domain scan.aquasecurtiy.org (note the transposed 'i' and 'y' in 'security') at IP 45.148.10.212 (TECHOFF SRV LIMITED, Amsterdam), with a custom X-Filename header. If the primary C2 is unreachable and a GitHub PAT is available, the malware falls back to creating a public repository named tpcp-docs on the victim's GitHub account and uploading stolen data as a release asset.

On developer machines (detected via GITHUB_ACTIONS != 'true'), the malicious Trivy binary deploys a Python dropper to ~/.config/systemd/user/sysmon.py with systemd unit integration for persistence. This dropper polls a secondary C2 at tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io (ICP-hosted) after a 5-minute sleep interval, enabling arbitrary payload execution on compromised developer workstations.

A third C2 endpoint, plug-tab-protective-relay.trycloudflare.com, was identified via Cloudflare Tunnel infrastructure.

The blast radius is significant: over 10,000 GitHub workflow files reference aquasecurity/trivy-action, and any pipeline that ran using a compromised version tag between March 19-20 executed the credential stealer before the legitimate Trivy scan. The Homebrew project performed an emergency downgrade (PR #273304). Detection artifacts include missing GPG signatures on compromised commits, impossible commit timestamps (2020-era dates with 2026 parents), and the distinctive 'tpcp-docs' repository creation on victim accounts.

TeamPCP is a cloud-native threat group active since at least November 2025, known for exploiting misconfigured Docker APIs, Kubernetes clusters, Ray dashboards, and Redis servers using automated worm-driven campaigns. The group has compromised at least 60,000 servers worldwide and operates a Telegram channel with 700+ members where they publish stolen data. Their motivation spans financial gain through ransomware, cryptomining, data theft, and extortion.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1543 Create or Modify System Process
- T1053 Scheduled Task/Job
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1070 Indicator Removal
- T1528 Steal Application Access Token
- T1552 Unsecured Credentials
- T1003 OS Credential Dumping
- T1016 System Network Configuration Discovery
- T1083 File and Directory Discovery
- T1057 Process Discovery
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1074 Data Staged
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1090 Proxy
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1586 Compromise Accounts
- T1583 Acquire Infrastructure

## Sources

- [Wiz: Trivy Compromised — Everything You Need to Know about the Latest Supply Chain Attack](https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack)
- [StepSecurity: Trivy Compromised a Second Time — Malicious v0.69.4 Release](https://www.stepsecurity.io/blog/trivy-compromised-a-second-time---malicious-v0-69-4-release)
- [Socket.dev: Trivy Under Attack Again — Widespread GitHub Actions Tag Compromise](https://socket.dev/blog/trivy-under-attack-again-github-actions-compromise)
- [Aqua Security: Trivy Security Incident 2026-03-19 Discussion](https://github.com/aquasecurity/trivy/discussions/10425)
- [GitHub Issue: aquasecurity/trivy-action is compromised](https://github.com/aquasecurity/trivy-action/issues/541)
- [Flare: TeamPCP — An Emerging Force in the Cloud Native and Ransomware Landscape](https://flare.io/learn/resources/blog/teampcp-cloud-native-ransomware)
- [The Hacker News: TeamPCP Worm Exploits Cloud Infrastructure](https://thehackernews.com/2026/02/teampcp-worm-exploits-cloud.html)
- [Cyble: TeamPCP Threat Actor Profile](https://cyble.com/threat-actor-profiles/teampcp/)
- [ZEST Security: Trivy Supply Chain Attack — When Your Scanner Gets Hacked](https://www.zestsecurity.io/resources/content/trivy-supply-chain-attack-github-actions)
- [Dark Reading: TeamPCP Turns Cloud Infrastructure Into Crime Bots](https://www.darkreading.com/cloud-security/teampcp-cloud-infrastructure-crime-bots)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0256