cyber.hendryadrian.com
Threat Research · sysdig.com

TeamPCP Stealer Reappears in Checkmarx GitHub Action After Trivy Compromise

· Original article ↗

Summary

Sysdig researchers observed a stealer matching the Trivy compromise in Checkmarx’s ast-github-action about four days later. The activity suggests stolen credentials enabled further action poisoning; runtime detection identified the behavior.

Key points

  • Sysdig researchers observed the same credential-stealing payload in Checkmarx/ast-github-action v2.3.28 about four days after the Trivy compromise; they say the activity suggests stolen credentials were reused to poison another action.
  • The payload harvested secrets from CI runner memory, queried cloud instance metadata for credentials, and searched workspaces for Slack and Discord webhook URLs.
  • The stealer encrypted collected data in tpcp.tar.gz and uploaded it to vendor-imitating domains, including scan[.]aquasecurtiy[.]org and checkmarx[.]zone.
  • The article reports that 75 of 76 Trivy action tags were force-pushed to malicious commits, while the Checkmarx action used setup.sh as its entry point.
  • Sysdig and Falco runtime rules detected behaviors including metadata access correlated with subsequent file uploads; the article says static scanning and domain reputation checks did not catch the activity.
  • Recommended steps include rotating exposed credentials, auditing affected workflow runs, pinning actions to full commit SHAs, monitoring runner egress, and restricting metadata-service access.

Article Details

Attack Vectors
  • TeamPCP force-pushed version tags for aquasecurity/trivy-action, redirecting CI workflows to commits containing a credential-stealing payload.
  • The payload scraped Runner.Worker process memory for secrets, queried the cloud instance metadata service for IAM credentials, and searched workspaces for Slack and Discord webhook URLs.
  • The payload encrypted harvested data into tpcp.tar.gz and uploaded it with curl to typosquat domains. Sysdig observed an identical stealer running through Checkmarx/ast-github-action version 2.3.28 approximately four days after the Trivy compromise.
Defensive Notes
  • Rotate secrets, tokens, and cloud credentials accessible to CI runners during the affected period; audit workflow logs for tpcp.tar.gz and the reported typosquat domains.
  • Pin GitHub Actions to full commit SHAs rather than version tags, which the article says were force-pushed.
  • Restrict or disable instance metadata access from CI runner containers; where needed, enforce IMDSv2 with hop limits.
  • Enable runtime monitoring with Sysdig Secure or Falco, and monitor CI runner outbound connections for curl POST uploads to unexpected domains.
  • Search GitHub organizations for repositories named tpcp-docs, which the article identifies as a fallback exfiltration indicator.

Indicators of compromise

TypeIndicatorContext
DOMAINcheckmarx[.]zoneTyposquat domain used to receive encrypted payload data from the compromised Checkmarx action.
DOMAINscan[.]aquasecurtiy[.]orgTyposquat domain identified as an exfiltration destination for data stolen by the Trivy-delivered payload.
IPV445[.]148[.]10[.]212Resolver IP reported for the exfiltration domain scan.aquasecurtiy[.]org.
IPV483[.]142[.]209[.]11Resolver IP reported for the exfiltration domain checkmarx[.]zone.

MITRE ATT&CK

T1552.005 · Cloud Instance Metadata APIThe stealer queried the cloud instance metadata service from CI runners to retrieve temporary IAM credentials.

Threat Actors

TeamPCPThe article attributes the Trivy action compromise and the later Checkmarx action activity to TeamPCP; Sysdig observed an identical stealer in both waves, and the article assesses that credentials stolen in the first compromise enabled further action poisoning.

Malware

TeamPCP Cloud stealerThe threat actor force-pushed 75 of 76 version tags in the aquasecurity/trivy-action repository, redirecting them to malicious commits containing the “TeamPCP Cloud stealer.” 

Vendors

Aqua SecurityTeamPCP compromised Aqua Security’s trivy-action and injected a credential-stealing payload that harvested CI runner memory, queried cloud instance metadata, enumerated webhook URLs, and exfiltrated encrypted secrets toCheckmarxThe identical stealer appeared days later in Checkmarx’s ast-github-action (v2.3.28), indicating stolen credentials from the Trivy compromise were used to poison additional GitHub Actions;Sysdigdependency scans failed because trusted action tags were subverted by force-pushes; runtime detection (Sysdig Secure / Falco) succeeded by detecting IMDS access correlated with subsequent binary uploads from the

Products

GitHub ActionsThe identical stealer appeared days later in Checkmarx’s ast-github-action (v2.3.28), indicating stolen credentials from the Trivy compromise were used to poison additional GitHub Actions;Sysdig Securescans failed because trusted action tags were subverted by force-pushes; runtime detection (Sysdig Secure / Falco) succeeded by detecting IMDS access correlated with subsequent binary uploads from the sameTrivyTeamPCP compromised Aqua Security’s trivy-action and injected a credential-stealing payload that harvested CI runner memory, queried cloud instance metadata, enumerated webhook URLs, and exfiltrated encrypted secrets to

Tools

Falcofailed because trusted action tags were subverted by force-pushes; runtime detection (Sysdig Secure / Falco) succeeded by detecting IMDS access correlated with subsequent binary uploads from the same process

Related Articles