Socket Finds More Compromised Trivy Docker Images Linked to TeamPCP

Summary

Socket reports that Trivy Docker images 0.69.5 and 0.69.6 contain TeamPCP-linked indicators. Aqua Security’s GitHub organization may have been exposed; organizations are advised to avoid affected versions and treat recent executions as potentially compromised.

Key points

Socket says Trivy Docker images 0.69.5 and 0.69.6 were pushed on March 22 without matching GitHub releases or tags and contain indicators associated with TeamPCP.
Socket identified the typosquatted C2 domain scan[.]aquasecurtiy[.]org, files payload.enc and tpcp.tar.gz, and references to the tpcp-docs GitHub repository.
Socket identifies 0.69.4 as the initial compromised release, since removed; 0.69.3 is the last known clean release. The article says it found no evidence older images or binaries were modified after publication.
Researcher Paul McCarty noted that Aqua Security’s GitHub organization appeared exposed; the article says the scope is unclear and internal repository access may have been temporarily public.
Docker tags are not immutable. Third-party images that automatically pulled or rebuilt with affected Trivy versions during the attack windows may also have incorporated malicious binaries.
Organizations are advised to review Trivy use in CI/CD, avoid affected versions, revoke tokens, use trusted publishing practices, and treat recent executions as potentially compromised.

Article Details

Event Type: Supply-chain compromise involving malicious Trivy Docker images.
Impact: Trivy Docker images tagged 0.69.4, 0.69.5, and 0.69.6 were reported compromised; 0.69.3 was the last known clean release. The images contained indicators associated with the TeamPCP infostealer. Aqua Security’s GitHub organization appeared exposed, potentially allowing temporary access to internal repositories, though the scope is unclear. Other images that pulled or rebuilt against affected Trivy versions may also have incorporated malicious binaries.