cyber.hendryadrian.com
Threat Research · wiz.io

Wiz Details TeamPCP’s Post-Compromise Activity After Supply Chain Attacks

· Original article ↗

Summary

Wiz reports that credentials stolen in TeamPCP supply chain attacks were used to explore cloud environments, execute code through GitHub workflows and AWS ECS, and exfiltrate repository and cloud data.

Key points

  • The attacks targeted Trivy, KICS, LiteLLM, and Telnyx packages or projects, with malware harvesting cloud credentials, SSH keys, Kubernetes configurations, and CI/CD secrets.
  • Wiz observed stolen credentials being validated with TruffleHog and used for AWS discovery, including enumeration of IAM, EC2, Lambda, ECS, S3, and Secrets Manager.
  • Attackers used stolen GitHub personal access tokens to create malicious workflows, access repository contents and runtime secrets, and delete workflow logs.
  • In AWS environments, attackers used ECS Exec to run commands and scripts in containers and accessed S3, Secrets Manager, and databases to retrieve data.
  • Wiz says activity appeared to originate largely from VPN exit nodes and VPS hosts; it could not rule out stolen secrets being shared with other groups.
  • Wiz advises enabling and monitoring cloud and version-control audit logs, and hunting for anomalous secret use, enumeration, mass cloning, data retrieval, and workflow-log deletion.

Article Details

Attack Vectors
  • Compromised open-source projects and packages were used to distribute credential-stealing malware through binaries, GitHub Actions, container images, OpenVSX extensions, and PyPI packages.
  • Stolen credentials and Personal Access Tokens were used to validate access, enumerate AWS environments, access running containers through ECS Exec, and create malicious GitHub workflows in targeted repositories.
  • Attackers cloned repositories and retrieved data from AWS S3 buckets, Secrets Manager, and databases; stolen secrets were also used to access additional victim resources.
Defensive Notes
  • Enable and monitor audit logging across cloud providers and version-control systems, including cloud storage logs and IP logging in GitHub audit logs.
  • Hunt for anomalous VPN use, access from new or unusual Autonomous System Organizations, cloud enumeration and secret-validation API calls, bursts of secret or object retrieval, anomalous ExecuteCommand or SSM execution, mass git.clone activity, and deleted workflow logs.
  • Review the listed network indicators and user agents, including Trufflehog, git/2.43.0, and the specified Boto3/Botocore user agent.

Indicators of compromise

TypeIndicatorContext
IPV4103[.]75[.]11[.]59Listed as a network indicator in connection with the Trivy supply-chain compromise.
IPV4105[.]245[.]181[.]120Observed callback proxy used for TruffleHog secret validation.
IPV4138[.]199[.]15[.]172Observed attacker source used for GitHub exfiltration, malicious workflow pushes, AWS reconnaissance, execution, and exfiltration.
IPV4154[.]47[.]29[.]12Observed attacker source used for secret validation and AWS reconnaissance.
IPV4163[.]245[.]223[.]12Observed attacker source used for GitHub exfiltration.
IPV4170[.]62[.]100[.]245Observed attacker source used for AWS reconnaissance.
IPV4185[.]77[.]218[.]4Observed attacker source used for TruffleHog secret validation.
IPV4193[.]32[.]126[.]157Observed attacker source used for GitHub exfiltration.
IPV4209[.]159[.]147[.]239Observed attacker source used for TruffleHog secret validation.
IPV423[.]234[.]107[.]104Observed attacker source used for TruffleHog secret validation.
IPV434[.]205[.]27[.]48Observed attacker source used for TruffleHog secret validation.

MITRE ATT&CK

T1059.004 · Unix ShellThrough ECS Exec, the actors ran Bash commands directly on running containers.T1059.006 · PythonThrough ECS Exec, the actors ran Python scripts directly on running containers.T1070 · Indicator RemovalAfter malicious GitHub workflows ran, the actors deleted the associated workflow logs, likely to hinder detection.T1078.004 · Cloud AccountsThe group used stolen AWS credentials and Personal Access Tokens to access victim cloud environments and repositories.T1526 · Cloud Service DiscoveryAfter validating stolen credentials, the actors enumerated AWS services, including IAM, EC2, Lambda, RDS, Route 53, ECS, and Secrets Manager.T1619 · Cloud Storage Object DiscoveryThe actors enumerated S3 buckets and retrieved objects from cloud storage.

Threat Actors

TeamPCPGroup tracked by Wiz for supply-chain operations and post-compromise activity involving credential validation, cloud and repository access, and data exfiltration.

Vendors

Aqua SecurityMarch 19 - Trivy: Credential-stealing malware injected into Aqua Security's vulnerability scanner through the binary, GitHub Actions and container images.CheckmarxMarch 23 - KICS: Same malware injected into Checkmarx's IaC scanner, through the GitHub Action and OpenVSX extensions.TelnyxMarch 27 - Telnyx: Malicious versions of the Telnyx Python package were published to PyPI.WizFollowing the recent supply chain attacks targeting the Trivy, KICKS, and LiteLLM projects, the Wiz Customer Incident Response Team (CIRT) and Wiz Research have proactively hunted, notified, and responded to multiple

Products

AWSby making live API calls directly to the respective cloud providers. For example, when verifying an AWS access key, the TruffleHog invokes the sts:GetCallerIdentity API call to confirm whether the compromisedGitHubMarch 19 - Trivy: Credential-stealing malware injected into Aqua Security's vulnerability scanner through the binary, GitHub Actions and container images.KICSMarch 23 - KICS: Same malware injected into Checkmarx's IaC scanner, through the GitHub Action and OpenVSX extensions.KubernetesAll four attacks deployed malware that harvests cloud credentials, SSH keys, Kubernetes configuration files, and CI/CD secrets, encrypting and exfiltrating them to attacker-controlled domains. This blog post details howLiteLLMFollowing the recent supply chain attacks targeting the Trivy, KICKS, and LiteLLM projects, the Wiz Customer Incident Response Team (CIRT) and Wiz Research have proactively hunted, notified, and responded to multipleOpenVSXMarch 23 - KICS: Same malware injected into Checkmarx's IaC scanner, through the GitHub Action and OpenVSX extensions.TrivyFollowing the recent supply chain attacks targeting the Trivy, KICKS, and LiteLLM projects, the Wiz Customer Incident Response Team (CIRT) and Wiz Research have proactively hunted, notified, and responded to multiple

Tools

Nord StreamIn other cases, residual evidence indicated that the malicious workflows were created by the Nord Stream GitHub tool.TruffleHogharvesting operations, the first steps were  validating the stolen secrets using the open-source tool TruffleHog. TruffleHog can automate credential validation by making live API calls directly to the respective

Related Articles