Skip to main content
Mallory
MalwareUsed by 2 actorsExploits 1 CVE

Trivy

Trivy is Aqua Security’s open-source vulnerability scanner that was compromised in a March 19, 2026 supply-chain attack attributed to TeamPCP. High-confidence reporting in the provided content states that the attackers poisoned the Trivy ecosystem by force-pushing malicious tags in aquasecurity/trivy-action and aquasecurity/setup-trivy and publishing a backdoored Trivy binary release, v0.69.4, to official channels including GitHub Releases, Docker Hub, GHCR, ECR, deb/rpm repositories, and get.trivy.dev. Additional malicious Docker Hub images 0.69.5 and 0.69.6 were later reported. The compromised artifacts preserved normal Trivy functionality while executing credential-stealing logic.

The malicious payload harvested secrets from CI/CD runners and developer systems. Reported behavior includes reading GitHub Actions Runner.Worker memory via /proc/<pid>/mem to recover secrets, scanning numerous sensitive filesystem paths for SSH keys, Git credentials, AWS, GCP, and Azure credentials, Kubernetes tokens, Docker registry credentials, Terraform state, database credentials, .env files, shell histories, TLS keys, VPN material, and cryptocurrency wallets, and collecting host information such as environment variables and network interface data. Stolen data was packaged as tpcp.tar.gz, encrypted with AES-256-CBC using an RSA-4096/RSA-OAEP hybrid scheme, and exfiltrated primarily to the typosquatted domain scan.aquasecurtiy.org, which was reported at 45.148.10.212. Additional attacker infrastructure mentioned in the content includes plug-tab-protective-relay.trycloudflare.com. If direct exfiltration failed, the malware could use a stolen GitHub token to create public repositories such as tpcp-docs and upload the archive as a release asset.

On non-CI Linux developer machines, the backdoored Trivy binary reportedly attempted persistence by writing a Python payload under the user’s config/systemd path and creating a systemd user service; related reporting also describes polling the ICP-hosted endpoint tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io for follow-on payloads. The compromise window described in the content was approximately 12 hours for trivy-action, about 4 hours for setup-trivy, and about 3 hours for the malicious Trivy v0.69.4 release.

The incident is associated with TeamPCP, also referenced in the content under aliases including DeadCatx3, PCPcat, and ShellForce. The Trivy compromise is described as the initial credential-harvesting stage of a broader multi-ecosystem campaign that later enabled downstream compromises affecting Checkmarx KICS, LiteLLM, Telnyx, npm packages, and other targets. Reported downstream impact includes ownCloud confirming its build infrastructure was affected by CVE-2026-33634, while stating no customer data or source code was impacted. The content explicitly ties the Trivy compromise to CVE-2026-33634 and notes theft of CI/CD secrets such as npm tokens, Docker Hub credentials, and PyPI publishing tokens.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES
CVE-2026-33634Trivy supply chain compromise via malicious release and retagged GitHub Actions

ownCloud published a security notice confirming their build infrastructure -- the systems producing container images and client binaries -- was affected by CVE-2026-33634 (the Trivy compromise).

via sans iscisc.sans.edu
THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
TeamPCP

On March 19, TeamPCP force-pushed malicious commits over 75 of 76 version tags of aquasecurity/trivy-action and poisoned Trivy release v0.69.4. Any CI/CD pipeline that ran Trivy that day had its secrets harvested and exfiltrated to the attacker.

via mend io blogmend.io
hackerbot-claw

On March 19, 2026, aquasecurity/trivy-action — a widely used GitHub Action for running the Trivy vulnerability scanner — was compromised for approximately 12 hours... a malicious trivy binary release (v0.69.4) was published for approximately 3 hours.

via step security blogstepsecurity.io
MITRE ATT&CK

Techniques & procedures

26 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique
T1595Active ScanningEvidence2

ERA Security Scanner ... nmap, nikto, subfinder, subdomain enumeration, IP reputation, DNS, and mail security analysis ... security-tools-mcp ... nmap, nuclei, sqlmap, nikto, dirsearch, httpx, trivy ... NmapService nmapScan

T1583.001DomainsEvidence1

The v0.69.4 binaries contained malicious code that phones home to a typosquat C2 domain... scan[.]aquasecurtiy[.]org — note the typo ( securtiy vs security ), a typosquat of Aqua Security's domain.

T1584Compromise InfrastructureEvidence1

ownCloud published a security notice confirming their build infrastructure -- the systems producing container images and client binaries -- was affected by CVE-2026-33634 (the Trivy compromise).

Initial Access

6 techniques
T1078Valid AccountsEvidence5

...allowing the hackers to steal its secret API key and use that access to pivot to obtain data stored in the Commission’s AWS account.

T1078.004Cloud AccountsEvidence2

...hackers acquired a secret API key associated with the European Commission’s AWS account... use that access to pivot to obtain data stored in the Commission’s AWS account.

T1195Supply Chain CompromiseEvidence10

Tags and branches are mutable, which means a repo owner can repoint them to a different commit at any time... if the action maintainer's account is compromised, an attacker can repoint that tag to a malicious commit and every downstream workflow picks it up on the next run without a PR or other indication.

T1195.001Compromise Software Dependencies and Development ToolsEvidence3

The attack almost certainly began when a compromised Trivy CI/CD action ran inside LiteLLM’s own build pipeline... TeamPCP then used that token to push malicious releases directly to PyPI.

T1195.002Compromise Software Supply ChainEvidence2

Besides the Trivy breach, TeamPCP has been linked to ransomware attacks and crypto-mining campaigns... The hackers have more recently been behind a systematic campaign of supply chain attacks compromising other open source security projects...

T1195.003Compromise Hardware Supply ChainEvidence1

ownCloud published a security notice confirming their build infrastructure -- the systems producing container images and client binaries -- was affected by CVE-2026-33634 (the Trivy compromise). ownCloud confirms: no customer data compromised, no source code altered, impact limited to build systems only.

Execution

2 techniques
T1059Command and Scripting InterpreterEvidence1
TacticExecution

access AWS environments, execute commands in containers... The attackers validated cloud keys... and used them to access cloud services, enumerate infrastructure, run commands inside containers...

T1574Hijack Execution FlowEvidence2

Using compromised credentials with tag write access, the attacker force-pushed 76 of 77 version tags in aquasecurity/trivy-action and all 7 tags in aquasecurity/setup-trivy, redirecting existing, trusted version references to malicious commits.

Persistence

2 techniques
T1078Valid AccountsEvidence5

...allowing the hackers to steal its secret API key and use that access to pivot to obtain data stored in the Commission’s AWS account.

T1078.004Cloud AccountsEvidence2

...hackers acquired a secret API key associated with the European Commission’s AWS account... use that access to pivot to obtain data stored in the Commission’s AWS account.

T1055Process InjectionEvidence1

Reads GitHub Actions Runner worker memory (on Linux) — decodes a base64 Python script that locates the Runner.Worker process and reads its memory via /proc/<pid>/mem to extract secrets marked isSecret: true.

T1078Valid AccountsEvidence5

...allowing the hackers to steal its secret API key and use that access to pivot to obtain data stored in the Commission’s AWS account.

T1078.004Cloud AccountsEvidence2

...hackers acquired a secret API key associated with the European Commission’s AWS account... use that access to pivot to obtain data stored in the Commission’s AWS account.

Stealth

5 techniques
T1055Process InjectionEvidence1

Reads GitHub Actions Runner worker memory (on Linux) — decodes a base64 Python script that locates the Runner.Worker process and reads its memory via /proc/<pid>/mem to extract secrets marked isSecret: true.

T1070.004File DeletionEvidence1
TacticStealth

After exfiltration, the malware cleaned up all temporary files and launched the legitimate Trivy scan.

T1078Valid AccountsEvidence5

...allowing the hackers to steal its secret API key and use that access to pivot to obtain data stored in the Commission’s AWS account.

T1078.004Cloud AccountsEvidence2

...hackers acquired a secret API key associated with the European Commission’s AWS account... use that access to pivot to obtain data stored in the Commission’s AWS account.

T1574Hijack Execution FlowEvidence2

Using compromised credentials with tag write access, the attacker force-pushed 76 of 77 version tags in aquasecurity/trivy-action and all 7 tags in aquasecurity/setup-trivy, redirecting existing, trusted version references to malicious commits.

Credential Access

5 techniques
T1003OS Credential DumpingEvidence1

It iterated through th e /proc/ directory to isolate the PIDs for the .NET runtime powering the Runner.Worker process. Because the script inherited the runner’s user privileges, it read the /proc/<pid>/mem file descriptor , mapped the memory boundaries via /proc/<pid>/maps, and ran string-matching algorithms across the heap memory segments.

T1528Steal Application Access TokenEvidence2

When the compromised action ran, it harvested LiteLLM’s PyPI publishing token.

T1552Unsecured CredentialsEvidence2

The attacker's script can easily read any of them with an environment lookup like os.environ.get('MY_SECRET') and send them back to an attacker without leaving evidence.

T1555Credentials from Password StoresEvidence1

threat actors used the Trufflehog open source tool to find and validate stolen credentials. Then, TeamPCP performed reconnaissance ... After the organization downloaded a compromised version of Trivy, attackers stole an AWS API key ... From there, they used Trufflehog to discover more AWS credentials

T1649Steal or Forge Authentication CertificatesEvidence3

CERT-EU said that the breach originated on March 19 when hackers acquired a secret API key associated with the European Commission’s AWS account... allowing the hackers to steal its secret API key and use that access to pivot to obtain data stored in the Commission’s AWS account.

Discovery

2 techniques
T1526Cloud Service DiscoveryEvidence2
TacticDiscovery

...use that access to pivot to obtain data stored in the Commission’s AWS account.

T1613Container and Resource DiscoveryEvidence1
TacticDiscovery

using credentials stolen during earlier compromises to access Amazon Web Services (AWS) accounts, execute commands in containers... Reviewing cloud logs for unexpected Amazon Elastic Container Service Exec activity...

Collection

1 technique
T1530Data from Cloud StorageEvidence1

before finally accessing various resources, such as S3 buckets and Amazon Elastic Container Service (ECS) instances, to exfiltrate sensitive data ... and then exfiltrated data from the environment

T1071.001Web ProtocolsEvidence1

HTTPS POST to C2: Stolen data is encrypted (SHA-256 + base64), then sent to an attacker-controlled domain decoded at runtime via the scramble cipher.

T1105Ingress Tool TransferEvidence1

The trivy release automation ( aqua-bot ) published v0.69.4 ... The v0.69.4 binaries contained malicious code that phones home to a typosquat C2 domain.

Exfiltration

3 techniques
T1041Exfiltration Over C2 ChannelEvidence1

The stolen data was then encrypted ... and bundled into a tpcp.tar.gz archive, then exfiltrated via HTTP POST to the typosquatted domain scan.aquasecurtiy[.]org.

T1567Exfiltration Over Web ServiceEvidence1

Fallback exfiltration — if the C2 is unreachable and a GitHub PAT is available, creates a public repository called tpcp-docs on the victim's GitHub account and uploads the stolen data as a release asset.

T1567.002Exfiltration to Cloud StorageEvidence1

execute commands in containers, and exfiltrate sensitive cloud data... Reviewing cloud logs for unexpected Amazon Simple Storage Service access, and Secrets Manager retrievals.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping26

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.