Recent investigations by SOCRadar reveal that the compromise of over 2,500 organizations, initially attributed to a LiteLLM supply chain attack, actually stemmed from a previous breach involving the Trivy scanner. This clarification shifts the focus from LiteLLM to Trivy, a product of Aqua Security, highlighting the complexities of software supply chain vulnerabilities.
The Role of Trivy in the Attack
The breach, orchestrated by the threat group TeamPCP, involved malicious code that spread through the Trivy scanner, impacting numerous downstream packages and repositories. This ripple effect was intensified by the malware’s worm-like characteristics, which enabled automatic inclusion of harmful libraries across multiple builds. Reports from CloudSEK and HudsonRock earlier this week pointed to LiteLLM as the cause, but SOCRadar’s findings suggest otherwise.
TeamPCP’s attack pattern was consistent: once an infected package was accessed, malicious code executed automatically, harvesting sensitive data such as credentials, tokens, and API keys. The attackers used this stolen information to manipulate accessible packages and spread malicious versions, thus broadening the attack’s reach.
Timeline of the Compromise
SOCRadar’s detailed analysis of the LiteLLM incident data uncovered records for 2,188 affected entities, documenting timestamps, credential types, CI/CD platforms, and domains. The breach timeline spanned from March 19 at 18:05 UTC to March 24 at 20:09 UTC. Crucially, 95% of the compromised organizations ceased data collection before the malicious LiteLLM packages were registered, aligning more closely with the Trivy breach timeline.
The malicious Trivy build first surfaced on March 19, with a surge in activity occurring on March 22 and 23 when compromised Trivy images were accessible on Docker Hub. The incident concluded on March 24 following PyPI’s quarantine of the affected packages. This persistence indicates how the .pth payload continued to operate on already-infected systems even after the initial infection source was removed.
Impact on Organizations Worldwide
The breach affected six major CI/CD platforms, including GitHub Actions, GitLab CI, Jenkins, Bitbucket, CircleCI, and Buildkite, with significant impacts noted in Germany, Brazil, and France. The malware targeted a wide array of secrets, with over 1,000 organizations inadvertently exposing JWT and authentication tokens. Additionally, hundreds of entities revealed private keys, AWS access keys, GitLab tokens, OpenAI API keys, Slack webhooks, and Google API keys.
SOCRadar reported that committer email addresses were compromised across more than 1,100 organizations, giving attackers access to both developer identities and machine tokens. Of the 2,188 organizations analyzed, 56% were rated high confidence in exposure, 39% medium, and 6% low, reflecting the challenge in attributing precise impacts to specific entities.
Currently, some of the stolen data is being traded on platforms like Telegram. This includes collections of data associated with LiteLLM, Trivy, and CanisterWorm, likely gathered at various stages of the attack campaign. The incident underscores the ongoing threat posed by supply chain attacks and the importance of robust cybersecurity measures to protect against such vulnerabilities.
