Product

Trivy

0 mentions in 7 days · 6 in 30 days · 7 total · first seen Aug 12, 2026 · last 19d ago

Timeline7 articles

Two alleged TeamPCP members arrested and charged after months of software supply

Australian Federal Police, with FBI support, arrested two alleged TeamPCP members behind supply-chain attacks that compromised over 1,000 organizations.

The AFP charged two Western Australian men, identified by media as Ruben Ian Thomson (21) and Louis Michael Gaebler (23), with 14 combined offences including unauthorized data modification and dealing in criminal proceeds. TeamPCP is blamed for poisoning open-source software releases including Trivy, LiteLLM, and the mini Shai-Hulud worm campaign, exposing over 500,000 credentials and at least 300 GB of data. Victims included the European Commission and GitHub, with remediation costs estimated in the hundreds of millions of dollars. Researchers from Flare traced one suspect through leaked passwords, a GitHub alias, and a Steam profile.

CyberScoopAug 27, 14:32 UTC · 19d agoPolicy & legal1

Two Arrests, One Supply-Chain Attack, and a Lot of Stolen Credentials

AFP charges two men over TeamPCP open-source supply-chain attacks that stole 500,000+ credentials from 1,000+ organizations via four malware families.

Australian police charged two Western Australian men as principal participants in TeamPCP, which allegedly inserted malicious code into open-source software to steal credentials and sensitive data from government, academia, and private sector organizations worldwide. The campaign compromised more than 1,000 organizations, harvested over 500,000 credentials, and exfiltrated at least 300 GB of data, with remediation costs in the hundreds of millions of dollars. Four malware families were deployed: CanisterWorm (cloud token harvesting), SANDCLOCK (AWS and Kubernetes credential theft), Mini Shai-Hulud (self-replicating npm/PyPI worm), and Miasma (credential-harvesting worm variant). Trojanized tools included Trivy, KICS, LiteLLM, and the Telnyx Python SDK, with exfiltration via GitHub repositories tpcp-docs and docs-tpcp.

Security AffairsAug 27, 14:09 UTC · 19d agoThreat actor in the wild1

Australia charges two men for TeamPCP supply

Australia charged two Perth men over TeamPCP supply-chain attacks compromising 1,000+ organizations and exposing 500,000+ credentials.

The AFP charged two Perth-based men with a combined 14 offences for their alleged roles in TeamPCP, with payments in cryptocurrency for data intrusion, identity crime, and money laundering. The group's supply-chain attacks targeted developer tools including TanStack, Trivy, and LiteLLM, with downstream victims including the European Commission and GitHub. Investigators estimate the campaign compromised over 1,000 organizations, exposed more than 500,000 credentials, and led to theft of at least 300 GB of data, with remediation costs in the hundreds of millions of dollars. The men could face a combined 82 years if given maximum sentences, though sentences are typically served concurrently.

The RecordAug 27, 13:00 UTC · 19d agoPolicy & legal

Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks

Australian Federal Police charges two men with 14 offences over TeamPCP supply chain backdoors in Trivy, Checkmarx KICS, and LiteLLM affecting 1,000+ organizations.

The Australian Federal Police charged two Western Australian men, aged 21 and 23, with 14 offences for their alleged principal roles in TeamPCP's March 2026 supply chain attacks; they appeared in Perth Magistrates Court on August 27, 2026. The group stole publishing credentials from trusted open-source projects and pushed poisoned releases across five ecosystems - GitHub Actions, Docker Hub, npm, PyPI, and OpenVSX - with LiteLLM's unpinned Trivy install enabling token theft and backdoored LiteLLM releases. The FBI said the malicious code potentially compromised more than 1,000 organizations, enabled theft of over 500,000 credentials, and exfiltrated at least 300 GB of data. Oligo Security linked the group's infrastructure to activity back to 2020, previously tracked as TA-NATALSTATUS and IronErn.

The Hacker NewsAug 27, 12:04 UTC · 19d agoPolicy & legal in the wild1

Two alleged TeamPCP hackers arrested over global supply chain attacks

AFP and FBI arrested two alleged TeamPCP hackers behind open-source supply chain attacks that stole 500,000+ credentials from 1,000+ organizations.

Australian Federal Police, working with the FBI and Western Australia Police, arrested a 21-year-old from Cottesloe and a 23-year-old from Mandurah on August 26, 2026, over alleged membership in the TeamPCP cybercrime group. The group allegedly planted malicious code in open-source packages, harvesting credentials, authentication tokens and at least 300 GB of data from over 1,000 organizations, with remediation costs estimated in the hundreds of millions of dollars. TeamPCP has been linked to supply chain attacks on GitHub, Telnyx, LiteLLM, Aqua Trivy, Checkmarx KICS, TanStack, MistralAI and Red Hat using a cloned self-replicating worm dubbed Shai-Hulud. Researchers note TeamPCP cloned the Shai-Hulud worm but was not behind the original 2025 attacks.

Help Net SecurityAug 27, 00:00 UTC · 20d agoThreat actor

Google researchers uncover criminal zero-day exploit likely built with AI

Google links a likely LLM-built criminal zero-day for an open-source admin tool to planned mass exploitation and maps AI-assisted threats.

Google Threat Intelligence Group linked a zero-day exploit for a popular open-source web-based administration tool, enabling 2FA bypass with valid credentials via a semantic logic error, to a criminal group, citing educational docstrings, a hallucinated CVSS score, and textbook Python as signs of LLM authorship; the vendor was notified before a planned mass exploitation campaign. The report also details Russia-nexus malware families CANFAIL and LONGSTREAM using AI-generated decoy code, the PROMPTSPY Android backdoor driving the UI through the Gemini API, APT27 using Gemini to build relay tooling, and the TeamPCP (UNC6780) supply chain compromise of LiteLLM and Trivy repositories that planted the SANDCLOCK credential stealer.

Help Net SecurityAug 24, 04:21 UTC · 22d agoThreat actor

Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations

Malicious LiteLLM 1.82.7/1.82.8 PyPI releases tied to the Trivy TeamPCP campaign harvested cloud, SSH, and database credentials, potentially exposing 2,500+ organizations.

CloudSEK reported that two malicious LiteLLM releases on PyPI (versions 1.82.7 and 1.82.8, live about 40 minutes on March 24) harvested cloud keys, SSH keys, Kubernetes tokens, and database passwords, with captured loot files mapping potential exposure to more than 2,500 organizations including NVIDIA, Cisco, Deloitte, Volkswagen, FedEx, Siemens, and X Corp. The campaign is part of TeamPCP (tracked by Google as UNC6780), linked to the Aqua Security Trivy scanner compromise tracked as CVE-2026-33634 and added to CISA's Known Exploited Vulnerabilities catalog on March 26. The payload used a litellm_init.pth file executed at Python interpreter startup and exfiltrated secrets to models.litellm[.]cloud; the FBI's FLASH-20260702-01 advisory urged rotation of CI/CD, publishing, and cloud credentials.

The Hacker NewsAug 12, 08:05 UTC · Aug 12, 2026Data breach in the wildCVE-2026-33634

Related CVEsby mentions

CVE-2026-336349.459%
Embedded Malicious Code in Aquasecurity Trivy, trivy-action, and setup-trivy Releases
CVE-2026-33634 is an embedded malicious code (supply chain) vulnerability in which a threat actor using compromised Aquasecurity credentials published a backdoored Trivy v0.69.4 release on March 19, 2026, force-pushed 76 of 77 version tags in the aquasecurity/trivy-action GitHub Action to credential-stealing malware, and replaced all 7 tags in aquasecurity/setup-trivy with malicious commits. The malicious code executes when CI/CD pipelines pull or run the affected Trivy Go module/container image or when workflows resolve the compromised mutable version tags, including runs on March 19-20, 2026 that referenced tags instead of pinned commit SHAs. An attacker gains code execution in developer CI environments and can steal secrets (cloud, registry, and other credentials accessible to affected pipelines), with a repository named 'tpcp-docs' appearing in an organization indicating the fallback exfiltration mechanism fired and secrets were taken. Anyone who pulled or executed Trivy 0.69.4 or referenced affected trivy-action (0.0.1-0.34.2) or setup-trivy (0.2.0-0.2.6) tags is affected, and related malicious LiteLLM releases tied to the same campaign may have exposed 2,100+ organizations. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on March 26, 2026, EPSS estimates a 59.2% probability of exploitation within 30 days, and the FBI reports the TeamPCP actor compromised developer tools to steal cloud credentials.
· Aquasecurity (Aquasec) Trivy (Go module / container image) 0.69.4 (known safe: 0.69.2 and 0.69.3) · Aquasecurity (Aquasec) trivy-action (GitHub Action) 0.0.1 through 0.34.2 (76 of 77 tags force-pushed with malicious commits; known safe: 0.35.0) KEV PoC ×2large

Appears with

threat actor TeamPCP 7 product LiteLLM 6 organization FBI 6 organization Australian Federal Police 4 organization Western Australia Police Force 3 vendor Aqua Security 3 vendor Oligo Security 2 product TanStack 2 victim European Commission 2 threat actor UNC6780 2 malware SANDCLOCK 2 malware mini Shai-Hulud 2 organization CloudSEK 2 vendor CloudSEK 2 product KICS 2 victim GitHub 2

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.