TeamPCP Supply Chain Campaign

How did they gain access to push the malicious v0.69.4 tag?

The attacker was able to push a tag to aquasecurity/trivy pointing to a malicious commit. This requires write access to the repository. Was this via a compromised PAT, GitHub App, or deploy key?

Resolution: Aqua Security confirmed the attack stemmed from incomplete containment of the March 1, 2026 incident. Credential rotation "wasn't atomic and attackers may have been privy to refreshed tokens."

Was aqua-bot the initial access vector, or only compromised via /trivy?

The aqua-bot service account was used for lateral movement to tfsec, traceeshark, and trivy-action. However, it's unclear whether aqua-bot credentials were the initial compromise, or if they were harvested from the trivy repository's secrets after the v0.69.4 tag push triggered workflows.

Resolution: The official disclosure confirms incomplete credential rotation from the first incident allowed attackers to capture refreshed tokens, including aqua-bot credentials.

What was the v0.70.0 trivy attacker tag?

At 17:51:17 UTC on March 19, a v0.70.0 tag was deleted. The commit (9dbb34d3ec0f) was authored by aqua-bot on March 16 — 3 days earlier — with message "Updates", modifying cmd/trivy/main.go, pkg/github/auth.go, pkg/github/repowrite.go, pkg/github/runner.go. This suggests aqua-bot compromise may predate March 19.

What was the setup-trivy poisoning?

All 7 tags (v0.2.0-v0.2.6) were force-pushed to malicious commits. Commit 8afa9b9f spoofed contributor "thara" (Tomochika Hara). Message: "Pin Trivy install script checkout to a specific commit (#28)". Spoofed date: 2026-01-15. Exposure window: ~4 hours (17:43-21:44 UTC Mar 19).

Is DarkSeek3r related?

A GitHub user "DarkSeek3r" (user ID 266895321) was created at 2026-03-10T01:44:23. Their only public activity was forking aquasecurity/trivy and actions/checkout — the exact repositories used in this attack. Update: Account renamed to octocommit on Mar 10 — still active, not deleted.

TeamPCP

Also known as PCPcat, Persy_PCP, ShellForce, CipherForce, and DeadCatx3. Emerged as a significant threat to cloud-native infrastructure in late 2025.

Self-attribution string "TeamPCP Cloud stealer" found in the trivy-action payload links this incident to the group.

Telegram: @Persy_PCP, @teampcp

Cloud-Native Infrastructure

Common Techniques

"hackerbot-claw compromised Trivy"

Reality: hackerbot-claw is an automated penetration testing bot that scans GitHub for vulnerable projects—its user agent and behavioral patterns differ from the main attacker. MegaGame10418 is the actor who exploited the February 27 PwnRequest, exfiltrating the aqua-bot PAT. Aqua's official post-mortem confirms: "The user agent and behavioral patterns of hackerbot-claw are different than the other events inspected."

"Malicious commits landed in Trivy's main branch"

Reality: The imposter commits (1885610c, 70379aad) never merged into main. They exist in GitHub's object store due to cross-fork object sharing. The attack worked because a malicious tag (v0.69.4) was pushed that referenced these orphan commits—triggering CI/CD builds without any merge or review.

"GhostClaw is related to TeamPCP"

Reality: GhostClaw is a separate campaign with different TTPs and IOCs. TeamPCP uses tag hijacking and CI/CD exploitation; GhostClaw uses npm typosquatting and AI workflow hooks. Different infrastructure (registrars, C2 patterns), more social engineering-focused payloads (fake CLI installers with progress bars), and different persistence mechanisms (shell hooks, cron jobs vs. GitHub Actions). No shared IOCs or attribution overlap identified.