Trivy Hack: Millions of credentials from thousands of companies leaked
A hack at Trivy and LiteLLM affected more companies than expected: Data from companies and software services has been leaked and can be misused.
Already in spring, hackers seized numerous datasets from various companies during an attack on several software projects. Now it turns out: the hack is much larger than initially thought. The hacker group, calling itself "TeamPCP", obtained data from at least a thousand cloud services. An expert from the cybersecurity firm Mandiant reports that he expects "another 10,000 victims".
How the attack unfolded
The hack occurred through a manipulated software chain – including the AI service LiteLLM. The scanning tool Trivy, which was actually supposed to highlight security vulnerabilities and weaknesses, was cracked and compromised with malware. Later, the developers of the open-source project "Lite LLM" used precisely the infected Trivy version in their own build pipeline. This allowed "Team PCP" to obtain secret tokens and thus inject the manipulated LiteLLM versions into "PyPI", the official online directory for Python-based software packages and libraries. Although this was discovered after only about 40 minutes, the damage was done. A large number of companies contracted the malicious code, and "TeamPCP" obtained access data to clouds, AI platforms, SSH servers, and more. They also gained access to keys and tokens for the security environment of corporate networks. Technical details can be found on Github and Endorlabs.
What could happen to me?
It is possible that the huge amount of data also contains access data for services you use. The security firms CloudSEK and Hudson Rock have now investigated the loot. 153 gigabytes in size with around half a million datasets – all containing access data and other personal information from around 2500 companies worldwide. These include Amazon, Samsung, Adobe, Epic Games, Ubisoft, Ebay, HP, Nvidia, Microsoft, Cisco, IBM, Intel, SAP, Salesforce, Siemens, Airbus, John Deere, Bosch, Volkswagen, BMW, Mercedes-Benz, Deutsche Bahn, and others. A large sample by independent experts shows that the data is real and some of it still works today.
What do I do now?
If your company is on the list of Hudson Rock or CloudSEK, you should inform the responsible department. If you are a customer of one of these companies, your customer data may have been leaked. Therefore, be aware of phishing attempts that seem tailored to you. Change the passwords of affected accounts and continue to use two-factor authentication or passkeys.
I've been tinkering with digital networks ever since I found out how to activate both telephone channels on the ISDN card for greater bandwidth. As for the analogue variety, I've been doing that since I learned to talk. Though Winterthur is my adoptive home city, my heart still bleeds red and blue.
From the latest iPhone to the return of 80s fashion. The editorial team will help you make sense of it all.
Show all
