TeamPCP Is Systematically Targeting Security Tools Across the OSS Ecosystem

Key Takeaways

• TeamPCP is systematically targeting open-source security tools and developer infrastructure, including Trivy, Checkmarx' KICS, OpenVSX extensions, and LiteLLM.
• The campaign specifically targets CI/CD pipelines and GitHub Actions to turn trusted security scanners into infostealers.
• Threat actors claim to have exfiltrated approximately 300 GB of compressed credentials, with 500,000 stolen credentials attributed to the LiteLLM compromise alone.
• There is an unconfirmed but speculated connection between TeamPCP and the LAPSUS$ threat group, supported by recent Telegram posts.
• The attacks highlight a critical vulnerability in the software supply chain where autonomous, self-propagating OSS registry attacks follow initial CI/CD compromises.

Affected Systems

• CI/CD Pipelines
• GitHub Actions
• Trivy vulnerability scanner
• Checkmarx' KICS scanner
• OpenVSX extensions
• LiteLLM (PyPI package)
• npm packages

Attack Chain

TeamPCP compromises open-source security tools and developer infrastructure, such as Trivy, Checkmarx' KICS, and PyPI packages like LiteLLM. These compromised tools are then executed within victim CI/CD pipelines, specifically via GitHub Actions. Once running inside the pipeline, the malicious code acts as an infostealer, harvesting secrets, credentials, and infrastructure data. The stolen data is then exfiltrated to the attackers, enabling further downstream supply chain attacks and extortion.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

No specific detection rules or queries are provided in the article.

Detection Engineering Assessment

EDR Visibility: Low — EDRs typically have limited visibility into ephemeral CI/CD pipeline runners like GitHub Actions unless specifically instrumented. Network Visibility: Medium — Outbound connections from CI/CD runners to unknown or untrusted IPs for data exfiltration could be detected with proper network monitoring. Detection Difficulty: Hard — Malicious activity is blended with legitimate security scanning tools inside ephemeral CI/CD environments, making it difficult to distinguish from normal operations.

Required Log Sources

• CI/CD Pipeline Logs
• GitHub Audit Logs
• Container runtime logs
• Network flow logs from CI/CD environments

Hunting Hypotheses

Hypothesis	Telemetry	ATT&CK Stage	FP Risk
Look for unexpected outbound network connections originating from CI/CD runners executing security scanners like Trivy or KICS.	Network flow logs, DNS logs	Exfiltration	Medium
Monitor for unauthorized access or anomalous usage of secrets and credentials recently exposed to CI/CD pipelines.	Cloud Audit Logs, IAM logs	Credential Access	Low

Control Gaps

• Lack of continuous monitoring in CI/CD workflows
• Implicit trust in open-source security tools
• Unrestricted outbound network access from CI/CD runners

Key Behavioral Indicators

• Anomalous outbound data transfers from CI/CD environments
• Unexpected modifications to GitHub Actions workflows or tags

False Positive Assessment

• Low

Recommendations

Immediate Mitigation

• Audit CI/CD pipelines for compromised versions of Trivy, Checkmarx KICS, OpenVSX extensions, and LiteLLM.
• Rotate any secrets, API keys, or credentials that were exposed to potentially compromised CI/CD runners.

Infrastructure Hardening

• Implement egress network filtering on CI/CD runners to prevent unauthorized data exfiltration.
• Pin GitHub Actions and OSS dependencies to specific, verified commit hashes rather than mutable tags.

User Protection

• Enforce least privilege access for CI/CD service accounts and tokens.

Security Awareness

• Educate development and security teams on the risks of supply chain attacks targeting security tools.
• Monitor canonical advisory discussions and threat intelligence for updates on affected OSS versions.

MITRE ATT&CK Mapping

• T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools
• T1552.007 - Credentials in Files: Container Images
• T1528 - Steal Application Access Token
• T1048 - Exfiltration Over Alternative Protocol

Additional IOCs

• Urls:
  • hxxps://t[.]me/team_pcp - Telegram channel associated with the TeamPCP threat actor