Security Firm Hit by Ransomware After Supply Chain Attacks

Security firm Checkmarx has recently experienced a severe security lapse, enduring multiple cyber incidents over the past six weeks. The breaches began on March 19 with a supply chain attack on Trivy, a vulnerability scanner. Attackers gained access to Trivy's GitHub account and distributed malware, which Checkmarx later received. This malware aimed to steal sensitive credentials from infected systems.

Following the Trivy incident, Checkmarx's own GitHub account was compromised on March 23, leading to the distribution of malware to its users. Although Checkmarx believed the issue was resolved, a subsequent malicious package was pushed on April 22, indicating persistent unauthorized access or a new intrusion. This event also saw malicious packages published on the official Checkmarx/kics Docker Hub repository.

The situation escalated further when a ransomware group known as Lapsu$ leaked a significant amount of Checkmarx's private data on the dark web around March 30. Evidence suggests this data originated from Checkmarx's GitHub repositories, accessed through the initial supply chain attack. The stolen data included information gathered after March 23, indicating that the attackers maintained access despite remediation efforts.

Checkmarx is not the sole victim; security firm Bitwarden was also affected by the same Trivy supply chain attack, sharing similar malicious infrastructure. The attacks highlight a concerning trend where security tools are exploited as both targets and delivery mechanisms for further compromises. Attackers are actively targeting these products due to their privileged access and widespread use within the software development ecosystem, leading to cascading effects on customers and partners.