TeamPCP Compromises Checkmarx Jenkins AST Plugin Weeks After KICS Supply Chain Attack

Checkmarx identified a malicious version of its Jenkins AST plugin published to the Jenkins Marketplace.

• •Users should update from compromised versions to 2.0.13-848.v76e89de8a_053 released after the incident
• •TeamPCP orchestrated this second attack on Checkmarx within weeks of compromising KICS Docker image and VS Code extensions
• •The attacker gained repository access and renamed the GitHub repository with a defaced message claiming credential theft
• •Security analysis suggests either incomplete initial remediation or the group retained a persistent backdoor for re-entry

This summary was automatically generated by AI based on the original article and may not be fully accurate.