Trivy Hack Spreads Infostealer via Docker, Triggers Worm and Kubernetes Wiper

This article covers a supply chain attack on Trivy, an open-source vulnerability scanner by Aqua Security, leading to widespread compromise across developer environments.

• •Malicious Docker Hub image versions 0.69.4, 0.69.5, and 0.69.6 were pushed by threat actor TeamPCP, containing the TeamPCP infostealer credential harvester
• •Stolen credentials were used to compromise dozens of npm packages and distribute a self-propagating worm called CanisterWorm
• •All 44 internal GitHub repositories of Aqua Security's 'aquasec-com' org were defaced in a scripted 2-minute burst using a compromised 'Argon-DevOps-Mgt' service account token
• •A new wiper malware targets Kubernetes clusters in Iran, deploying privileged DaemonSets and wiping nodes via a container named 'kamikaze', while installing CanisterWorm backdoor on non-Iranian nodes