The Trivy Supply Chain Attack Just Hit Cisco. ShinyHunters Stole 300 GitHub Repos, 3 Million Salesforce Records, and AWS Data. Government Personnel Records Are in the Breach.

The Full Chain: From Trivy to Cisco

This story started on March 19 when TeamPCP compromised Aqua Security's Trivy vulnerability scanner. We covered that attack in detail on March 25. The key insight was that Trivy runs in CI/CD pipelines with broad access to secrets, credentials, and environment variables. When TeamPCP injected their credential stealer into Trivy's GitHub Actions, every organization that ran Trivy during the compromise window had their CI/CD secrets harvested and exfiltrated.

Cisco was one of those organizations. Cisco's internal development environment used Trivy as part of its build process. When the compromised Trivy action executed in Cisco's CI/CD pipeline, it harvested credentials from the runner environment, including AWS access keys and tokens with access to Cisco's internal infrastructure.

Using those stolen credentials, the attackers bypassed Cisco's authentication controls and gained access to its internal build environments. Once inside, they compromised dozens of devices including lab workstations and developer systems. From those systems, they cloned over 300 private GitHub repositories. BleepingComputer reported that the stolen repositories include source code for Cisco's AI Assistant, AI Defense, and other unreleased AI products. Some repositories allegedly belong to corporate customers, including banks, business process outsourcing companies, and US government agencies.

The AWS keys were used to perform unauthorized operations inside Cisco's cloud accounts. ShinyHunters posted screenshots showing the AWS EC2 Volumes console with dozens of virtual storage drives and an S3 bucket listing. Some drive creation dates fall on March 16-17, 2026, indicating the access may have begun even before the Trivy compromise was publicly detected.

The Salesforce Exposure

ShinyHunters claims the breach extends beyond the development environment. They report over 3 million Salesforce CRM records containing personally identifiable information were exfiltrated. The data reportedly came through three separate access paths: a voice phishing (vishing) attack attributed to UNC6040 (which Cisco previously disclosed last summer), exploitation of Salesforce Aura (Experience Cloud) guest user access controls, and the AWS account compromise.

The Salesforce angle is the most consequential for downstream impact. Resecurity's threat intelligence analysis reports that the stolen Salesforce data includes records tied to personnel from the FBI, DHS, DISA, IRS, NASA, the Australian Ministry of Defense, and multiple Indian government agencies. These records are likely associated with procurement, configuration, and support interactions for Cisco networking products used by those agencies.

This data is exceptionally valuable for adversaries planning targeted phishing, social engineering, or supply chain attacks against government personnel. Names, email addresses, phone numbers, and account metadata for government IT personnel who manage Cisco infrastructure provide a ready-made target list for follow-on operations. The exposure is not limited to Cisco. It extends to every government agency whose personnel data sits in Cisco's Salesforce instance.

The Adversary Perspective

The convergence of ShinyHunters and TeamPCP represents a new operational model in cybercrime. TeamPCP provides the initial access through supply chain compromise. ShinyHunters provides the extortion and monetization capability. Together, they cover the full attack lifecycle from supply chain exploitation through data theft to ransom negotiation.

The Trivy-to-Cisco chain validates the cascading credential theft model. TeamPCP did not target Cisco directly. They targeted a security tool that Cisco used. The credential harvester in the compromised Trivy action collected everything accessible from CI/CD runner memory. One of those credentials happened to unlock Cisco's internal infrastructure. This is not targeted exploitation. It is credential harvesting at scale with downstream exploitation of whatever the credentials unlock. The attacker does not need to know who uses Trivy. They just need to steal everything and sort through the results.

The multi-vector approach makes verification and response difficult. ShinyHunters claims three separate breach vectors: vishing, Salesforce Aura, and AWS. One of these (the vishing attack) was already disclosed by Cisco last summer. The Salesforce Aura exploitation may represent a broader campaign: ShinyHunters reportedly exploited misconfigured Salesforce Experience Cloud guest user access at 300 to 400 organizations using an open-source tool called AuraInspector. The AWS compromise is linked to the Trivy supply chain attack. Defenders are not responding to one incident. They are responding to three overlapping incidents with different timelines, different entry points, and different data exposure profiles.

The source code theft creates long-term strategic risk. Stolen source code for unreleased AI products gives competitors and nation-state actors insight into Cisco's product roadmap, architectural decisions, and potential vulnerabilities before the products ship. If the AI Defense source code contains the security logic for Cisco's AI-era security products, adversaries can study it for bypass techniques before the product reaches market. This is not a data breach that can be resolved with credit monitoring. It is an intellectual property loss with multi-year competitive implications.

Defensive Takeaways