One Compromised Vulnerability Scanner

TL;DR

CERT-EU confirmed today that TeamPCP's Trivy supply chain compromise (CVE-2026-33634) was the initial access vector for the European Commission cloud breach. The attackers used a stolen AWS API key with management rights to access the Commission's Amazon cloud infrastructure. They created a new access key on an existing user to evade detection, used TruffleHog to scan for additional secrets, and exfiltrated approximately 340GB of data (91.7GB compressed). The stolen data includes personal information from 71 clients of the Europa web hosting service: 42 European Commission internal clients and 29 other EU entities. Potentially affected institutions include the European Parliament, Council of the European Union, and the European External Action Service. ShinyHunters published the complete dataset on March 28. The dataset contains names, email addresses, usernames, and 51,992 outbound email files. CERT-EU found no evidence of lateral movement to other Commission AWS accounts.

The takeaway

Palo Alto Networks Unit 42 estimates at least 1,000 SaaS environments were affected by the broader Trivy compromise.

340GB

Data Exfiltrated

Clients Affected

EU Entities

1000+

SaaS Envs Hit

The Complete Chain: March 19 to April 3

We have covered every link in this chain as it developed. Today, with CERT-EU's advisory, the full picture is documented by an official EU cybersecurity body. Here is the complete timeline.

March 19: TeamPCP compromises Aqua Security's Trivy vulnerability scanner. Malicious code injected into 76 of 77 version tags in trivy-action. Every CI/CD pipeline that pulls Trivy during the compromise window has its secrets harvested. AWS credentials, Kubernetes tokens, SSH keys, Docker registry credentials, database passwords, and cryptocurrency wallets are all targeted.

March 19 (same day): The European Commission's CI/CD environment pulls the compromised Trivy version. An AWS API key with management rights over other Commission AWS accounts is stolen. TeamPCP begins reconnaissance on the Commission's cloud infrastructure.

March 23: TeamPCP uses stolen Trivy credentials to compromise Checkmarx KICS and two Open VSX extensions. The chain expands to a second security scanner vendor.

March 24: TeamPCP uses Trivy-harvested PyPI credentials to backdoor LiteLLM (97M monthly downloads). Telnyx Python SDK also compromised with steganographic WAV file payload. Commission's cybersecurity operations center finally detects suspicious AWS API activity on March 24, five days after initial access.

March 25: CERT-EU notified by the Commission. Atarus Research publishes initial TeamPCP supply chain analysis.

March 28: ShinyHunters publishes the full European Commission dataset (340GB) on their dark web leak site.

March 31: ShinyHunters posts extortion demands against Cisco with April 3 deadline. Stolen data includes 300+ GitHub repos, 3M Salesforce records, and AWS infrastructure data. Separately, North Korea's UNC1069 compromises Axios (100M weekly downloads) using the WAVESHAPER.V2 backdoor.

April 3 (today): CERT-EU publishes official advisory attributing the Commission breach to TeamPCP via Trivy with "high confidence." Cisco's extortion deadline arrives. The Trivy compromise is now estimated to have affected at least 1,000 SaaS environments globally.

What CERT-EU Confirmed

CERT-EU's advisory provides the authoritative account of how the Commission was breached. The attackers used the stolen AWS API key to create and attach a new access key to an existing user, a technique designed to evade detection by avoiding the creation of new users that would trigger identity alerts. They then used TruffleHog, an open source secret scanning tool, to search for additional credentials and validated AWS access by calling the Security Token Service (STS). This operational pattern matches the TeamPCP modus operandi documented by Wiz researchers across multiple victims.

The exfiltrated data spans 71 clients of the Europa.eu web hosting service. The 29 EU entities beyond the Commission's own 42 internal clients have not been named, but TechRadar reports that potentially affected institutions include the European Parliament, Council of the European Union, and the European External Action Service. Other agencies in scope could include the European Medicines Agency, European Banking Authority, ENISA, and Frontex.

Analysis of the leaked dataset confirmed 51,992 files related to outbound email communications (2.22GB total). CERT-EU notes that while most of these are automated notifications, "bounce-back" messages frequently contain the original user-submitted content, creating a significant risk of deeper personal data exposure. The dataset also contains names, last names, usernames, and email addresses from users across multiple EU entities.

CERT-EU found no evidence that the attackers moved laterally to other Commission AWS accounts, despite possessing management rights that would have enabled such movement. This suggests either the attackers chose to focus on the data exfiltration objective rather than expanding access, or that their lateral movement was interrupted by the detection on March 24.

The Scale Is Now Clear

CSO Online calls the Trivy compromise "one of the most consequential supply-chain incidents of recent times" and reports estimates of at least 1,000 SaaS environments affected. Palo Alto Networks Unit 42 describes TeamPCP's campaign as a systematic targeting of open source security projects, noting that by compromising developers with keys to sensitive systems, "they then have the ability to hold compromised organizations for ransom."

The confirmed high-profile victims now include: Cisco (300+ repos, 3M Salesforce records, AWS data), the European Commission (340GB, 71 clients, 29 EU entities), Checkmarx (KICS scanner, Open VSX extensions), LiteLLM (97M monthly downloads, entire package quarantined on PyPI), and Telnyx (Python SDK backdoored with WAV steganography). The number of victims is expected to grow as organizations continue to audit their environments.

CSO Online also raises a strategic concern: the fact that stolen data was handed to ShinyHunters, a major extortion group, suggests TeamPCP may be operating as an initial access broker that sells data and network access to the highest bidder. If so, affected organizations should expect a wave of extortion demands in the coming weeks, not just from ShinyHunters but from any group that purchases access from TeamPCP's inventory.

Defensive Takeaways

1
Follow CERT-EU's Published Remediation Guidance
CERT-EU's advisory includes specific remediation steps: update Trivy to a known-safe version across all environments, audit and rotate all AWS credentials accessible from CI/CD pipelines, deactivate unused or over-privileged keys, enable and review AWS CloudTrail for anomalous STS calls and TruffleHog usage, and restrict CI/CD pipeline access to cloud credentials with minimum required permissions. Implement AWS Service Control Policies (SCPs) to restrict sensitive API actions at the organization level. These steps apply to every organization that used Trivy, not just EU institutions.
2
Search CI/CD Logs for TeamPCP Exfiltration Artifacts
CERT-EU specifically recommends searching CI/CD logs for connections to typosquatted domains (scan.aquasecurtiy[.]org, checkmarx[.]zone, models.litellm[.]cloud), unexpected Cloudflare tunnel activity, creation of tpcp-docs or docs-tpcp GitHub repositories, and references to tpcp.tar.gz. If any of these artifacts are present, your environment was compromised during the Trivy attack window and your credentials should be treated as stolen.
3
Prepare for Secondary Extortion
The TeamPCP-to-ShinyHunters handoff suggests an initial access broker model. If your organization's credentials were harvested during the Trivy compromise, those credentials may have been sold or shared with multiple threat groups. Even if you have not received a direct extortion demand, your data may appear in future leak site posts or be used for targeted attacks. Monitor dark web leak sites for your organization's data. Engage a threat intelligence provider to track whether your credentials appear in TeamPCP or ShinyHunters inventories.
4
Implement Pipeline Integrity Controls Now
The Trivy compromise worked because CI/CD pipelines trust the tools they run. Pin all Actions to commit SHAs. Use --ignore-scripts for npm installs in CI. Implement network egress controls on CI runners that restrict outbound connections to an allowlist. Monitor for unexpected outbound traffic from build environments. Every credential accessible from a CI/CD runner is a credential an attacker will steal if the pipeline is compromised. Scope those credentials to the minimum required permissions and use short-lived tokens instead of long-lived keys.
5
This Is Not Over
Palo Alto Networks estimates 1,000+ SaaS environments were compromised in the Trivy supply chain attack. Cisco and the European Commission are the highest-profile confirmed victims, but they are not the only ones. CSO Online reports that "the number of victims is likely to grow in the coming weeks." If your organization runs Trivy, uses AWS in CI/CD, or consumes any of the downstream packages compromised by TeamPCP (LiteLLM, Telnyx, Checkmarx KICS), audit your environments now. The attackers have had two weeks with stolen credentials. The window for pre-emptive credential rotation is closing. After it closes, the remediation becomes incident response.

Atarus Assessment

On March 25, we published our first analysis of TeamPCP's supply chain cascade and wrote: "This campaign is almost certainly not over. TeamPCP has demonstrated a consistent pattern: each compromised environment yields credentials that unlock the next target." Nine days later, that assessment has been validated at a scale none of us anticipated. One vulnerability scanner, compromised on March 19, has now breached Cisco (Fortune 500, AI source code, government customer data), the European Commission (340GB, 71 clients, data from the institutions that govern 450 million people), and an estimated 1,000+ additional SaaS environments. ShinyHunters is monetizing the stolen data. TeamPCP may be brokering access to additional buyers. North Korea separately exploited the same ecosystem trust model to backdoor Axios. The open source supply chain did not just have a bad month. It had a structural failure. The implicit trust model that allows a single compromised tool to cascade into a continental data breach is not a bug in any one product. It is a design property of how the entire ecosystem works. Until that changes, the next Trivy is not a question of if. It is a question of when, and whether the next target will be your organization or the one you depend on.