Supply Chain Attacks Hit Checkmarx and Bitwarden in Recent Incidents

Summary: Security company Checkmarx has been the victim of multiple supply chain attacks, including the corruption of Trivy and its own GitHub repository, resulting in the delivery of malware to clients.

These events underscore the critical vulnerability of security tools themselves, showing how attackers can exploit multiple vectors to impact the industry.

\n\n

Furthermore, Checkmarx revealed that a ransomware group known as Lapsu$ had leaked private data on the dark web. This data, dated March 30, indicated that the attackers maintained access to the company's GitHub repositories after the initial detection of the compromise.

\n\n

Additionally, it was reported that Checkmarx's Docker Hub repository also published malicious packages at a similar time.

\n\n

Subsequently, Checkmarx's GitHub account was compromised, leading to the distribution of new waves of malware to the security firm's users. Despite containment efforts, the malicious access persisted, suggesting failures in initial remediation.

\n\n

These incidents began on March 19 with the vulnerability of Trivy, a popular vulnerability scanner. Attackers accessed Trivy's GitHub and used that access to distribute malware to its users, including Checkmarx.

\n\n

The security company Checkmarx has faced a difficult period, enduring multiple supply chain attacks within a 40-day span.

Key facts

  • Checkmarx suffered at least one supply chain attack in 40 days.
  • The first incident began with the vulnerability of Trivy on March 19.
  • Attackers compromised Checkmarx's GitHub account multiple times.
  • A ransomware group called Lapsu$ leaked Checkmarx data on the dark web.

Why it matters

These supply chain attacks are particularly alarming because they target the very tools that are supposed to protect companies. They reveal that even security firms are high-value targets, demanding an urgent reassessment of security in software dependencies and code repositories.