GoKawiilIt has been a bad six weeks for security firm Checmarx. Over the past 40 days, it has been the victim of at least one supply-chain attack that delivered malware to customers on two separate occasions. Now it has been hit by a ransomware attack from prolific fame-seeking hackers.
The streak of misfortunes started on March 19, with the supply-chain attack of Trivy, a widely used vulnerability scanner. The attackers behind the breach first breached the Trivy GitHub account and then used their access to push malware to Trivy users, one of which was Checkmarx. The pushed malware scoured infected machines for repository tokens, SSH keys, and other credentials.
Both a target and delivery mechanism
Four days later, Checkmarx’s GitHub account was compromised and began pushing malware to the security firm’s users. The company contained and remediated the breach and replaced the malware with the legitimate apps. Or so Checkmarx thought.
On April 22, the company’s GitHub account pushed a new wave of malware, suggesting either that the previous breach hadn’t been fully fixed or that a new, unidentified hack had occurred. The company once again worked to boot the attackers out of the account. According to security firm Socket, the official Checkmarx/kics Docker Hub repo also published malicious packages around the same time.
On Monday, Checkmarx disclosed there was another chapter to the saga. The company said that a ransomware group tracked as Lapsu$ last week dumped a tranche of private data onto the dark web. The date stamp of the dumped material was March 30. Based on the date stamp, it appears that the attackers maintained their access to the GitHub account following Checkmarx’s March 23 discovery of the compromise, and attempts to drive them out failed.