Analyzing TeamPCP’s Supply Chain Attacks: Checkmarx KICS and elementary-data in CI/CD Credential Theft

MITRE Techniques

• [T1195.002] Supply Chain Compromise: Compromise Software Supply Chain – The actor poisoned trusted distribution channels and release workflows across Docker Hub, VS Code/OpenVSX, PyPI, GHCR, and GitHub Actions (‘Poisoned Docker Hub images, VS Code extensions, PyPI packages, and GitHub Actions across both incidents’).
• [T1078] Valid Accounts – Stolen publisher credentials were used to republish compromised artifacts in the KICS case (‘stolen publisher credentials used for Docker Hub, VS Code, and GitHub Action republish’).
• [T1199] Trusted Relationship – GitHub Actions runner trust was abused through pull request comment injection in elementary-data (‘GitHub Actions runner token abused through PR comment script injection’).
• [T1059.007] Command and Scripting Interpreter: JavaScript – The KICS payload executed JavaScript via the Bun runtime on the victim system (‘mcpAddon.js executed via Bun runtime on the victim system’).
• [T1059.006] Command and Scripting Interpreter: Python – The elementary-data .pth payload executed when Python started (‘elementary-data .pth payload executed at Python interpreter startup’).
• [T1059.004] Command and Scripting Interpreter: Unix Shell – The injected command in GitHub Actions launched a shell stager (‘GitHub Actions runner executes shell stager after comment injection’).
• [T1547] Boot or Logon Autostart Execution – The .pth file caused code to run on every Python interpreter startup (‘elementary-data .pth fires on every Python interpreter startup on the host’).
• [T1027] Obfuscated Files or Information – Both payloads used encryption or XOR-based hiding to hinder analysis (‘KICS payload uses AES-256-GCM + RSA OAEP-SHA256; elementary-data uses MD5-keystream XOR’).
• [T1070.004] Indicator Removal: File Deletion – Temporary-directory cleanup removed artifacts after execution (‘temporary-directory context manager to delete trin.tar.gz on exit’).
• [T1552.001] Unsecured Credentials: Credentials In Files – Both payloads harvested secrets from files on disk (‘Both payloads harvest SSH keys, cloud credential files, and developer tokens from disk’).
• [T1552.005] Unsecured Credentials: Cloud Instance Metadata API – The stealer queried cloud metadata services for credentials (‘queries EC2 IMDS v2 and ECS task credential endpoints’).
• [T1528] Steal Application Access Token – The attacker abused the GitHub Actions GITHUB_TOKEN to forge a release commit (‘GITHUB_TOKEN abused to forge release commit’).
• [T1526] Cloud Service Discovery – The payload enumerated AWS Secrets Manager and SSM entries (‘secretsmanager:ListSecrets and ssm:DescribeParameters live enumeration’).
• [T1613] Container and Resource Discovery – Kubernetes secrets were enumerated from the runner environment (‘kubectl get secrets –all-namespaces enumeration’).
• [T1005] Data from Local System – The malware collected local credential files, shell history, and config files (‘Credential files, shell history, AI and MCP configuration files harvested’).
• [T1530] Data from Cloud Storage – The payload retrieved plaintext secrets from cloud secret stores (‘secretsmanager:GetSecretValue retrieves plaintext secrets’).
• [T1071.001] Application Layer Protocol: Web Protocols – Exfiltration used HTTPS to actor-controlled infrastructure (‘HTTPS exfiltration to actor-controlled C&C endpoints in both incidents’).
• [T1102.001] Dead Drop Resolver – GitHub commit-search was used to recover fallback C&C domains (‘use GitHub commit-search API to recover fallback C&C domains’).
• [T1041] Exfiltration Over C2 Channel – Encrypted archives were posted to C2 over HTTPS (‘POST encrypted credential archives over HTTPS to the primary C&C endpoint’).
• [T1567] Exfiltration Over Web Service – Stolen data was also dead-dropped into public GitHub repositories (‘auto-created public GitHub repositories under Dune-themed names’).
• [T1657] Financial Theft – Cryptocurrency wallet keystores were targeted as part of the credential theft (‘Cryptocurrency wallet harvesting observed in the elementary-data payload’).