Poisoned Trivy update led to European Commission cloud breach, CERT-EU says
The European Union's cybersecurity service, CERT-EU, said on April 2 that a breach of the European Commission's cloud infrastructure began with a compromised copy of Trivy, a popular open source security scanner, which gave attackers an Amazon Web Services key tied to the Commission's europa.eu hosting platform.
The finding makes the incident one of the clearest examples this year of a software supply chain attack reaching a government. A tool meant to find security problems in code became the way in.
What happened
According to CERT-EU's report, the attacker obtained the AWS API key on March 19 through the Trivy compromise and ran a secret-scanning tool to look for more credentials. The key granted management rights over other Commission AWS accounts. The attacker created a new access key on an existing user, apparently to avoid detection, and carried out reconnaissance. The Commission's security centre received alerts on March 24 and secured the compromised secret the next day.
CERT-EU assessed with high confidence that the Commission was running a compromised Trivy version received through normal update channels. Aqua Security, which maintains Trivy, attributes that compromise to a group known as TeamPCP.
The Commission confirmed the attack on March 27. On March 28, the ShinyHunters extortion group published the stolen data on its leak site. A ShinyHunters member told TechCrunch the group had taken data that TeamPCP stole in earlier attacks and leaked it.
What was taken
The published set is about 91.7 GB compressed, or 340 GB uncompressed, and includes names, usernames and email addresses, mainly from Commission websites. It also includes nearly 52,000 outbound email files. CERT-EU said most are automated messages, but bounced emails may contain original user content. Up to 71 europa.eu hosting clients may be affected: 42 internal Commission clients and at least 29 other EU bodies. No websites were altered or taken offline.
What to do
CERT-EU urges organizations to audit Trivy versions across all environments, including build pipelines, and update to a version Aqua Security identifies as safe. Rotate cloud secrets that may have been exposed, pin GitHub Actions to full commit hashes rather than tags, review CloudTrail for unexpected new access keys, and limit pipeline access to cloud credentials.
