The TeamPCP campaign marks a turning point in cloud security. Attackers are no longer bypassing defenses. They are weaponizing them.
In this session, we break down how attackers compromised the widely used Trivy security scanner and used it to launch a cascading software supply chain attack across thousands of organizations.
This attack shows how CI/CD pipelines have become a primary target and how trusted security tools can be turned into attack vectors. A vulnerability scanner used by more than 10,000 development teams was compromised to steal cloud credentials, exfiltrate sensitive data, and spread malware across software ecosystems.
This is not an edge case. It highlights fundamental risks in modern cloud environments, including over-permissioned access, lack of trust boundaries in CI/CD pipelines, and the growing impact of software supply chain attacks.
What You Will Learn:
This webcast walks through the TeamPCP attack from start to finish, covering how it began, how it spread, the impact, and the key lessons for defenders.
Presenters will break down the attack to show:
- Security tools can become attack vectors
- How trusted tools like Trivy, Checkmarx KICS, and LiteLLM were weaponized to steal credentials.
- CI/CD credential theft can have an exponential blast radius
- How a single compromised token cascaded across pipelines, packages, and multiple ecosystems.
- Active compromise can break standard credential rotation
- Why rotating credentials inside a compromised environment can enable re-compromise.
- GitHub Actions requires compensating controls
- Key architectural risks and the controls needed to secure CI/CD workflows.
- Self-propagating supply chain attacks are operational
- How automated worm-like behavior enabled rapid spread across software ecosystems.
Who Should Attend?
- Chief Information Security Officers (CISOs)
- VPs / Directors of Cloud Security
- VPs / Directors of DevSecOps
- VPs / Directors of Application Security
- Security Architects
- Cloud Security Architects
- Platform Engineering Leads / Managers
- Security Engineers
- DevSecOps Engineers
- Incident Responders
This session supports content and knowledge from SEC510, SEC540, SEC588, and FOR509. To learn more, access free resources, and explore upcoming course runs within the SANS Cloud Security curriculum CLICK HERE.
