Cisco Systems

Summary

Threat actors used stolen credentials from the Trivy supply chain attack to compromise an internal development environment at Cisco, deploying a malicious GitHub Action plugin to steal credentials and data from build and development systems. The incident affected dozens of devices, including developer and lab workstations, and involved unauthorized use of stolen AWS keys in a small number of cloud accounts. More than 300 GitHub repositories were cloned, including source code for AI products, unreleased products, and repositories allegedly belonging to corporate customers such as banks, BPOs, and US government agencies. The breach was contained through isolation, reimaging, and credential rotation, while follow-on activity linked to LiteLLM and Checkmarx supply chain attacks was expected.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Cisco experienced a cyberattack after threat actors used credentials stolen during the Trivy supply chain attack to enter the company’s internal development environment. The Trivy incident involved compromise of the vulnerability scanner project’s GitHub pipeline, where attackers distributed credential-stealing malware through official releases and GitHub Actions. In Cisco’s case, the intrusion was tied to a malicious “GitHub Action plugin” associated with that supply chain compromise. The attackers used the malicious GitHub Action to steal credentials and data from Cisco’s build and development environment. The activity affected dozens of devices, including developer workstations and lab workstations.

The breach led to the theft of Cisco source code and source code associated with customers. More than 300 GitHub repositories were reportedly cloned during the incident. The cloned repositories included source code for Cisco AI-powered products, including AI Assistants and AI Defense, as well as unreleased products. A portion of the stolen repositories allegedly belonged to corporate customers, including banks, business process outsourcing organizations, and U.S. government agencies. Multiple AWS keys were also reportedly stolen during the breach. Those keys were later used to carry out unauthorized activities across a small number of Cisco AWS accounts.

Cisco’s Unified Intelligence Center, CSIRT, and EOC teams contained the initial breach. The company isolated affected systems and began reimaging them. Cisco also started wide-scale credential rotation in response to the theft of credentials and AWS keys. The initial breach was contained, but Cisco expected continued fallout from related follow-on supply chain attacks involving LiteLLM and Checkmarx. Multiple sources told BleepingComputer that more than one threat actor was involved in the Cisco CI/CD and AWS account breaches, with varying degrees of activity.

Security researchers linked the broader supply chain attacks to the TeamPCP threat group because of the use of the group’s self-titled “TeamPCP Cloud Stealer” infostealer. TeamPCP had been conducting a series of supply chain attacks targeting developer code platforms, including GitHub, PyPI, NPM, and Docker. The group also compromised the LiteLLM PyPI package, which impacted tens of thousands of devices, and the Checkmarx KICS project, where the same information-stealing malware was deployed. BleepingComputer reported the Cisco incident based on an anonymous source and stated that Cisco had not replied to questions about the breach at the time of publication.

Sources

Sources available to members: 1 source.