Why a recent supply-chain attack singled out security firms Checkmarx and Bitwarden

In a troubling turn of events, cybersecurity company Checkmarx has found itself in the crosshairs of multiple cyberattacks over the past six weeks. The ordeal began on March 19 when the firm was targeted in a supply-chain attack involving Trivy, a popular vulnerability scanner. Hackers gained access to the Trivy GitHub account and exploited it to distribute malware to unsuspecting users, including Checkmarx. The malware was designed to search infected systems for sensitive information such as repository tokens, SSH keys, and other credentials. Just days later, Checkmarx's own GitHub account fell victim to a similar compromise, leading to the distribution of malware to its clientele. Although the company acted swiftly to contain the breach, replacing the malicious software with legitimate applications, it soon became evident that the threat had not been entirely eradicated. On April 22, Checkmarx's GitHub account was involved in another malware push, raising concerns that the initial breach had either not been fully resolved or that a new, unidentified attack had occurred. The company once again took measures to expel the intruders from their account. Security firm Socket reported that malicious packages were also published through Checkmarx's official Docker Hub repository around the same timeframe. The situation escalated when, on Monday, Checkmarx announced that the notorious ransomware group Lapsu$ had leaked a significant amount of the company's private data onto the dark web. This data dump, dated March 30, indicates that the attackers managed to retain access to Checkmarx's GitHub account even after the company had discovered the compromise on March 23. Despite attempts to secure their systems, the threat loomed larger as the saga of cyber breaches continued to unfold.