Full Report
Cybercrooks ruin engineers' weekends with Saturday attack
Analysis Summary
# Incident Report: TeamPCP Supply Chain Compromise of Checkmarx Jenkins Plugin
## Executive Summary
Over the weekend of May 9, 2026, the threat actor group "TeamPCP" successfully compromised Checkmarx’s distribution channel to upload a malicious version of the Checkmarx AST Scanner plugin to the Jenkins Marketplace. This incident marks the third successful compromise of Checkmarx systems by the same actor in three months, involving the deployment of "Mini Shai-Hulud" malware. The attack suggests either a failure to rotate compromised secrets from previous breaches or an undiscovered persistence mechanism within the Checkmarx environment.
## Incident Details
- **Discovery Date:** Saturday, May 9, 2026
- **Incident Date:** May 9, 2026
- **Affected Organization:** Checkmarx
- **Sector:** Cybersecurity / Software Development Tools
- **Geography:** Global (Impacts all Jenkins users downloading the plugin)
## Timeline of Events
### Initial Access
- **Date/Time:** Saturday, May 9, 2026 (exact time undisclosed)
- **Vector:** Likely compromised credentials or unrotated secrets (API keys/tokens).
- **Details:** Attackers gained unauthorized access to Checkmarx’s publishing credentials for the Jenkins Marketplace and GitHub repositories.
### Lateral Movement
- Details on internal movement are limited, but the attackers demonstrated access to the CI/CD pipeline infrastructure and GitHub repository settings to rename projects and inject malicious code.
### Data Exfiltration/Impact
- **Malware Injection:** A "backdoored" version of the AST Scanner plugin was published.
- **Defacement:** Checkmarx’s GitHub project was renamed to “Checkmarx-Fully-Hacked-by-TeamPCP-and-Their-Customers-Should-Cancel-Now.”
- **Functionality:** The malware ("Mini Shai-Hulud") is designed to steal credentials, environment variables, and secrets from the Jenkins runner environment.
### Detection & Response
- **Discovery:** Detected on Saturday by Checkmarx engineers and external security researcher Adnan Khan.
- **Response Actions:** Checkmarx issued a public advisory on Saturday, began publishing a clean version of the plugin, and initiated pull requests on Monday, May 11, to remove the malicious code.
## Attack Methodology
- **Initial Access:** Valid Accounts (Likely unrotated developer/publishing secrets).
- **Persistence:** Potentially neglected backdoors or persistent tokens from previous attacks (March/April 2026).
- **Privilege Escalation:** Not explicitly detailed, but sufficient to modify marketplace listings.
- **Defense Evasion:** Leveraging the "trust model" of a security-focused plugin to bypass scrutiny.
- **Credential Access:** The malware seeks to harvest tokens and secrets from Jenkins pipelines.
- **Discovery:** Reconnaissance of the Jenkins Marketplace environment.
- **Lateral Movement:** Supply chain propagation (from vendor to customers).
- **Collection:** Stealing source code access and environment variables.
- **Exfiltration:** Standard C2 or webhook exfiltration (specifics not detailed in the article).
- **Impact:** Supply Chain Compromise and Brand Damage.
## Impact Assessment
- **Financial:** Undisclosed; potential loss of service contracts.
- **Data Breach:** Exposure of customer pipeline secrets, API tokens, and source code for those who updated the plugin.
- **Operational:** Disruption of CI/CD pipelines as users are forced to roll back or wait for clean patches.
- **Reputational:** High. This is the third compromise by the same actor in 90 days, raising significant questions about Checkmarx's internal security posture.
## Indicators of Compromise
- **File indicators:** Modified "Checkmarx AST Scanner" plugin (versions published May 9, 2026).
- **Behavioral indicators:** Renaming of GitHub repositories; unauthorized modifications to Jenkins Marketplace descriptions.
- **Known Good Version:** 2.0.13-829.vc72453fa_1c16 (Published Dec 17, 2025).
## Response Actions
- **Containment:** Published advisory urging users to stop using May 9th versions.
- **Eradication:** Removal of malicious npm and GitHub packages; overwriting the malicious plugin on the Jenkins Marketplace.
- **Recovery:** Development and release of a sanitized version of the AST plugin.
## Lessons Learned
- **Secret Rotation Failure:** Organizations must ensure that *all* secrets are rotated across all platforms (GitHub, npm, Jenkins Marketplace) immediately following a breach.
- **Persistence Monitoring:** Response teams failed to identify how TeamPCP maintained access following the March and April intrusions.
- **Third-Party Trust:** Even security tools are vulnerable to supply chain attacks, requiring users to verify hashes/versions of security plugins.
## Recommendations
- **Rotate All Secrets:** Perform an exhaustive rotation of all CI/CD tokens, SSH keys, and marketplace credentials.
- **Implement MFA:** Enforce Multi-Factor Authentication (MFA) for all repository and marketplace publishing accounts.
- **Integrity Checking:** Implement automated integrity checks to alert when unauthorized changes are made to public-facing descriptions or package versions.
- **Audit Trails:** Conduct a deep forensic audit of all developer service accounts to identify hidden persistence mechanisms (e.g., rogue OAuth apps).