Why a recent supply-chain attack singled out security firms Checkmarx and Bitwarden
Security firms Checkmarx and Bitwarden fell victim to a sophisticated supply-chain attack originating from compromised development tools, demonstrating how attackers are weaponizing security infrastructure itself as both a target and distribution mechanism for malware and credential theft. The cascading breaches—compounded by ransomware extortion and incomplete remediation—highlight a critical vulnerability: security tools with privileged access across wide customer bases represent high-value targets for access brokers who sell credentials to ransomware gangs, creating downstream risks across entire customer ecosystems. For IT organizations, this underscores the urgent need to reassess trust assumptions around security vendors and implement enhanced monitoring of third-party tool integrity, as traditional supplier relationships with security providers no longer guarantee protection.
It has been a bad six weeks for security firm Checmarx. Over the past 40 days, it has been the victim of at least one supply-chain attack that delivered malware to customers on two separate occasions. Now it has been hit by a ransomware attack from prolific fame-seeking hackers. The streak of misfortunes started on March 19, with the supply-chain attack of Trivy, a widely used vulnerability scanner. The attackers behind the breach first breached the Trivy GitHub account and then used their access to push malware to Trivy users, one of which was Checkmarx. The pushed malware scoured infected machines for repository tokens, SSH keys, and other credentials. Both a target and delivery mechanism Four days later, Checkmarx’s GitHub account was compromised and began pushing malware to the security firm’s users. The company contained and remediated the breach and replaced the malware with the legitimate apps. Or so Checkmarx thought.Read full article Comments
