The Scanner Was the Vulnerability

Two days later the same group hit KICS, Checkmarx's infrastructure-as-code scanner, poisoning 35 version tags with stolen GitHub personal access tokens. Two days after that, LiteLLM, the AI gateway. Four days after that, the Telnyx Python SDK, with the encrypted payload tucked inside a WAV file, because by the fourth one you are no longer solving a problem, you are decorating.

On August 26 the Australian Federal Police, working with the FBI and Western Australia Police, arrested two men in the Perth suburbs of Cottesloe and Mandurah. Ruben Ian Thomson, 21, faces eight charges — unauthorized data modification, dealing in more than $100,000 in criminal proceeds, refusing to hand over device passwords. Louis Michael Gaebler, 23, faces six. Between them, the AFP alleges, TeamPCP compromised more than a thousand organizations, exposed roughly half a million credentials, and removed at least 300 gigabytes of data. Cleanup costs are estimated in the hundreds of millions.

Arrests for this attack vector are rare enough that the story gets filed as a win, and in the narrow sense it is one. But look at where the failure actually sits, because it is not where the press release puts it.

Aqua Security, which maintains Trivy, was breached in February. The incident was found. The credentials were rotated. The rotation was incomplete — the aqua-bot service account survived it — and the March compromise ran on a credential that everyone involved believed had already been revoked. There is no system anywhere that distinguishes rotated from mostly rotated. There is a ticket, and the ticket gets closed, and the ticket does not know how to be 95 percent closed.

Then it compounds, which is the part worth watching. The Trivy access yielded PyPI publishing tokens. Those tokens produced the LiteLLM compromise. That compromise shipped a file called litellm_init.pth, which Python executes at interpreter startup — on every process, on every machine that has the package installed, whether or not anything on that machine ever calls LiteLLM. The blast radius stopped tracking usage. Presence was enough. And it moved at machine speed: harvested tokens infected 47 npm packages in under sixty seconds.

Everyone in security knows the phrase "supply chain attack." It is on every vendor slide and in every board deck. Awareness of this vector is total and has been for years, and a thousand organizations went down anyway, because awareness is not a control. What you actually have is a trust graph you did not draw and cannot enumerate. Nobody at any of those thousand companies made a decision to trust a bot account at a container-scanning vendor. They made a decision to scan their containers. The trust was inherited, silently, several hops down, in a dependency of a tool that exists to check dependencies.

And that is the specific thing here — but it is worth being precise about which part was chosen. Look at the order. Aqua on the 19th, Checkmarx on the 21st: two security vendors, back to back, before either compromise had produced a single reusable token. That was selection. What followed was not. LiteLLM is an AI gateway and the Telnyx SDK is a telephony library, and neither was picked for what it does. They were picked because a credential harvested upstream happened to open them. The choosing happens at the door. Everything past the door is arithmetic.

The door is what matters, though, because a scanner is worth compromising precisely for the thing that makes it useful. It earned the right to sit in every pipeline and run with elevated access. Unit 42 titled its writeup "Weaponizing the Protectors," which is correct and also slightly generous. Nothing was weaponized. The tool was already pointed at everything you own. All they did was change what it was looking for.

The arrests took two people out of Western Australia. Aikido Security's Charlie Eriksen put it plainly: the conditions that produced them have not gone away, so there will be another TeamPCP. He is describing a pipeline, not a prediction.

And the conditions are not exotic. A February breach handled by a competent team, a rotation that got most of the way, a ticket someone marked done on a Friday. Somewhere right now a credential rotation is nearly finished.

But an incomplete rotation is only fatal because of what one surviving token is worth, and that is the part no one was arrested for. Go back to the first sentence. Someone force-pushed 76 of 77 version tags. A version tag is supposed to be the stable name of a release — pinning one is the entire point — and it is not stable, it is a pointer, and a pointer can be moved. Downstream, nothing would notice. A package registry publishes on a single bearer token and asks nothing further. There is no attested link between a release and the humans who authorized it, which means there is no artifact anywhere in the chain capable of contradicting the tag.

So the trust graph you did not draw is also a graph you cannot check. Fix the rotation and you have fixed the rotation.