EU Attributes Commission Breach to TeamPCP Trivy Attack

The European Union's cybersecurity agency, CERTEU, has attributed a significant data breach at the European Commission's cloud infrastructure to the cybercriminal group TeamPCP, which exploited a supply chain attack on the open-source vulnerability scanner Trivy to steal sensitive information from the Europa.eu platform. The incident, detected on March 24 and publicly disclosed on March 27, affected data from at least 71 clients, including 42 internal Commission users and 29 other EU entities.

Hackers initially compromised Trivy, developed by Aqua Security, on March 19 by injecting malware into its update channels. The European Commission unknowingly downloaded the tainted version, which allowed attackers to harvest an AWS API key from its environment. Using this key, the intruders created a new access credential attached to an existing user account to avoid detection, conducted reconnaissance with tools like TruffleHog to scan for additional secrets, and exfiltrated approximately 340 gigabytes of uncompressed data, equivalent to 92 gigabytes when compressed. CERTEU reported that no lateral movement to other Commission AWS accounts was detected, and the breach did not disrupt...