Checkmarx suffered multiple supply-chain breaches via GitHub and Docker Hub over 40 days, culminating in a Lapsu$ ransomware data dump.
Starting March 19, attackers breached the Trivy vulnerability scanner's GitHub account and used it to push malware to Checkmarx. Four days later, Checkmarx's own GitHub account was compromised and began distributing malware to its users. A second malware wave hit April 22, indicating the initial remediation failed. Lapsu$ ransomware group then dumped private Checkmarx data on the dark web, with timestamps suggesting persistent access throughout the entire period.
This attack chain is a textbook example of transitive trust exploitation: attackers compromised Trivy, used it to reach Checkmarx, then used Checkmarx to reach end developers. If you pull Docker images or GitHub Actions from security vendors, you are in the blast radius. The April 22 re-infection shows that vendor 'remediation' announcements cannot be trusted at face value — you need your own verification layer.
Audit every GitHub Action, Docker image, and CLI tool in your CI/CD pipeline that comes from a third-party security vendor. Cross-reference the SHA digest of currently pinned versions against what was published on March 19–April 22 using Docker Hub's tag history or GitHub's commit log.
Run: curl -s https://hub.docker.com/v2/repositories/checkmarx/kics/tags/?page_size=25 | jq '.results[] | {name: .name, last_updated: .last_updated, digest: .digest}'
Tags