KICS
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Analysis of the poisoned image indicates that the bundled KICS binary was modified to include data collection and exfiltration capabilities not present in the legitimate version... the malware could generate an uncensored scan report, encrypt it, and send it to an external endpoint.
Techniques & procedures
13 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
5 techniques
Initial Access
the threat actors behind TeamPCP’s supply chain campaign are now using credentials stolen during earlier compromises to access Amazon Web Services (AWS) accounts... They rely on valid keys and trusted automation paths, allowing them to bypass authentication controls and blend into normal developer and pipeline activity.
The attackers validated cloud keys taken from the Trivy, LiteLLM, and Checkmarx KICS compromises and used them to access cloud services, enumerate infrastructure, run commands inside containers, and exfiltrate sensitive data.
The evidence suggests this is not an isolated Docker Hub incident, but part of a broader supply chain compromise affecting multiple Checkmarx distribution channels.
Docker alerted Socket to malicious images pushed to the official checkmarx/kics Docker Hub repository... attackers appear to have overwritten existing tags... Analysis of the poisoned image indicates that the bundled KICS binary was modified...
Execution
2 techniques
Execution
Persistence
2 techniques
Persistence
the threat actors behind TeamPCP’s supply chain campaign are now using credentials stolen during earlier compromises to access Amazon Web Services (AWS) accounts... They rely on valid keys and trusted automation paths, allowing them to bypass authentication controls and blend into normal developer and pipeline activity.
Privilege Escalation
2 techniques
Privilege Escalation
the threat actors behind TeamPCP’s supply chain campaign are now using credentials stolen during earlier compromises to access Amazon Web Services (AWS) accounts... They rely on valid keys and trusted automation paths, allowing them to bypass authentication controls and blend into normal developer and pipeline activity.
Stealth
2 techniques
Stealth
the threat actors behind TeamPCP’s supply chain campaign are now using credentials stolen during earlier compromises to access Amazon Web Services (AWS) accounts... They rely on valid keys and trusted automation paths, allowing them to bypass authentication controls and blend into normal developer and pipeline activity.
Credential Access
2 techniques
Credential Access
It iterated through th e /proc/ directory to isolate the PIDs for the .NET runtime powering the Runner.Worker process. Because the script inherited the runner’s user privileges, it read the /proc/<pid>/mem file descriptor , mapped the memory boundaries via /proc/<pid>/maps, and ran string-matching algorithms across the heap memory segments.
The attackers validated cloud keys taken from the Trivy, LiteLLM, and Checkmarx KICS compromises and used them to access cloud services... Rotating all secrets exposed in any environment where compromised packages were installed, including cloud access keys, Secure Shell keys, and GitHub tokens.
Discovery
2 techniques
Discovery
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A trojanized version of the legitimate KICS scanner distributed through compromised Docker images. The modified Golang ELF binary mimics normal KICS functionality while adding unauthorized telemetry, scan-report collection, encryption, and exfiltration to attacker-controlled infrastructure; it also shares command-and-control infrastructure with mcpAddon.js and may include additional malicious code.
A compromised Checkmarx KICS distribution in which poisoned container images and related developer tooling were used to fetch or execute credential-stealing logic targeting cloud, Kubernetes, database, and CI/CD secrets.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.