Full Report
Checkmarx has confirmed that a modified version of the Jenkins AST plugin was published to the Jenkins Marketplace. "If you are using Checkmarx Jenkins AST plugin, you need to ensure that you are using the version 2.0.13-829.vc72453fa_1c16 that was published on December 17, 2025 or previously," the cybersecurity company said in a statement over the weekend. As of writing, Checkmarx has released
Analysis Summary
# Incident Report: TeamPCP Compromise of Checkmarx Jenkins AST Plugin
## Executive Summary
The threat actor group TeamPCP successfully compromised the Checkmarx Jenkins AST (Application Security Testing) plugin, publishing a modified malicious version to the Jenkins Marketplace. This incident is part of an ongoing supply chain campaign by TeamPCP against Checkmarx, likely resulting from inadequate secret rotation or a persistent foothold from a previous breach in March 2026. The compromise led to the defacement of the plugin's GitHub repository and the potential exposure of customer environments using the malicious plugin versions.
## Incident Details
- **Discovery Date:** Approximately May 9–10, 2026
- **Incident Date:** Late April to Early May 2026
- **Affected Organization:** Checkmarx
- **Sector:** Cybersecurity / Software Development Tools
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** Post-March 2026 incident.
- **Vector:** Use of stolen credentials/secrets.
- **Details:** Attackers likely utilized credentials harvested during a previous March 2026 supply chain attack (targeting GitHub Actions and VS Code extensions) that were not successfully rotated or neutralized.
### Lateral Movement
- **Details:** The attackers gained unauthorized access to Checkmarx’s GitHub repository and the Jenkins Marketplace publishing pipeline.
### Data Exfiltration/Impact
- **Details:** The "Jenkins AST" plugin was modified with malicious code. The GitHub repository was defaced and renamed to "Checkmarx-Fully-Hacked-by-TeamPCP-and-Their-Customers-Should-Cancel-Now."
### Detection & Response
- **Discovery:** Identified by security researchers (Adnan Khan) and SOCRadar monitoring.
- **Response actions taken:** Checkmarx released a clean version of the plugin (v2.0.13-848.v76e89de8a_053) and issued a public advisory regarding safe versions.
## Attack Methodology
- **Initial Access:** Valid accounts (Stolen credentials from previous breach).
- **Persistence:** Likely retained access via unrotated secrets or missed backdoors in the CI/CD pipeline.
- **Defense Evasion:** Using official marketplace channels to distribute modified code (Supply Chain Compromise).
- **Credential Access:** Secret harvesting from previous GitHub Actions/VS Code extension compromises.
- **Lateral Movement:** Movement from compromised developer/automation environments to official repository management.
- **Impact:** Supply chain infection/Brand defacement.
## Impact Assessment
- **Financial:** High remediation costs and potential loss of contract renewals.
- **Data Breach:** Exposure of developer secrets and internal repository configurations.
- **Operational:** Disruption to the Jenkins plugin ecosystem and Checkmarx’s release cycle.
- **Reputational:** High; this marks the second major successful attack by the same group on the same target within two months, suggesting a failure in incident recovery processes.
## Indicators of Compromise
- **File indicators:** Modified Jenkins AST plugin versions released after December 17, 2025 (specifically those preceding v2.0.13-848).
- **Behavioral indicators:** Unauthorized renaming of GitHub repositories; anomalous publishing activity to Jenkins Marketplace.
- **Defaced Repo Name:** `Checkmarx-Fully-Hacked-by-TeamPCP-and-Their-Customers-Should-Cancel-Now`
## Response Actions
- **Containment:** Removal/overshadowing of malicious plugin versions in the marketplace.
- **Eradication:** Release of patched version `2.0.13-848.v76e89de8a_053`.
- **Recovery:** Public communication urging customers to verify plugin versions.
## Lessons Learned
- **Remediation Gaps:** The second breach confirms that the initial response to the March 2026 incident failed to identify all compromised credentials or access points.
- **Secret Management:** Rotating secrets is insufficient if the rotation does not encompass the entire scope of the attacker's footprint (including CI/CD tokens).
- **Supply Chain Fragility:** Trust in marketplace-delivered plugins can be weaponized quickly if the vendor’s publishing pipeline is compromised.
## Recommendations
- **Comprehensive Secret Rotation:** Perform a "scorched earth" rotation of all GitHub tokens, SSH keys, and Marketplace API keys.
- **Hardware MFA:** Enforce hardware-based Multi-Factor Authentication (MFA) for all repository contributors and marketplace publishers.
- **CI/CD Auditing:** Implement strict integrity checks and manual approval gates for publishing any updates to public marketplaces.
- **Version Verification:** Organizations using the AST plugin should pin their versions to the known-good hash: `2.0.13-829.vc72453fa_1c16` (published Dec 17, 2025) or the new verified patch.