Cisco source code theft linked to Trivy supply chain breach

A supply chain attack led to a Cisco source code theft after attackers compromised a widely used security tool. Instead of targeting Cisco directly, the attackers moved through a trusted component inside the company’s development pipeline. As a result, they gained access to internal systems and extracted sensitive code.

This incident shows how modern attacks focus on indirect entry points, where trust becomes the weakest link.

Compromised tool enabled initial access

The Cisco source code theft began with a breach involving the Trivy vulnerability scanner. Attackers injected malicious code into the tool’s distribution process, turning a legitimate security product into an infection vector.

Once the compromised version ran inside Cisco’s environment, it collected credentials tied to CI/CD workflows. These credentials allowed attackers to authenticate as legitimate processes, which helped them avoid detection during the initial stages.

Because the activity appeared normal, traditional security controls did not immediately flag the intrusion.

Attackers moved through internal systems

After gaining access, attackers expanded their reach inside Cisco’s development infrastructure. They accessed systems connected to build pipelines, testing environments, and cloud resources.

During this stage, they:

• Used stolen credentials to authenticate across services
• Accessed internal development and lab environments
• Retrieved cloud keys linked to critical infrastructure

Cisco responded by revoking credentials and isolating affected systems. However, the attackers had already established access before containment efforts began.

Large-scale code exfiltration confirmed

The Cisco source code theft involved a significant data extraction operation. Attackers cloned hundreds of internal repositories, including projects tied to active development.

The stolen data includes:

• Source code for internal tools and services
• AI-related projects and experimental features
• Code connected to unreleased functionality

Some of the affected repositories also related to external partners, which increases the potential impact beyond Cisco’s internal environment.

Attack shows coordinated activity

Investigators believe the breach involved more than one threat actor. Different patterns of access and behavior suggest that multiple groups operated within the compromised environment.

This raises the risk of continued exposure, as stolen data or access paths may be shared or reused. It also complicates response efforts, since multiple actors can exploit the same foothold in different ways.

Supply chain risks continue to grow

The Cisco source code theft highlights the increasing risk tied to third-party tools. Development pipelines depend on automated systems and external components, which creates multiple points of failure.

This incident shows that:

• Trusted tools can become attack vectors
• Credential exposure remains a critical weakness
• Supply chain attacks can scale across multiple targets

As development environments become more interconnected, attackers gain more opportunities to move laterally through trusted systems.

Conclusion

The Cisco source code theft did not begin with a direct breach of Cisco’s defenses. Instead, it started with a compromised tool that attackers used to gain trusted access.

This approach reflects a broader shift in cyberattacks. Threat actors no longer rely only on exploits. They now target the systems and processes that organizations depend on every day. Without stronger controls around these dependencies, similar incidents will continue to surface.