Episode description:
Show notes:
This month, Adrian and Alex dig into what happens when one breach detonates a chain of others, and why "we have a SOC 2 report" is no defense when the vendor underneath you gets popped. The featured case is Marquis Software Solutions vs SonicWall, where a 2025 breach of SonicWall's MySonicWall cloud backup service gave attackers everything they needed to break into Marquis, drop ransomware, and exfiltrate data on customers of 74 banks and credit unions. Three layers of lawsuits later (consumers suing the banks, banks pressuring Marquis, Marquis now suing SonicWall), Adrian and Alex use the case to make a point about software liability, the absurdity of "as-is" terms in critical infrastructure, and why bare-minimum vendor diligence and self-attestations will surface during discovery as exhibits against you.
Story two is the Trivy supply chain compromise, where TeamPCP turned Aqua Security's open-source container scanner into a credential-harvesting beachhead. After an incomplete credential rotation following an earlier incident, the attackers pushed a malicious binary, dropping an infostealer that ran before the legitimate scan and silently swept GitHub tokens, AWS/GCP/Azure credentials, SSH keys, and Kubernetes tokens out of CI/CD runners and developer machines. The blast radius reached Cisco, the European Commission, Checkmarx, Bitwarden's CLI, LiteLLM, Guesty, S&P Global, and seeded the CanisterWorm npm worm. Alex walks through the "how not to get Trivied" playbook: pin GitHub Actions to commit SHAs, kill long-lived CI/CD credentials in favor of OIDC and ephemeral tokens, compartmentalize CI from CD (ideally on different platforms), shrink your dependency graph, and demand evidence of SAST/SCA and IR practice from every third party whose code ends up in your pipeline.
Resources:
- https://destroyedbybreach.com
- https://kaynemcgladrey.com/compliance-paperwork-wont-save-you-from-a-vendor-breach/
- https://www.acaglobal.com/industry-insights/sonicwall-cloud-backup-breached-firewall-configurations-compromised/
- https://www.tenchisecurity.com/en/insights-news/secure-practices-trivy-supply-chain-attack
- https://thenewstack.io/teampcp-trivy-supply-chain-attack/
