A threat actor operating under the handle xpl0itrs is advertising 569GB of data allegedly stolen from RapidFort, a US container-hardening and software supply chain security vendor, on a cybercrime forum. The listing — 140,061 files pulled from 48 Amazon S3 buckets, priced at $40,000 — ties the intrusion to the CanisterWorm campaign run jointly with TeamPCP, and claims the underlying access dates back to March 2026. RapidFort has not issued a public statement confirming or denying the claim.
What happened
CanisterWorm is the ICP-blockchain-C2 campaign that backdoored Trivy, the container vulnerability scanner embedded in a large fraction of CI/CD pipelines, discovered in late March 2026. TeamPCP is the threat cluster (also tracked as PCPcat/ShellForce) that ran a parallel cascade the same month, poisoning Trivy, KICS, LiteLLM, and Telnyx artifacts to harvest CI/CD secrets at scale and eventually pivoting into ransomware deployment via the Vect RaaS group. Both campaigns are documented on this site. What’s new here is a specific named victim surfacing five months later: RapidFort, a vendor whose entire business is scanning and hardening other companies’ container images and CI/CD pipelines.
The forum listing includes a bucket-by-bucket manifest: developer hardening-pipeline artifacts, a vulnerability-database pipeline said to account for roughly 235GB on its own, scanner backend code, general DevOps infrastructure, and billing exports. The seller claims the archive contains plaintext AWS credential files, RSA private keys, Kubernetes kubeconfigs, environment variables, and per-customer CloudFormation templates that provision cross-account IAM roles — the mechanism RapidFort uses to reach into customer accounts and scan their images, snapshots, and volumes. xpl0itrs also claims the data includes material tied to US government and defense-affiliated customers, and alleges RapidFort has not notified affected customers.
Why this matters beyond one vendor
RapidFort sits inside its customers’ build and deployment pipelines by design — that’s the product. If the CloudFormation/IAM material in this dump is genuine, the blast radius isn’t RapidFort’s own infrastructure; it’s every environment that onboarded the scanner and granted it a cross-account role. An attacker holding valid cross-account IAM trust relationships doesn’t need to compromise each downstream target independently — they inherit whatever access the customer granted the vendor. This is the same structural risk that made the original Trivy compromise dangerous: a security tool with broad pipeline access becomes a single point of catastrophic failure when the vendor itself is the one that gets popped.
The claim that the access dates to the March 2026 TeamPCP/Trivy cascade is notable on its own. It suggests initial access sat undetected — or detected but unremediated — for close to five months before surfacing as a forum listing, which is consistent with TeamPCP’s documented pattern of harvesting credentials broadly and monetizing later rather than immediately.
Caveats
This is an unverified criminal-forum claim, not a confirmed breach disclosure. RapidFort has not published an incident statement. At least one adjacent vendor named in related chatter (Knox Systems) has publicly stated it found no evidence its own customers or workloads were affected. Treat the specific technical claims — file counts, bucket contents, credential formats — as unconfirmed until RapidFort or an independent forensic party corroborates them.
What to do now
If you are a RapidFort customer: Ask RapidFort directly for confirmation and scope. Independently audit and consider rotating any cross-account IAM role, access key, or trust policy you provisioned for RapidFort’s scanner. Review CloudTrail for API activity from RapidFort-associated role ARNs going back to March 2026, focusing on unexpected AssumeRole, GetObject, or ListBuckets calls outside expected scan windows.
If you run any tool from the March 2026 TeamPCP/Trivy cascade (Trivy v0.69.4–v0.69.6, kics-github-action, LiteLLM 1.82.7/1.82.8, or Telnyx SDK 4.87.1/4.87.2) and have not already rotated credentials from that incident, treat this disclosure as confirmation that unremediated exposure from that window is still being monetized months later — rotate now if you haven’t.
General hygiene: Scope third-party security-tool IAM roles to the minimum permissions required, avoid broad AdministratorAccess-style cross-account trust for scanners, and set CloudTrail alerting on unused or dormant cross-account roles suddenly becoming active.