RansomHouse Claims Trellix Source Code Repository Breach; 53,000 Customers Across 185 Countries at Downstream Risk

Cybersecurity vendor Trellix (formed from the McAfee Enterprise/FireEye merger) confirmed in early May that attackers gained unauthorized access to a portion of its source code repository, with RansomHouse claiming responsibility and leaking screenshots purporting to show access to its appliance management system. Trellix states no evidence of source code exploitation or tampering with its release/build pipeline, but has not disclosed which product lines were accessed, the intrusion timeline, or the attack vector; the breach is assessed as potentially linked to a broader TeamPCP-led supply chain campaign that also hit Checkmarx, Aqua Security, and Bitwarden by compromising CI/CD secrets. Defenders running Trellix XDR, EDR, or network security products should treat forthcoming patches with elevated scrutiny and audit agent privileges, as source code access provides adversaries a roadmap to detection logic and bypass opportunities.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.