Article
Understanding Supply Chain Attack Tactics with Case Study
Supply chain attacks explained: how adversaries exploit trusted vendors and updates, with SolarWinds, Kaseya and NotPetya examples and an npm case study.
Read more
Malware profile
TruffleHog
Also known as Trufflehog
TruffleHog is a legitimate open source tool that searches for leaked passwords, API keys and other secrets in code, logs, chats and cloud storage.
In short
TruffleHog is a legitimate open source tool that searches for leaked passwords, API keys and other secrets in code, logs, chats and cloud storage. It is not malware. MITRE lists it as software because attackers can run it to find credentials, and CERT-EU reports that an actor launched it during the European Commission cloud breach in March 2026.
- Names2names in public reportsTruffleHog · Trufflehog
- Techniques12ATT&CK techniques listedCredential Access · Collection · Discovery
- Linked Groups1groups that use itTeamPCP
In one minute
- What it is
- A legitimate open source secrets scanner that attackers can also use.
- What it does
- Searches code, git history, CI/CD pipelines, cloud storage and chat tools for credentials and API keys, and can check whether they still work.
- Who uses it
- CERT-EU says that in the European Commission cloud breach the threat actor launched it. The initial access, through the Trivy supply chain compromise, was publicly attributed to TeamPCP. MITRE lists no group for it.
- How it gets in
- It has no entry method of its own. It is run by someone who already holds access, for example a stolen cloud key.
- What to do first
- Find and rotate exposed secrets before an attacker does, and watch cloud logs for unexpected use of secret scanners.
What it does
The tool was built to help defenders and developers find secrets that were stored by mistake. The maintainers say it can also check whether a found secret still works, which tells a team whether a leak is an active danger.
That same ability is useful to an attacker who already has a foothold. CERT-EU describes an actor launching it to look for more secrets after stealing one AWS key.
Names
Public sources use several names for this malware.
| Name | Where it appears |
|---|---|
| TruffleHog | MITRE ATT&CK software S9009 and CERT-EU blog[1, 2] |
| Trufflehog | MITRE ATT&CK Associated Software[1] |
What it can do
What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.
Credential Access
Unsecured Credentials: Credentials In Files T1552.001
MITRE says it has obtained credentials stored in config files and credential files in victim environments.[1]
Unsecured Credentials: Cloud Instance Metadata API T1552.005
MITRE says it can query the AWS and GCP metadata endpoints for instance and service credentials.[1]
Credentials from Password Stores: Cloud Secrets Management Stores T1555.006
MITRE says it can obtain secrets from AWS Secrets and GCP Secret Manager.[1]
Steal Application Access Token T1528
MITRE says it has gathered access tokens and API tokens from CI/CD pipeline tools and repositories.[1]
Collection
Data from Information Repositories: Code Repositories T1213.003
MITRE says it has gathered data and credentials from code repositories.[1]
Data from Cloud Storage T1530
MITRE says it can scan cloud storage services such as Amazon S3 and Google Cloud Storage for credentials.[1]
Data from Local System T1005
MITRE says it has gathered data from home directories in the victim environment.[1]
Discovery
Cloud Storage Object Discovery T1619
MITRE says it can list cloud storage buckets, including Amazon S3 and Google Cloud Storage.[1]
Cloud Infrastructure Discovery T1580
MITRE says it can list AWS infrastructure, including EC2 instances.[1]
File and Directory Discovery T1083
MITRE says it can browse and scan individual files and directories.[1]
Initial Access
How it spreads
TruffleHog is not malware and does not spread by itself. Attackers who already have access to a system or cloud account can run the tool there. In the European Commission case described by CERT-EU, the actor had first stolen an AWS key through the Trivy supply chain compromise and then launched TruffleHog.
Timeline
- 2016
First release
MITRE says the tool's author first released TruffleHog in 2016.[1]
- 2026-03-19
Actor runs TruffleHog
CERT-EU says the actor obtained an AWS key through the Trivy supply chain compromise and the same day launched TruffleHog to look for more secrets.[2]
- 2026-03-24
Alerts at the Commission
CERT-EU says the European Commission's security operations center saw alerts about possible misuse of Amazon APIs and an unusual volume of network traffic.[2]
- 2026-03-25
CERT-EU notified
CERT-EU says the European Commission told it that an AWS cloud account had been compromised.[2]
- 2026-03-27
Commission press release
CERT-EU says the European Commission publicly disclosed the incident in a press release.[2]
- 2026-04-02
CERT-EU blog
CERT-EU published its account of the breach, naming the use of TruffleHog and advising defenders to look for it in AWS logs.[2]
Who uses it
Related vulnerabilities
Seen in
Detection and defense
Questions
Is TruffleHog malware?
No. MITRE describes it as an open-source secrets-discovery tool, and its maintainers publish it openly. Attackers can misuse it, as CERT-EU reported in one 2026 case.
What does TruffleHog look for?
Credentials, API keys and encryption keys. MITRE says it can search code repositories, git history, CI/CD pipelines, filesystems and cloud storage buckets.
How was it used in the European Commission breach?
CERT-EU says the actor stole an AWS key on 19 March 2026 through the Trivy supply chain compromise and the same day launched TruffleHog to look for additional secrets.
How can a defender spot misuse?
CERT-EU advises reviewing AWS CloudTrail logs for unusual STS calls, use of TruffleHog and new access keys created on existing users.
Does TruffleHog check if a secret works?
The maintainers say it can log in to confirm whether a classified secret is live. That is useful to defenders, and also to anyone who has found a secret.
In our research
- Understanding Supply Chain Attack Tactics with Case Study October 2025
- TeamPCP Threat group
Sources
- TruffleHog, Software S9009 MITRE ATT&CKSupports: Description, platforms, aliases, first release year and techniques listed for TruffleHog.
- European Commission cloud breach: a supply-chain compromise CERT-EUSupports: The actor launched TruffleHog on 19 March 2026, the timeline, and the defensive advice.
- trufflesecurity/trufflehog project page Truffle Security, project maintainerSupports: What the tool is, what it searches and that it can confirm whether a secret is live.
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.