Threat Actor Modus Operandi: Team PCP

EXECUTIVE SUMMARY

TeamPCP is a highly automated, financially motivated cybercriminal operation that has rapidly evolved from cloud-native mass exploitation into one of the most consequential software supply chain threat actors observed to date. Active since at least September 2025 and operating publicly via Telegram since July 2025, the group transitioned in March 2026 from worm-driven cloud infrastructure compromise into a cascading supply chain campaign that weaponized the very security tools enterprises rely on for defense — including Aqua Security Trivy, Checkmarx KICS, BerriAI LiteLLM, and the Telnyx Python SDK. The operation has compromised an estimated 500,000 machines and exfiltrated over 300 GB of credentials and secrets, with Mandiant assessing impact across 1,000 to 10,000 SaaS environments. TeamPCP represents a fundamental escalation in supply chain threats: blockchain-based command and control resistant to takedown, self-propagating worm capabilities, deliberate targeting of security-adjacent tooling with elevated privileges, and a formal ransomware affiliate program distributing access to approximately 300,000 BreachForums users.

The dual-phase operational evolution — from December 2025 cloud infrastructure pre-positioning to March 2026 supply chain weaponization — demonstrates methodical, planned campaign development rather than opportunistic activity. The integration of CanisterWorm, a destructive wiper component that geofences on Iran locale and Farsi language packs, introduces an unprecedented blend of financially motivated and apparently geopolitical objectives within a single threat cluster.

TeamPCP’s targeting evolution illustrates a deliberate shift from opportunistic cloud exploitation toward strategic supply chain weaponization. Phase 1 operations (late 2025 through February 2026) prioritized any internet-exposed cloud service with weak authentication. Phase 2 operations (March 2026 onward) demonstrated calculated selection of security-adjacent tooling — vulnerability scanners, IaC analyzers, AI gateways — that operate with elevated privileges by design. Compromising these tools provides the attacker with the broad access organizations have already granted, maximizing operational efficiency.

Why Security-Adjacent Tooling

TeamPCP’s choice of targets in the supply chain phase is deliberate and consequential. Vulnerability scanners (Trivy), infrastructure-as-code analyzers (KICS), and AI gateways (LiteLLM, Telnyx) inherit elevated privileges from the organizations that deploy them. They run inside CI/CD pipelines with access to cloud tokens, Kubernetes secrets, SSH keys, and environment variables. By compromising the tool itself, TeamPCP bypasses the need to find vulnerabilities in customer environments — the customers have already granted the tool the access required for the attacker’s objectives.

OPERATIONAL EVOLUTION — TWO PHASES

The Phase 2 campaign demonstrates a self-propagating capability that transformed supply chain risk from single-hop to exponential. Stolen credentials harvested from each compromised tool were automatically weaponized to compromise additional packages without further attacker intervention. The npm worm component infected 47 additional packages in under 60 seconds — an operational tempo that no manual operation could achieve.

INITIAL ACCESS TECHNIQUES

1. Exposed Cloud Services

TeamPCP’s foundational access methodology targets externally accessible cloud infrastructure with weak or missing authentication. Primary targets include Docker Remote API endpoints, Kubernetes API servers and kubelets, Ray distributed computing dashboards, and Redis instances. The group conducts continuous internet-wide scanning, with newly compromised systems immediately enrolled in the scanning infrastructure to extend reach exponentially.

2. React2Shell Exploitation (CVE-2025-55182)

TeamPCP weaponizes the React2Shell vulnerability — a CVSS 10.0 remote code execution flaw in React/Next.js applications — to gain initial access to internet-facing web applications. The vulnerability provides RCE within vulnerable cloud endpoints and was the primary technical exploit driving the December 2025 mass campaign. Notably, port 666 is used for nearly all exploitation operations, providing a high-fidelity detection signature.

3. Software Supply Chain Compromise

TeamPCP’s Phase 2 access model exploits trust relationships in the software supply chain. By compromising service accounts (such as aqua-bot at Aqua Security) and harvesting CI/CD credentials, the group force-pushes malicious code to legitimate version tags of widely deployed open-source security tools. Customers downloading the compromised tool versions execute attacker-controlled code with the elevated privileges those tools require.

4. Stolen Credentials Cascade

Each compromised supply chain target yields credentials that enable the next stage. GitHub Personal Access Tokens stolen from Trivy customers were used against Checkmarx KICS. PyPI publishing tokens harvested at scale enabled LiteLLM and Telnyx compromises. This credential cascade architecture, combined with automated weaponization scripts, allows a single initial compromise to propagate across multiple ecosystems within hours.

5. Imposter Commit Attacks

The imposter commit technique — force-pushing malicious code to existing version tags using compromised service account credentials — allows TeamPCP to inject backdoors into software supply chains while appearing as legitimate developer activity. The Trivy compromise included 76 of 77 historical version tags being force-pushed simultaneously, ensuring that organizations pinning to any specific version received the malicious code.

TEAMPCP CLOUD STEALER — THREE-STAGE PAYLOAD

The TeamPCP cloud stealer is the primary payload deployed across supply chain compromises. Once triggered by package installation or container entrypoint execution, it runs a deliberate three-stage attack designed to maximize credential theft and establish persistence before defenders can respond.

Exfiltrated data is encrypted using a consistent RSA public key signature (a primary TeamPCP fingerprint) and transmitted to the ICP blockchain canister C2. The dropper archive is consistently named tpcp.tar.gz, providing a reliable detection artifact across infections.

CANISTERWORM — DECENTRALIZED WORM AND WIPER

CanisterWorm is the most operationally significant component of TeamPCP’s arsenal and represents the first documented abuse of decentralized blockchain infrastructure for command and control. The worm combines self-propagation, decentralized C2, environmental targeting, and destructive wiper functionality into a single tool that has redefined cloud-native threat capabilities.

The geopolitical targeting of Iran is unexplained in current reporting. Researcher Charlie Eriksen characterized the actor’s behavior as “Chaotic Evil” — a description consistent with an actor blending financially motivated operations with apparently ideological or geopolitical objectives without coherent doctrine. Whether the Iran targeting represents nation-state alignment, ideological positioning, or operator personal motivation is unknown.

ARSENAL AND TOOLING

TeamPCP’s tooling philosophy emphasizes operational scale over technical novelty. The group leans on tried-and-tested techniques — known vulnerabilities, common misconfigurations, existing open-source tools — combined with extensive automation. This approach industrializes exploitation, transforming exposed infrastructure into what researchers describe as a “self-propagating criminal ecosystem.”

DEFENSE EVASION AND PERSISTENCE

• Decentralized Blockchain C2 — ICP canister provides tamper-proof dead-drop. Traditional domain takedowns and IP blocking are ineffective. This is the first documented abuse of decentralized blockchain for malware C2.

• Imposter Commit Attacks — Force-pushing malicious code to existing version tags using compromised service accounts appears as legitimate developer activity in Git history and CI/CD logs.

• Multi-Month Pre-Positioning — Infrastructure established in December 2025 was not activated until March 2026. Defensive teams reviewing only recent activity miss the staging phase.

• Service Masquerading — Malware processes named pgmon (PostgreSQL utility) and disguised as legitimate systemd services to evade endpoint scrutiny.

• WAV Steganography — Encrypted second-stage payloads hidden inside valid audio files bypass content filters and DLP scanning. Files appear benign in transit.

• Self-Signed Certificates — Three unique certs reused across operations provide encrypted channels while avoiding CA-based attribution.

• Pre-install/Post-install npm Injection — Malicious code executes during npm install before any runtime monitoring engages.

• Force-Pushed Git Tags — All historical version tags rewritten simultaneously to ensure version pinning provides no protection.

• Incomplete Credential Rotation Exploitation — TeamPCP exploited Aqua Security’s incomplete credential rotation following a minor February 2026 breach, demonstrating patient observation of victim response.

• Self-Propagating Worm — Stolen npm tokens automatically weaponized without operator intervention. The 47-package npm cascade completed in under 60 seconds.

• Recursive Cloud Token Harvesting — Each compromised CI/CD pipeline yields credentials enabling additional compromises across ecosystems.

• Port 666 Convention — While serving as a detection signature, the consistent use of port 666 for exploitation also reflects deliberate operator branding rather than randomization.

INFRASTRUCTURE PATTERNS

ICP Canister C2 — A Defensive Challenge

The Internet Computer Protocol canister C2 represents a fundamental challenge to traditional threat infrastructure takedown. Unlike domains, IPs, or even bulletproof hosting, ICP canisters operate on a decentralized blockchain — there is no registrar to seize the domain, no hosting provider to terminate the server, and no centralized authority capable of revoking the canister. Defenders must instead rely on detection of canister query patterns, blocking at the network egress layer, or interrupting victim-side resolution. This represents an evolution in threat infrastructure resilience that will likely be adopted by other actors.

ECOSYSTEM AND PARTNERSHIPS

TeamPCP operates within an interconnected cybercrime ecosystem and has formed explicit partnerships that fundamentally amplify its operational reach. The March 2026 partnership announcements transformed TeamPCP from a single threat cluster into a distribution platform feeding multiple ransomware operations.

The Vect Ransomware Mobilization

The Vect ransomware partnership represents an unprecedented operational shift. The model — TeamPCP provides supply chain access, Vect provides encryption and extortion tooling, BreachForums provides 300,000 potential operators — converts a credential-theft operation into industrialized ransomware deployment. If even a small fraction of registered users activate, this could become one of the largest coordinated ransomware affiliate mobilizations observed. Organizations exposed to any TeamPCP-compromised component should assume their stolen credentials may now be in distribution to a large affiliate network and act accordingly.

DETECTION AND HUNTING GUIDANCE

Actionable recommendations for SOC and threat hunting teams to detect and hunt TeamPCP activity:

• [CRITICAL] Block Outbound Port 666 — TeamPCP uses port 666 for nearly all exploitation operations. There is no legitimate enterprise use case for this port. Block at egress and alert on any internal traffic.

• [CRITICAL] Audit CI/CD Credentials — Rotate all GitHub Personal Access Tokens, npm publishing tokens, PyPI credentials, and cloud provider credentials accessible to compromised tools (Trivy, KICS, LiteLLM, Telnyx). Assume compromise if any version was deployed during March 19-27, 2026.

• [CRITICAL] Hunt for tpcp.tar.gz — Search file systems, archives, and CI/CD logs for the dropper filename. Block hash signatures matching the consistent RSA public key.

• [HIGH] Detect ICP Canister C2 — Monitor outbound traffic for connections to Internet Computer Protocol canister endpoints. Block at network egress where legitimate ICP usage is not required.

• [HIGH] Inspect Force-Pushed Git Tags — Audit your CI/CD pipelines for any actions referencing aquasecurity/trivy-action, aquasecurity/setup-trivy, checkmarx/kics-github-action, or checkmarx/ast-github-action. Pin to commit SHA rather than version tag.

• [HIGH] Monitor for pgmon Process — TeamPCP malware masquerades as pgmon. Alert on any pgmon process not associated with a legitimate PostgreSQL deployment.

• [HIGH] Monitor for Privileged Kubernetes DaemonSets — Alert on DaemonSet deployments with privileged security contexts, especially those deploying to all nodes simultaneously.

• [HIGH] Detect WAV Steganography — Monitor file uploads and downloads for WAV files in unusual contexts (e.g., development environments, CI/CD pipelines). Inspect for encrypted payload indicators.

• [MED] Audit systemd Services — Regularly enumerate systemd services and validate against expected baselines. TeamPCP backdoors masquerade as legitimate systemd entries.

• [MED] Detect Imposter Commits — Monitor your repositories for force-pushed tags from service accounts, particularly historical version tags. Alert on bulk tag rewrites.

• [MED] Monitor Cloud API Exposure — Continuously scan for exposed Docker APIs, Kubernetes API servers, Ray dashboards, and Redis instances. Internal exposure to internet is the primary Phase 1 vector.

• [MED] Block React2Shell Exploitation — Patch React/Next.js applications against CVE-2025-55182. Deploy WAF rules detecting exploit patterns.

• [MED] Monitor BreachForums for Organization Mentions — Track BreachForums and TeamPCP Telegram channel for mentions of your organization or partners.

Detection Engineering Notes

• Sigma: Create detections for unusual systemd service creation, particularly those binaries downloaded from non-standard sources or located in temp directories.

• Sigma: Detect Kubernetes API events showing privileged DaemonSet deployments by accounts not part of normal automation.

• YARA: Signature on tpcp.tar.gz archive structure and consistent RSA public key.

• Network: Egress monitoring for ICP canister connection patterns and port 666 traffic.

• Cloud: Alert on unusual cloud token usage geography or volume from CI/CD service accounts.

• CI/CD: Implement signed commit verification and branch protection on all repositories. Disable force-push on protected branches.

INTELLIGENCE GAPS

• Operator Identity — TeamPCP operator nationalities, locations, and identities are unknown. The group operates publicly via Telegram and BreachForums but has not been formally attributed.

• Iran Targeting Motivation — The CanisterWorm wiper component specifically geofences on Iran locale settings and Farsi language packs. Whether this represents nation-state alignment, ideological motivation, operator personal interest, or false flag is unknown.

• Phase 2 Initial Access — While the Aqua Security service account compromise is documented, the precise method by which TeamPCP gained the initial credentials enabling the Trivy attack has not been disclosed.

• Full Victim Enumeration — Beyond AstraZeneca and the publicly disclosed compromised packages, the full list of organizations affected by TeamPCP’s credential cascade is unknown. Mandiant estimates 1,000-10,000 SaaS environments but has not enumerated them.

• Vect Affiliate Activation Rate — Whether the 300,000 BreachForums users who received Vect affiliate keys will activate at scale or whether the partnership has produced significant additional ransomware deployment is not yet measurable.

• ICP Canister Specifics — While ICP-based C2 is documented, the specific canister addresses, authentication mechanisms, and traffic patterns have not been publicly enumerated for blocking purposes.

• Future Targets — TeamPCP’s pattern of compromising security-adjacent tooling suggests additional compromises may be in pre-positioning phase. Future targets are unknown.

• Group Structure — Whether TeamPCP is a single coherent operation or a loose collective sharing infrastructure (similar to “The Com” model) is unclear.

SOURCES

1. Flare / The Hacker News — “TeamPCP Worm Exploits Cloud Infrastructure to Build Criminal Empire” — February 9, 2026

2. Cyble — “TeamPCP Threat Actor Profile” — February 18, 2026

3. SANS Institute — “When the Security Scanner Became the Weapon: Inside the TeamPCP Supply Chain Campaign” — March 25, 2026

4. SANS Internet Storm Center — “TeamPCP Supply Chain Campaign: Update 002 — Telnyx PyPI Compromise, Vect Ransomware Mass Affiliate Program, and First Named Victim Claim” — March 27, 2026

5. Endor Labs — “TeamPCP Isn’t Done: Threat Actor Behind Trivy and KICS Compromise Targets LiteLLM” — March 30, 2026

6. Cloud Security Alliance — “TeamPCP: Cascading Supply Chain Attack on AI/ML Tooling” — March 30, 2026

7. Unit 42 (Palo Alto Networks) — “TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure” — March 31, 2026

8. JohnZBlack — “TeamPCP’s Criminal Empire Is Growing and Nobody Agrees Who’s Responsible” — April 5, 2026

9. Recorded Future / Insikt Group — “Your Supply Chain Breach Is Someone Else’s Payday” — April 15, 2026

10. SOC Prime — “TeamPCP Targets Cloud Workloads for Extortion” — April 21, 2026

11. Beelzebub — “Operation PCPcat” (initial documentation) — December 2025