TeamPCP

TeamPCP is a financially motivated cybercriminal threat actor active since at least late 2025 and widely tracked for large-scale software supply-chain intrusions, cloud credential theft, and follow-on extortion activity. Known aliases include DeadCatx3, PCPcat, Persy_PCP, ShellForce, Storm-2999, Team_PCP, and UNC6780. The group has also been associated with the Shai-Hulud campaign name and with the CanisterWorm propagation component used in parts of its operations. The actor initially drew attention through opportunistic exploitation of exposed or misconfigured cloud services, including Docker and Kubernetes environments, before evolving into a more consequential campaign centered on trusted developer tooling and CI/CD infrastructure. In March 2026, TeamPCP was linked to a cascading supply-chain operation that compromised multiple widely used projects and ecosystems, including Aqua Security Trivy, Checkmarx GitHub Actions and related components, and LiteLLM, with subsequent expansion into additional package ecosystems. A defining characteristic of this campaign was credential chaining: secrets stolen from one victim’s CI/CD environment were reused to compromise upstream maintainers, downstream projects, or adjacent software publishers, enabling rapid lateral expansion across trust relationships. TeamPCP’s tradecraft consistently emphasized credential harvesting from ephemeral build environments, developer systems, and cloud workloads. Observed payloads harvested GitHub and other CI/CD tokens, cloud provider credentials, SSH material, Kubernetes configuration and service-account data, package publishing credentials, environment files, database secrets, API keys, and other sensitive artifacts. The group repeatedly targeted security-adjacent and developer-centric tools because those products commonly execute in privileged environments with broad access to secrets and infrastructure. In CI/CD contexts, TeamPCP was observed abusing mutable release tags and poisoned package releases to execute malicious code while preserving normal workflow output, increasing dwell time and reducing immediate detection. A notable technical hallmark of TeamPCP operations is memory scraping of CI runner processes to recover secrets that would otherwise evade simple file-based collection. Additional recurring behaviors include broad filesystem credential discovery, encrypted staging of stolen data, fallback exfiltration through victim-controlled developer platforms, and persistence mechanisms on non-ephemeral Linux hosts using user-level service installation. Some reporting also links the actor to resilient command-and-control or dead-drop patterns leveraging decentralized infrastructure. Beyond credential theft, TeamPCP has been associated with worm-like propagation across software ecosystems and cloud-native environments. CanisterWorm, attributed in multiple reports to the group, used stolen package publishing credentials to spread malicious updates across npm and related environments. TeamPCP activity has also been tied to Kubernetes-focused post-compromise actions, including privileged workload deployment for persistence and lateral movement. Some reporting describes destructive functionality or locale-gated wiping behavior in certain campaign phases, indicating the actor’s operations can extend beyond espionage and theft into sabotage under selected conditions. The group’s operations have had significant downstream impact on enterprises and public-sector organizations because compromised tools were embedded in CI/CD pipelines and production workflows at scale. Public reporting has linked TeamPCP-enabled credential theft to major secondary breaches, including compromises of large SaaS and governmental environments. The actor has also been connected to data-only extortion and to monetization partnerships with ransomware or extortion actors, particularly Vect, suggesting an operational model in which supply-chain compromise and credential harvesting serve as scalable initial access for later extortion. Overall, TeamPCP is best characterized as a fast-moving, financially motivated intrusion set that operationalized software supply-chain compromise, CI/CD secret theft, and credential cascade effects into a broad access-and-extortion model. Its most distinctive features are sequential compromise of trusted developer infrastructure, aggressive reuse of stolen credentials across ecosystems, and targeting of cloud-native build and deployment environments where a single poisoned dependency can expose large numbers of downstream organizations.