TeamPCP

TeamPCP is a financially motivated cybercriminal threat actor known for large-scale compromises of cloud-native infrastructure and the open-source software supply chain. The group has been publicly active since late 2025 and is assessed by some researchers to have operational history reaching back to at least 2020. Known aliases include deadcatx3, pcpcat, persypcp, shellforce, storm_2999, team_pcp, teampcp_unc6780, and unc6780. TeamPCP has also been linked to activity clusters referred to as IronErn, ShadowRay 2.0, TA-NATALSTATUS, and Operation PCPcat. TeamPCP initially focused on opportunistic exploitation of exposed or misconfigured internet-facing services, including Docker, Kubernetes, Redis, Ray, and React or Next.js-related weaknesses. Early operations included credential theft, cryptocurrency mining, botnet-style propagation, and compromise of AI-related infrastructure. The actor has repeatedly used automated and wormable exploitation to scale intrusions, and has shown a pattern of rapidly adapting payloads and infrastructure. In 2026, TeamPCP became especially notable for aggressive software supply-chain attacks affecting widely used developer and security tooling. High-confidence reporting links the group to compromises involving Trivy, Checkmarx KICS, LiteLLM, the Telnyx Python SDK, and broad npm package poisoning campaigns. TeamPCP abused stolen GitHub and npm credentials, misconfigured CI/CD workflows, mutable release tags, and trusted publishing paths to distribute credential-stealing malware through legitimate package and release channels. Malware associated with the group, including Shai-Hulud and Mini Shai-Hulud lineages, harvested cloud credentials, GitHub tokens, SSH keys, Kubernetes secrets, Terraform data, Vault tokens, and CI/CD secrets from developer workstations and build environments, then used stolen publish credentials to republish additional malicious packages and expand laterally across maintainers and ecosystems. The actor’s tradecraft includes initial access through exposed services and CI/CD workflow abuse, persistence via user-level services and backdoors, credential theft from disk and process memory, exfiltration using encrypted archives, decentralized or resilient command-and-control mechanisms, and self-propagating worms across package ecosystems and Kubernetes environments. TeamPCP has also demonstrated destructive capability: newer malware variants reportedly included wiper-like logic that selectively targeted systems associated with Iran, while deploying alternate backdoor or worm functionality elsewhere. TeamPCP’s operations have had substantial downstream impact on enterprise SaaS and cloud environments because the group targeted foundational developer dependencies and security tools embedded in automated pipelines. The actor has also been linked to ransomware monetization and extortion through cooperation with Vect, and reporting indicates use of stolen access and data to support double-extortion activity. Overall, TeamPCP is characterized by rapid, noisy, high-scale campaigns that prioritize credential theft, propagation, and monetization over stealth.