MalwareUsed by 1 actorExploits 1 CVE

TeamPCP infostealer

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2026-33634Trivy ecosystem supply chain compromiseExploited in the wild

The attack is now being tracked under the CVE identifier CVE-2026-33634 (CVSS score: 9.4). "The mechanics here weren't novel. The attacker, with write access to the repository, force-pushed tags to a new commit containing a modified entry point and relied on the fact that most workflows reference actions by tag," CrowdStrike said.

via the hacker newsthehackernews.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

TeamPCP

The project has also recently been targeted in a supply-chain attack, where TeamPCP hackers released malicious PyPI packages that deployed an infostealer to harvest credentials, tokens, and secrets from infected systems.

via bleeping computerbleepingcomputer.com

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1195Supply Chain CompromiseEvidence5

On March 19, 2026, threat actors compromised Aqua Security's Trivy vulnerability scanner version 0.69.4, injecting credential-stealing malware into official releases and GitHub Actions.

T1195.001Compromise Software Dependencies and Development ToolsEvidence2

A new set of compromised Docker images linked to the Trivy supply chain attack has been identified... additional malicious artifacts were distributed through Docker Hub after attackers gained access through a GitHub Actions compromise.

Execution

1 technique

T1574Hijack Execution FlowEvidence1

Aqua Security... confirmed the team identified additional suspicious activity on Sunday, March 22, involving unauthorized changes and repository tampering.

Stealth

2 techniques

T1036MasqueradingEvidence1

Aqua Security... confirmed the team identified additional suspicious activity on Sunday, March 22, involving unauthorized changes and repository tampering.

T1574Hijack Execution FlowEvidence1

Aqua Security... confirmed the team identified additional suspicious activity on Sunday, March 22, involving unauthorized changes and repository tampering.

Command and Control

1 technique

T1071Application Layer ProtocolEvidence2

The malicious binaries contained typosquatted command-and-control (C2) domains, exfiltration files and references to attacker-controlled repositories used during the campaign.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

The malicious binaries contained typosquatted command-and-control (C2) domains, exfiltration files and references to attacker-controlled repositories used during the campaign.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app15 days ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

bleeping computerNews

Apr 28, 2026

Hackers are exploiting a critical LiteLLM pre-auth SQLi flaw

An infostealer delivered via malicious PyPI packages in a supply-chain attack targeting LiteLLM users, used to harvest credentials, tokens, and secrets from infected systems.

the hacker newsNews

Mar 23, 2026

Trivy Hack Spreads Infostealer via Docker, Triggers Worm and Kubernetes Wiper

An infostealer used in the Trivy supply chain compromise to steal credentials and other data from trojanized Trivy releases and related GitHub Actions.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actorExploits 1 CVE

TeamPCP infostealer

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2026-33634Trivy ecosystem supply chain compromiseExploited in the wild

via the hacker newsthehackernews.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

TeamPCP

via bleeping computerbleepingcomputer.com

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1195Supply Chain CompromiseEvidence5

On March 19, 2026, threat actors compromised Aqua Security's Trivy vulnerability scanner version 0.69.4, injecting credential-stealing malware into official releases and GitHub Actions.

T1195.001Compromise Software Dependencies and Development ToolsEvidence2

Execution

1 technique

T1574Hijack Execution FlowEvidence1

Aqua Security... confirmed the team identified additional suspicious activity on Sunday, March 22, involving unauthorized changes and repository tampering.

Stealth

2 techniques

T1036MasqueradingEvidence1

Aqua Security... confirmed the team identified additional suspicious activity on Sunday, March 22, involving unauthorized changes and repository tampering.

T1574Hijack Execution FlowEvidence1

Aqua Security... confirmed the team identified additional suspicious activity on Sunday, March 22, involving unauthorized changes and repository tampering.

Command and Control

1 technique

T1071Application Layer ProtocolEvidence2

The malicious binaries contained typosquatted command-and-control (C2) domains, exfiltration files and references to attacker-controlled repositories used during the campaign.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

The malicious binaries contained typosquatted command-and-control (C2) domains, exfiltration files and references to attacker-controlled repositories used during the campaign.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app15 days ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

bleeping computerNews

Apr 28, 2026

Hackers are exploiting a critical LiteLLM pre-auth SQLi flaw

An infostealer delivered via malicious PyPI packages in a supply-chain attack targeting LiteLLM users, used to harvest credentials, tokens, and secrets from infected systems.

the hacker newsNews

Mar 23, 2026

Trivy Hack Spreads Infostealer via Docker, Triggers Worm and Kubernetes Wiper

An infostealer used in the Trivy supply chain compromise to steal credentials and other data from trojanized Trivy releases and related GitHub Actions.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.