SANDCLOCK
SANDCLOCK is a credential stealer payload associated with the financially motivated threat group TeamPCP, formally tracked by Google Threat Intelligence Group as UNC6780. According to the provided reporting, it was deployed in software supply-chain compromises involving poisoned GitHub Actions and trojanized PyPI packages tied to projects including Trivy, Checkmarx, LiteLLM, and Telnyx. Its primary documented function is harvesting secrets from developer and CI/CD build environments, specifically including AWS keys and GitHub tokens. The stolen credentials were then monetized through follow-on extortion activity and partnerships with ransomware affiliates. The content consistently describes SANDCLOCK as TeamPCP/UNC6780’s credential-stealer payload used to facilitate downstream compromise of SaaS and development environments. High-confidence indicators in the content are limited to its targeting of build environments and theft of AWS keys and GitHub tokens; no specific file hashes, domains, or host-based artifacts for SANDCLOCK itself are provided.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
BleepingComputer reported that threat actors leveraged credentials stolen through the Trivy supply chain compromise (CVE-2026-33634) to breach Cisco's internal development environment... The CISA KEV remediation deadline for CVE-2026-33634 is today, April 8, 2026... Beyond patching Trivy to v0.69.2+, trivy-action to v0.35.0, or setup-trivy to v0.2.6, organizations must also complete credential rotation.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The payload was a credential stealer called SANDCLOCK that extracted AWS keys and GitHub tokens from build environments, and those credentials were then handed to ransomware affiliates for monetization.
Techniques & procedures
17 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
4 techniques
Initial Access
threat actors leveraged credentials stolen through the Trivy supply chain compromise... to breach Cisco's internal development environment.
The attackers gained access to build systems and developer workstations through a malicious GitHub Action plugin.
Execution
1 technique
Execution
Persistence
2 techniques
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
1 technique
Stealth
Credential Access
6 techniques
Credential Access
GTIG also named TeamPCP's credential stealer payload as SANDCLOCK.
The payload was a credential stealer called SANDCLOCK that extracted AWS keys and GitHub tokens from build environments
The payload swept AWS credentials, Google Cloud configurations, Kubernetes tokens, environment variables, SSH keys, API keys, and database credentials, exfiltrating to hxxps://whereisitat[.]lucyatemysuperbox[.]space/.
Collection
3 techniques
Collection
The payload swept AWS credentials, Google Cloud configurations, Kubernetes tokens, environment variables, SSH keys, API keys, and database credentials... The malicious payload ... exfiltrated GitHub tokens, npm tokens, SSH material, AWS/GCP/Azure secrets, GitHub Actions secrets, and AI tooling configuration files.
Exfiltration
3 techniques
Exfiltration
CERT-EU revealed that the threat actors used the stolen AWS secret to exfiltrate data from the Commission's cloud environment. This included data relating to websites hosted for up to 71 clients of the Europa web hosting service and outbound email communications.
Over 300 private GitHub repositories containing Cisco source code were cloned... AWS keys were stolen and used for unauthorized activities across Cisco's cloud accounts
The malicious payload contained the string "Shai-Hulud: The Third Coming" ... and exfiltrated GitHub tokens, npm tokens, SSH material, AWS/GCP/Azure secrets, GitHub Actions secrets, and AI tooling configuration files to public GitHub repositories created under victim accounts.
IOCs tracked for this family
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
Recent activity
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A credential stealer used in software supply chain compromises to extract AWS keys and GitHub tokens from build environments.
Credential stealer used to harvest AWS keys and GitHub tokens from CI/CD build environments. The stolen credentials were then monetized through ransomware and extortion partnerships.
A credential stealer associated with UNC6780/TeamPCP activity.
A credential stealer associated with UNC6780/TeamPCP activity.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.