FIRESCALE
FIRESCALE is a fallback command-and-control/dead-drop mechanism used within a 13-file Python second-stage toolkit attributed to TeamPCP and deployed after a supply-chain compromise in the Mini Shai-Hulud campaign. The toolkit targets Linux developer environments, exits on non-Linux systems, and includes anti-analysis checks that terminate execution on Russian-locale systems or hosts with four or fewer CPU cores. Its primary C2 is hardcoded as 83.142.209[.]194; FIRESCALE activates only when that primary address is unreachable, providing operational resilience after C2 disruption. According to the reporting, FIRESCALE queries GitHub’s commit search API at api.github[.]com/search/commits?q=FIRESCALE to obtain alternate C2 information and verifies redirect data with an embedded 4096-bit RSA public key. If both the primary C2 and FIRESCALE path fail, the toolkit falls back again to victim-hosted exfiltration by abusing the victim’s own GitHub account, creating a public repository and uploading stolen data as JSON. The broader toolkit establishes persistence via a systemd service named pgsql-monitor.service, runs 13 modular Python collectors in parallel, and steals credentials and secrets from local files, environment variables, SSH material, Docker containers, password managers, AWS, Azure, GCP, Kubernetes, HashiCorp Vault, package registries, CI/CD systems, VPN configs, Terraform state, and AI coding tools. Collected data is compressed, encrypted with AES-256-GCM, and the session key is wrapped with 4096-bit RSA-OAEP before exfiltration. The reporting also describes a wiper component tied to the same toolkit that checks for Israeli or Iranian indicators and, with a 1-in-6 probability when triggered, downloads RunForCover.mp3 from C2, plays it at maximum volume, and deletes accessible files; Russian-locale systems exit before payload execution. High-confidence infrastructure and indicators mentioned in the content include 83.142.209[.]194, GitHub commit-search use for "FIRESCALE," the persistence service name pgsql-monitor.service, and additional linked IPs 83.142.209[.]11, 83.142.209[.]203, 35.192.220[.]222, 34.66.134[.]145, 35.188.190[.]218, and 136.115.211[.]254.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Hunt.io analyzes the 13-file Python toolkit TeamPCP deploys after a supply chain compromise, documenting FIRESCALE, victim-hosted exfiltration, and infrastructure pivots that prior vendor reporting missed.
Techniques & procedures
10 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 techniqueHow TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account
Initial Access
2 techniquesHow TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account
Hunt.io analyzes the 13-file Python toolkit TeamPCP deploys after a supply chain compromise...
Persistence
1 techniquePrivilege Escalation
1 techniqueStealth
1 techniqueCommand and Control
5 techniquesHow TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account
How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account
How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account
Hunt.io analyzes the 13-file Python toolkit TeamPCP deploys after a supply chain compromise...
...documenting FIRESCALE, victim-hosted exfiltration, and infrastructure pivots that prior vendor reporting missed.
Exfiltration
2 techniques...documenting FIRESCALE, victim-hosted exfiltration...
...documenting FIRESCALE, victim-hosted exfiltration, and infrastructure pivots...
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
FIRESCALE is referenced as part of TeamPCP's post-compromise Python toolkit and is associated with victim-hosted exfiltration and infrastructure pivoting after a supply chain compromise.
A named component of TeamPCP's post-compromise 13-file Python toolkit, associated with surviving C2 takedowns and using victim-hosted exfiltration and infrastructure pivots.
A named Python-based toolkit used by TeamPCP after a supply chain compromise, notable for surviving C2 takedowns through victim-hosted exfiltration and infrastructure pivots.
A named component/tool in TeamPCP's post-compromise Python toolkit, associated with victim-hosted exfiltration and infrastructure pivoting after a supply chain compromise.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.