Skip to main content
Mallory
MalwareUsed by 1 actor

FIRESCALE

FIRESCALE is a fallback command-and-control/dead-drop mechanism used within a 13-file Python second-stage toolkit attributed to TeamPCP and deployed after a supply-chain compromise in the Mini Shai-Hulud campaign. The toolkit targets Linux developer environments, exits on non-Linux systems, and includes anti-analysis checks that terminate execution on Russian-locale systems or hosts with four or fewer CPU cores. Its primary C2 is hardcoded as 83.142.209[.]194; FIRESCALE activates only when that primary address is unreachable, providing operational resilience after C2 disruption. According to the reporting, FIRESCALE queries GitHub’s commit search API at api.github[.]com/search/commits?q=FIRESCALE to obtain alternate C2 information and verifies redirect data with an embedded 4096-bit RSA public key. If both the primary C2 and FIRESCALE path fail, the toolkit falls back again to victim-hosted exfiltration by abusing the victim’s own GitHub account, creating a public repository and uploading stolen data as JSON. The broader toolkit establishes persistence via a systemd service named pgsql-monitor.service, runs 13 modular Python collectors in parallel, and steals credentials and secrets from local files, environment variables, SSH material, Docker containers, password managers, AWS, Azure, GCP, Kubernetes, HashiCorp Vault, package registries, CI/CD systems, VPN configs, Terraform state, and AI coding tools. Collected data is compressed, encrypted with AES-256-GCM, and the session key is wrapped with 4096-bit RSA-OAEP before exfiltration. The reporting also describes a wiper component tied to the same toolkit that checks for Israeli or Iranian indicators and, with a 1-in-6 probability when triggered, downloads RunForCover.mp3 from C2, plays it at maximum volume, and deletes accessible files; Russian-locale systems exit before payload execution. High-confidence infrastructure and indicators mentioned in the content include 83.142.209[.]194, GitHub commit-search use for "FIRESCALE," the persistence service name pgsql-monitor.service, and additional linked IPs 83.142.209[.]11, 83.142.209[.]203, 35.192.220[.]222, 34.66.134[.]145, 35.188.190[.]218, and 136.115.211[.]254.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
TeamPCP

Hunt.io analyzes the 13-file Python toolkit TeamPCP deploys after a supply chain compromise, documenting FIRESCALE, victim-hosted exfiltration, and infrastructure pivots that prior vendor reporting missed.

via app huntapp.hunt.io
MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

T1583.006Web ServicesEvidence2

How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account

Initial Access

2 techniques
T1078Valid AccountsEvidence1

How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account

T1195Supply Chain CompromiseEvidence14

Hunt.io analyzes the 13-file Python toolkit TeamPCP deploys after a supply chain compromise...

Persistence

1 technique
T1078Valid AccountsEvidence1

How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account

T1078Valid AccountsEvidence1

How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account

Stealth

1 technique
T1078Valid AccountsEvidence1

How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account

T1008Fallback ChannelsEvidence1

How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account

T1071Application Layer ProtocolEvidence9

How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account

T1102Web ServiceEvidence3

How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account

T1105Ingress Tool TransferEvidence7

Hunt.io analyzes the 13-file Python toolkit TeamPCP deploys after a supply chain compromise...

T1568Dynamic ResolutionEvidence1

...documenting FIRESCALE, victim-hosted exfiltration, and infrastructure pivots that prior vendor reporting missed.

Exfiltration

2 techniques
T1537Transfer Data to Cloud AccountEvidence2

...documenting FIRESCALE, victim-hosted exfiltration...

T1567Exfiltration Over Web ServiceEvidence10

...documenting FIRESCALE, victim-hosted exfiltration, and infrastructure pivots...

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting
ip.v4●●●●●●●●●●●●View more in app15 days ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.