Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
TeamPCP successfully compromised packages across the npm and PyPI ecosystems, distributing a highly advanced, self-propagating variant of the TeamPCPCloudStealer malware.
13 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development Compromise Infrastructure: Web Services T1584.006 TeamPCP leverages victim npm and GitHub accounts to publish further malicious artifacts and propagate the infection.
Initial Access Supply Chain Compromise: Compromise Software Supply Chain T1195.002 Attackers compromised official Docker Hub images (checkmarx/kics) and OpenVSX extensions (ast-results, cx-dev-assist).
Execution Command and Scripting Interpreter: JavaScript T1059.007 The payload downloads and utilizes the legitimate Bun JavaScript runtime (bun or bun.exe) to execute the stealer script.
Defense Evasion Obfuscated Files or Information T1027 The JavaScript payloads (mcpAddon.js) are heavily obfuscated to deter reverse engineering and detection.
Credential Access Unsecured Credentials: Credentials In Files T1552.001 The malware targets secrets stored in environment variables, .npmrc files, SSH configurations, and AWS secret manager files.
Discovery System Network Configuration Discovery T1016 The stealer gathers and exfiltrates local network configuration details from the compromised host.
Discovery System Owner/User Discovery T1033 TeamPCPCloudStealer collects system user information and shell histories (bash, zsh).
Discovery Container and Resource Discovery T1613 The malware identifies cloud resources from providers such as Google Cloud Platform (GCP) and Azure.
Collection Data from Cloud Storage T1530 The stealer specifically targets and collects data stored within cloud infrastructure (e.g., Azure Key Vault).
Command and Control Fallback Channels T1008 The malware implements fallback mechanisms to retrieve active C2 domains if the primary telemetry domain is offline.
Command and Control Application Layer Protocol: Web Protocols T1071.001 Exfiltration and C2 communications occur over standard HTTP/HTTPS POST requests.
Command and Control Web Service: Dead Drop Resolver T1102.001 The payload queries the GitHub Search API for the keyword beautifulcastle to dynamically find commits hosting fallback C2 URLs.
Exfiltration Exfiltration Over C2 Channel T1041 Stolen data is encrypted using an embedded RSA or AES-256-GCM key and exfiltrated to the attacker’s C2 server.
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.