Loading story…
Researchers reported that TeamPCP has expanded its cloud-native malware operations by adding a destructive payload to its CanisterWorm toolkit. The malware checks whether it is running in Kubernetes and whether the host appears configured for Iran based on timezone or locale, then selects one of four paths: wiping Iranian Kubernetes environments, deploying the CanisterWorm backdoor in non-Iranian Kubernetes environments, wiping local non-Kubernetes Iranian systems, or doing nothing elsewhere. In Kubernetes, the wiper deploys a privileged DaemonSet that mounts the host root filesystem, deletes top-level directories, and forces node reboots, effectively bricking the cluster.
Researchers linked the payload to earlier CanisterWorm activity through shared ICP canister command-and-control infrastructure, overlapping backdoor code, the /tmp/pglog path, and the same DaemonSet-based propagation model. Reporting also said newer variants broaden propagation by harvesting SSH-related data and scanning for exposed Docker APIs on port 2375, raising the risk of spread across containerized and cloud environments. Defenders were urged to review Kubernetes DaemonSets, suspicious services and file paths, block outbound access to icp0[.]io domains, secure Docker APIs, rotate SSH keys, and inspect SSH logs for signs of lateral movement.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
Subsequent variants expanded propagation by collecting SSH-related data and scanning for exposed Docker APIs on port 2375. These additions increased the potential for the malware to spread destructively across cloud and containerized environments.
Aikido attributed the destructive payload to TeamPCP by tying it to the established CanisterWorm campaign through shared ICP canister C2 infrastructure, overlapping backdoor code, the /tmp/pglog path, and similar DaemonSet-based Kubernetes tradecraft. The report also published technical indicators including DaemonSet names, service names, file paths, and network observables for detection.
In Kubernetes environments identified as Iranian, the malware deploys a privileged DaemonSet that mounts the host root filesystem, deletes top-level directories, and force reboots nodes, effectively bricking the cluster. This marked an escalation from TeamPCP's prior persistence- and credential-theft-focused activity to destructive operations.
Researchers identified a new TeamPCP payload that checks whether it is running in Kubernetes and whether the host appears configured for Iran via timezone or locale. Based on those checks, it either wipes Iranian systems, deploys the CanisterWorm backdoor in non-Iranian Kubernetes environments, wipes local non-Kubernetes Iranian systems, or does nothing elsewhere.
In January 2026, TeamPCP used its Telegram channels to claim a breach of Vietnam's JobsGO and leak 2,325,285 candidate records. The disclosure showed the group pairing cloud intrusions with public extortion and data-leak operations.
In December 2025, TeamPCP began a large-scale campaign targeting exposed Docker APIs, Kubernetes clusters, Ray dashboards, Redis servers, and React2Shell-vulnerable applications. The operation used automated worm-like tooling to spread across cloud workloads, deploy persistence, exfiltrate data, run XMRig miners, and establish proxy and C2 infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
databreaches.net
Open sourcetomshardware.com
Open sourcecybersecuritynews.com
Open sourcecstromblad.com
Open sourceaikido.dev
Open sourceflare.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a worm-enabled npm supply-chain attack dubbed **CanisterWorm** that backdoored at least 29 legitimate packages, including 28 in the `@EmilGroup` scope and `@teale.io/eslint-config`. The attackers appear to have used stolen npm publishing tokens or equivalent CI/CD access to replace package contents, republish trojanized updates under the latest tag, and spread the malware across additional packages available to the compromised credentials. Aikido linked the activity to **TeamPCP** and assessed it as a likely follow-on from the earlier Trivy compromise, while Socket said the operation showed high-confidence signs of a legitimate publisher-space takeover with worm-like propagation. The infection chain used a Node.js `postinstall` loader, a Python backdoor, and an Internet Computer Protocol canister as a dead-drop command-and-control channel for dynamic payload delivery. On Linux, the malware established persistence through a user-level systemd service, disguised files as PostgreSQL-related artifacts, delayed execution to evade sandboxing, and used a propagation script to enumerate publishable packages, bump patch versions, preserve READMEs, and publish malicious updates at scale. At the time of reporting, the ICP canister returned a Rickroll URL as a dormant kill switch, but researchers warned it could be changed at any time to deliver a real second-stage binary to developers, CI runners, and build systems that installed the compromised packages.
Jun 29, 2026
Security researchers reported multiple malware operations abusing exposed cloud services and misconfigurations to seize control of Kubernetes and containerized environments. FortiGuard Labs said the **P2PInfect** botnet compromised Google Kubernetes Engine clusters by targeting internet-exposed Redis instances, abusing replication through the `SLAVEOF` command and, in some cases, leveraging `CVE-2022-0543` for remote code execution. The Rust-based malware uses a decentralized peer-to-peer architecture, non-standard ports, and long-lived dormant infections that can persist for months, creating a foothold for later delivery of ransomware, cryptominers, or other payloads. Separate reporting tied the activity to a broader rise in cloud-focused criminal operations that exploit known flaws and weak configurations rather than zero-days. Cyble profiled **TeamPCP** as a large-scale actor targeting Docker APIs, Kubernetes components, Ray dashboards, and Redis to convert victim infrastructure into proxy, command-and-control, ransomware, and Monero mining nodes. Researchers also described a newer framework, **PCPJack**, that appears to piggyback on already compromised cloud environments by wiping TeamPCP artifacts, stealing secrets from AWS, Docker, Kubernetes, GitHub, Slack, Office 365, and other services, and exfiltrating encrypted data to Telegram while spreading worm-like across exposed Docker, Kubernetes, Redis, MongoDB, and RayML services.
Jun 29, 2026
Researchers linked **TeamPCP** to multiple interconnected intrusion campaigns spanning web application exploitation, software supply-chain abuse, and infrastructure hijacking. Reporting on the **Operation PCPcat** and **React2Shell** activity said attackers exploited vulnerable **Next.js** deployments and compromised roughly **59,000 servers**, using them to steal credentials and build follow-on access. Separate investigations into the **CanisterWorm** campaign found dozens of malicious **npm** packages carrying hidden `postinstall` scripts that stole npm tokens from `.npmrc`, `/etc/npmrc`, and environment variables, then republished trojanized updates through victims’ own publisher accounts. The malware also established Linux persistence with a masqueraded user-level `systemd` service named **`pgmon`** and fetched later-stage payloads through **Internet Computer** canister infrastructure, complicating takedown efforts. Additional reporting tied the broader operation to compromised CI/CD ecosystems, residential proxy building, and ransomware monetization. An investigation into the **Xygeni GitHub Action** compromise found the same custom **ShadowLink** backdoor protocol used in malware that exploited **TP-Link** and **ASUS** routers, including abuse of **`CVE-2024-21833`** to install **microsocks** and maintain SOCKS5 proxy persistence via cron, `rc.local`, and NVRAM changes; researchers said this strongly links the router campaign to the Xygeni intrusion, while overlap with TeamPCP remains partly circumstantial. By late March, defenders reported TeamPCP had slowed new package compromises and shifted toward monetization through harvested credentials and dual ransomware tracks, including its own **CipherForce** operation and activity aligned with the **Vect** ransomware ecosystem; related fallout included **ownCloud** disclosing build infrastructure exposure through **`CVE-2026-33634`** associated with the Trivy compromise.
Jun 29, 2026