Loading story…
Palo Alto Networks Unit 42 reported that TeamPCP has conducted a multi-stage supply chain campaign aimed at security infrastructure providers, describing a pattern in which the actor compromises organizations that sit inside customer build, deployment, and protection workflows. The activity highlights the risk of attacking trusted security tooling and cloud-connected platforms to gain access to downstream environments, internal architecture, and sensitive operational data.
A later dark web listing tied a campaign called CanisterWorm to the same actor set, with a seller using the name xpl0itrs claiming to offer data allegedly stolen from RapidFort, a container hardening and software supply chain security vendor, for $40,000. The unverified listing advertised 569GB of data across 140,061 files from 48 S3 buckets, including hardening pipelines, vulnerability database pipelines, scanner backends, DevOps infrastructure, billing exports, plaintext cloud credentials, Kubernetes kubeconfig files, and private keys; if authentic, the exposure could create follow-on intrusion opportunities because RapidFort reportedly operates within customer CI/CD environments and may hold cross-account access into customer cloud estates.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
A threat actor using the name xpl0itrs advertised the alleged sale of data purportedly stolen from RapidFort for $40,000. The listing claimed 569GB of data from 48 S3 buckets and associated the intrusion with the CanisterWorm campaign linked to TeamPCP.
The Cloud Security Alliance reference says credentials stolen during TeamPCP's March 2026 supply-chain activity were later used to breach Cisco's development environment. The intrusion allegedly led to the exfiltration of more than 300 internal repositories, including code for Cisco AI Assistant and Cisco AI Defense.
The CSIRT.SK reference links TeamPCP to a destructive campaign using CanisterWorm logic to wipe Iranian Kubernetes clusters. It describes this as part of the group's broader infrastructure attacks against exposed Docker API, Kubernetes, Redis, and Ray environments.
On 2026-04-22, attackers tampered with Checkmarx KICS Docker images and maliciously published @bitwarden/cli@2026.4.0 to npm. Both payloads reportedly exfiltrated harvested credentials to an attacker-controlled domain impersonating Checkmarx.
Unit 42 reported on a campaign by TeamPCP involving multi-stage supply chain attacks targeting security infrastructure. The reference describes the operation as weaponizing trusted security tooling and infrastructure providers.
Telnyx published a security notice stating that malicious versions of the Telnyx Python SDK were identified on PyPI in March 2026. This adds Telnyx as an affected package ecosystem victim in the broader supply-chain intrusion story.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
darkwebinformer.com
Open sourcelabs.cloudsecurityalliance.org
Open sourcecsirt.sk
Open sourcesemgrep.dev
Open sourcepartner.gurucul.com
Open sourceunit42.paloaltonetworks.com
Open sourcetelnyx.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
TeamPCP has expanded a multi-ecosystem software supply chain campaign that compromised open-source security and developer tools including **Trivy**, **Checkmarx KICS**, **LiteLLM**, **Telnyx**, GitHub Actions, OpenVSX extensions, Docker images, and packages published through **PyPI** and **npm**. Reporting indicates the attackers used stolen developer and publishing credentials to push malicious releases through trusted channels, harvest environment variables, shell histories, cloud credentials, and GitHub tokens, and move laterally across CI/CD environments. In the Telnyx incident, valid credentials were reportedly used to publish malicious PyPI releases, with a second-stage payload hidden in a WAV file and code triggered on import. The campaign is now being linked to follow-on ransomware activity through an alleged partnership between TeamPCP and the **Vect** ransomware group, which has been advertised on BreachForums as an emerging ransomware-as-a-service operation. Researchers say the supply chain compromises may serve as initial access for extortion campaigns against downstream organizations, with TeamPCP reportedly recruiting negotiators after the Trivy breach and previously exfiltrating roughly **300 GB** of compressed credentials; the LiteLLM compromise alone was tied to hundreds of thousands of stolen credentials. The incidents underscore how compromised open-source tooling and CI/CD infrastructure can give attackers privileged enterprise access and create a path from package poisoning to ransomware deployment.
Aug 6, 2026
Researchers linked **TeamPCP** to multiple interconnected intrusion campaigns spanning web application exploitation, software supply-chain abuse, and infrastructure hijacking. Reporting on the **Operation PCPcat** and **React2Shell** activity said attackers exploited vulnerable **Next.js** deployments and compromised roughly **59,000 servers**, using them to steal credentials and build follow-on access. Separate investigations into the **CanisterWorm** campaign found dozens of malicious **npm** packages carrying hidden `postinstall` scripts that stole npm tokens from `.npmrc`, `/etc/npmrc`, and environment variables, then republished trojanized updates through victims’ own publisher accounts. The malware also established Linux persistence with a masqueraded user-level `systemd` service named **`pgmon`** and fetched later-stage payloads through **Internet Computer** canister infrastructure, complicating takedown efforts. Additional reporting tied the broader operation to compromised CI/CD ecosystems, residential proxy building, and ransomware monetization. An investigation into the **Xygeni GitHub Action** compromise found the same custom **ShadowLink** backdoor protocol used in malware that exploited **TP-Link** and **ASUS** routers, including abuse of **`CVE-2024-21833`** to install **microsocks** and maintain SOCKS5 proxy persistence via cron, `rc.local`, and NVRAM changes; researchers said this strongly links the router campaign to the Xygeni intrusion, while overlap with TeamPCP remains partly circumstantial. By late March, defenders reported TeamPCP had slowed new package compromises and shifted toward monetization through harvested credentials and dual ransomware tracks, including its own **CipherForce** operation and activity aligned with the **Vect** ransomware ecosystem; related fallout included **ownCloud** disclosing build infrastructure exposure through **`CVE-2026-33634`** associated with the Trivy compromise.
Jun 29, 2026
The FBI issued a FLASH warning that **TeamPCP** is carrying out large-scale software supply chain compromises by trojanizing trusted developer and security tools, including **Trivy**, **KICS**, **LiteLLM**, and the **Telnyx Python SDK**. The campaign is designed to infiltrate CI/CD pipelines, cloud infrastructure, and security workflows, then steal high-value secrets such as cloud access tokens, API keys, SSH keys, and Kubernetes secrets. Reporting tied to the alert describes TeamPCP as a financially motivated group whose operations show persistence and scale more commonly associated with advanced threat actors. Authorities and researchers said the activity is linked to malware families including **CanisterWorm**, **SANDCLOCK**, **Mini Shai-Hulud**, and **Miasma**, which were used to establish persistence, exfiltrate credentials, and spread access into downstream victim environments. The FBI said the group has also engaged in extortion, published victim names on a leak site, and collaborated with other threat actors, raising the risk that stolen credentials will be reused long after the initial compromise. Defenders were urged to rotate exposed secrets, pin GitHub Actions to verified commit SHAs, hunt for worm-created repositories, harden CI/CD environments, and review published indicators such as domains, IP addresses, hashes, and related CVEs.
Jul 9, 2026