Loading story…
Researchers linked TeamPCP to multiple interconnected intrusion campaigns spanning web application exploitation, software supply-chain abuse, and infrastructure hijacking. Reporting on the Operation PCPcat and React2Shell activity said attackers exploited vulnerable Next.js deployments and compromised roughly 59,000 servers, using them to steal credentials and build follow-on access. Separate investigations into the CanisterWorm campaign found dozens of malicious npm packages carrying hidden postinstall scripts that stole npm tokens from .npmrc, /etc/npmrc, and environment variables, then republished trojanized updates through victims’ own publisher accounts. The malware also established Linux persistence with a masqueraded user-level systemd service named pgmon and fetched later-stage payloads through Internet Computer canister infrastructure, complicating takedown efforts.
Additional reporting tied the broader operation to compromised CI/CD ecosystems, residential proxy building, and ransomware monetization. An investigation into the Xygeni GitHub Action compromise found the same custom ShadowLink backdoor protocol used in malware that exploited TP-Link and ASUS routers, including abuse of CVE-2024-21833 to install microsocks and maintain SOCKS5 proxy persistence via cron, rc.local, and NVRAM changes; researchers said this strongly links the router campaign to the Xygeni intrusion, while overlap with TeamPCP remains partly circumstantial. By late March, defenders reported TeamPCP had slowed new package compromises and shifted toward monetization through harvested credentials and dual ransomware tracks, including its own CipherForce operation and activity aligned with the Vect ransomware ecosystem; related fallout included ownCloud disclosing build infrastructure exposure through CVE-2026-33634 associated with the Trivy compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
Researchers published an investigation connecting the March 3 Xygeni GitHub Action compromise to a campaign exploiting TP-Link and ASUS routers to build a residential proxy network. The link was based on a shared custom backdoor protocol, ShadowLink, including identical registration paths, polling logic, and authentication secret.
An update assessed that TeamPCP had moved into monetization through direct credential exploitation, a proprietary CipherForce ransomware operation, and a separate partnership with the Vect ransomware ecosystem. The report also noted release of a 3 GB AstraZeneca data archive allegedly connected to related criminal activity.
ownCloud said its build infrastructure was affected by CVE-2026-33634 associated with the Trivy compromise, while stating that no customer data or source code was impacted. The disclosure added another downstream victim to the broader TeamPCP supply-chain story.
On March 30, Databricks' newly confirmed @DatabricksSec account said an internal investigation found nothing related to alleged TeamPCP-linked compromise and asked for more information. The statement responded to claims that TeamPCP-harvested credentials may have affected the company.
By March 27, researchers assessed that TeamPCP had stopped introducing new package compromises and shifted focus toward monetization of harvested access and credentials. This marked a transition from expansion of the supply-chain campaign to follow-on exploitation.
Follow-on reporting attributed CanisterWorm to TeamPCP and identified newly compromised packages, including multiple @emilgroup SDKs. The update emphasized that the campaign hijacked legitimate publisher accounts and weaponized trusted packages for automated propagation.
Researchers revealed a malicious npm package campaign dubbed CanisterWorm that used hidden postinstall scripts to steal npm tokens, deploy a Python backdoor, and self-propagate by republishing infected packages from compromised publisher accounts. The malware also established Linux persistence via a masqueraded user-level systemd service named pgmon and used Internet Computer infrastructure for next-stage retrieval.
Xygeni’s GitHub Action was compromised in a supply-chain incident later linked by researchers to a separate router-based proxy campaign through a shared ShadowLink backdoor protocol. This compromise became a key pivot point in later attribution analysis.
A large-scale exploitation campaign targeting Next.js/React-based servers resulted in roughly 59,000 compromised systems. The activity established the baseline for what was later tracked as Operation PCPcat.
A report documented a Next.js exploit campaign dubbed Operation PCPcat, describing credential theft and broad server compromise tied to the earlier React2Shell activity. The publication provided technical analysis of the campaign affecting tens of thousands of servers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
ctrlaltintel.com
Open sourceisc.sans.edu
Open sourcegbhackers.com
Open sourceendorlabs.com
Open sourcebeelzebub.ai
Open sourcecyberpress.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
TeamPCP has expanded a multi-ecosystem software supply chain campaign that compromised open-source security and developer tools including **Trivy**, **Checkmarx KICS**, **LiteLLM**, **Telnyx**, GitHub Actions, OpenVSX extensions, Docker images, and packages published through **PyPI** and **npm**. Reporting indicates the attackers used stolen developer and publishing credentials to push malicious releases through trusted channels, harvest environment variables, shell histories, cloud credentials, and GitHub tokens, and move laterally across CI/CD environments. In the Telnyx incident, valid credentials were reportedly used to publish malicious PyPI releases, with a second-stage payload hidden in a WAV file and code triggered on import. The campaign is now being linked to follow-on ransomware activity through an alleged partnership between TeamPCP and the **Vect** ransomware group, which has been advertised on BreachForums as an emerging ransomware-as-a-service operation. Researchers say the supply chain compromises may serve as initial access for extortion campaigns against downstream organizations, with TeamPCP reportedly recruiting negotiators after the Trivy breach and previously exfiltrating roughly **300 GB** of compressed credentials; the LiteLLM compromise alone was tied to hundreds of thousands of stolen credentials. The incidents underscore how compromised open-source tooling and CI/CD infrastructure can give attackers privileged enterprise access and create a path from package poisoning to ransomware deployment.
Jul 21, 2026
A broad software supply-chain campaign attributed to **TeamPCP** compromised trusted developer and security tools, beginning with a poisoned **Trivy GitHub Action** after attackers allegedly stole a personal access token via a misconfigured `pull_request_target` workflow. Researchers said malicious commits were pushed to most Trivy action tags, allowing the attackers to steal CI/CD secrets, cloud credentials, SSH keys, Kubernetes configuration, and other sensitive data from downstream users. The campaign then spread through stolen credentials to additional projects, including **Checkmarx KICS**, **LiteLLM** versions `1.82.7` and `1.82.8` on PyPI, the **Telnyx SDK**, and later **Bitwarden CLI**, with malware exfiltrating data to attacker-controlled infrastructure such as `checkmarx[.]zone` and `models[.]litellm[.]cloud`. Reporting also tied the operation to hundreds of compromised systems and large-scale theft of `.env` files and secrets from cloud, AI, payment, database, and messaging environments. The fallout expanded beyond package poisoning into downstream intrusions and data leaks. **Checkmarx** confirmed that data later leaked by **LAPSUS$** came from its private GitHub repository and said the initial access was likely enabled by credentials exposed in the Trivy-related compromise; researchers also linked the broader campaign to **Bitwarden** through shared malware and command-and-control patterns. Malicious KICS Docker images, GitHub Actions, and editor extensions were reported to steal credentials and scan results, while Bitwarden’s CI/CD workflow was allegedly abused to expose an npm token and publish a tainted `@bitwarden/cli` release. Security researchers and vendors warned that the campaign shows how attackers are increasingly targeting open-source maintainers and security tooling as high-leverage entry points, with reported ties to extortion and ransomware groups including **LAPSUS$** and **Vect** raising the risk that stolen access will be resold or used for follow-on attacks.
Jul 4, 2026
Researchers reported a worm-enabled npm supply-chain attack dubbed **CanisterWorm** that backdoored at least 29 legitimate packages, including 28 in the `@EmilGroup` scope and `@teale.io/eslint-config`. The attackers appear to have used stolen npm publishing tokens or equivalent CI/CD access to replace package contents, republish trojanized updates under the latest tag, and spread the malware across additional packages available to the compromised credentials. Aikido linked the activity to **TeamPCP** and assessed it as a likely follow-on from the earlier Trivy compromise, while Socket said the operation showed high-confidence signs of a legitimate publisher-space takeover with worm-like propagation. The infection chain used a Node.js `postinstall` loader, a Python backdoor, and an Internet Computer Protocol canister as a dead-drop command-and-control channel for dynamic payload delivery. On Linux, the malware established persistence through a user-level systemd service, disguised files as PostgreSQL-related artifacts, delayed execution to evade sandboxing, and used a propagation script to enumerate publishable packages, bump patch versions, preserve READMEs, and publish malicious updates at scale. At the time of reporting, the ICP canister returned a Rickroll URL as a dormant kill switch, but researchers warned it could be changed at any time to deliver a real second-stage binary to developers, CI runners, and build systems that installed the compromised packages.
Jun 29, 2026