A criminal group tracked as TeamPCP executed a coordinated supply chain campaign spanning multiple developer ecosystems, including package registries and container repositories. The operation compromised a widely used AI proxy package on a Python repository, injecting malicious code into two specific versions. This incident exposed how centralized services that manage API keys and cloud credentials become high-value targets when upstream dependencies are breached. The threat actor leveraged compromised security scanning tools to gain initial access, demonstrating a strategy that exploits the broad permissions granted to infrastructure monitoring software. The scope of the attack affected production systems running the targeted package, leading to system instability and potential data exposure across diverse environments.
The malicious payload operated through a multi-layered, base64-encoded structure that executed entirely in memory to avoid leaving standalone files on disk. Upon installation, the code activated via a path file mechanism that triggered on every Python interpreter startup, bypassing the need for specific module imports. The payload included environment gating to target continuous integration pipelines and performed geofencing to exclude certain regions. It harvested over fifty categories of sensitive data, including cloud credentials, SSH keys, Kubernetes secrets, and cryptocurrency wallets. The collected information was encrypted using a hybrid scheme involving a random session key and a hardcoded public key before being exfiltrated over HTTPS. Additionally, the malware deployed a persistent backdoor that installed a system service to poll a command-and-control server for further instructions, enabling remote code execution and lateral movement across Kubernetes clusters by creating privileged pods on each node.[/subscribe_to_unlock_form]
A criminal group tracked as TeamPCP executed a coordinated supply chain campaign spanning multiple developer ecosystems, including package registries and container repositories. The operation compromised a widely used AI proxy package on a Python repository, injecting malicious code into two specific versions. This incident exposed how centralized services that manage API keys and cloud credentials become high-value targets when upstream dependencies are breached. The threat actor leveraged compromised security scanning tools to gain initial access, demonstrating a strategy that exploits the broad permissions granted to infrastructure monitoring software. The scope of the attack affected production systems running the targeted package, leading to system instability and potential data exposure across diverse environments.
The malicious payload operated through a multi-layered, base64-encoded structure that executed entirely in memory to avoid leaving standalone files on disk. Upon installation, the code activated via a path file mechanism that triggered on every Python interpreter startup, bypassing the need for specific module imports. The payload included environment gating to target continuous integration pipelines and performed geofencing to exclude certain regions. It harvested over fifty categories of sensitive data, including cloud credentials, SSH keys, Kubernetes secrets, and cryptocurrency wallets. The collected information was encrypted using a hybrid scheme involving a random session key and a hardcoded public key before being exfiltrated over HTTPS. Additionally, the malware deployed a persistent backdoor that installed a system service to poll a command-and-control server for further instructions, enabling remote code execution and lateral movement across Kubernetes clusters by creating privileged pods on each node.[emaillocker id="1283"]
The campaign demonstrated significant operational capability, with the actor rapidly iterating on delivery mechanisms within minutes to improve stealth and broaden impact. The compromise of security scanning tools allowed the attacker to publish trojanized packages, effectively turning defensive infrastructure into an attack vector. The incident highlighted the critical risk posed by tools that require broad read access to environment variables and runner memory. Defensive implications suggest that organizations must treat security scanning components with the same rigor as deployment tooling, ensuring that credential rotation is atomic and that access controls are strictly enforced. The rapid community response and takedown of the malicious versions likely limited the extent of credential exfiltration, though the full impact remains under assessment.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Initial Access | T1195.002 | Supply Chain Compromise | Compromise Software Supply Chain |
| Execution | T1059.004 | Command and Scripting Interpreter | Python |
| Execution | T1059.004 | Command and Scripting Interpreter | Python |
| Persistence | T1078 | Valid Accounts | - |
| Persistence | T1547.001 | Boot or Logon Autostart Execution | Registry Run Keys / Startup Folder |
| Defense Evasion | T1070.004 | Indicator Removal | File Deletion |
| Credential Access | T1552 | Unsecured Credentials | - |
| Credential Access | T1552.005 | Unsecured Credentials | Cloud Instance Metadata API |
| Lateral Movement | T1021.002 | Remote Services | SMB and Windows Shares |
| Command and Control | T1571.002 | Non-Standard Port | - |
| Command and Control | T1071.001 | Application Layer Protocol | Web Protocols |
| Exfiltration | T1041 | Exfiltration Over C2 Channel | - |
The following reports contain further technical details:
[/emaillocker]