TeamPCP, a financially motivated group active since late 2025, distributed malicious code through compromised software supply chains and exposed cloud infrastructure. The campaign targeted widely used security scanners, AI infrastructure components, and developer tools, including a popular code editor extension. By infiltrating trusted build systems and package registries, the group gained access to credentials and source code across multiple environments. The initial access vectors included valid credentials from prior incidents and vulnerabilities in exposed management interfaces. This approach allowed the threat actor to compromise tools that developers and organizations rely on for daily operations, creating a broad scope of potential exposure for sensitive data and system access.
The attack mechanism involved injecting credential-stealing code into legitimate software releases. In one instance, malicious commits were force-pushed to existing tags of a vulnerability scanner, causing workflows to execute the new code without configuration changes. The payload searched process memory for secrets on hosted runners and checked numerous file paths for keys and credentials on self-hosted systems. Collected data was encrypted using advanced cryptographic standards and uploaded to lookalike domains or stored in newly created repositories as a fallback. Persistence was achieved through installed services that polled for commands, while stolen publishing tokens enabled the distribution of further malicious updates through package registries. This sequence allowed the group to extend access and maintain control even after initial removal of the compromised software.[/subscribe_to_unlock_form]
TeamPCP, a financially motivated group active since late 2025, distributed malicious code through compromised software supply chains and exposed cloud infrastructure. The campaign targeted widely used security scanners, AI infrastructure components, and developer tools, including a popular code editor extension. By infiltrating trusted build systems and package registries, the group gained access to credentials and source code across multiple environments. The initial access vectors included valid credentials from prior incidents and vulnerabilities in exposed management interfaces. This approach allowed the threat actor to compromise tools that developers and organizations rely on for daily operations, creating a broad scope of potential exposure for sensitive data and system access.
The attack mechanism involved injecting credential-stealing code into legitimate software releases. In one instance, malicious commits were force-pushed to existing tags of a vulnerability scanner, causing workflows to execute the new code without configuration changes. The payload searched process memory for secrets on hosted runners and checked numerous file paths for keys and credentials on self-hosted systems. Collected data was encrypted using advanced cryptographic standards and uploaded to lookalike domains or stored in newly created repositories as a fallback. Persistence was achieved through installed services that polled for commands, while stolen publishing tokens enabled the distribution of further malicious updates through package registries. This sequence allowed the group to extend access and maintain control even after initial removal of the compromised software.[emaillocker id="1283"]
The campaign resulted in the theft of thousands of internal repositories from a major code hosting platform, with stolen data later listed for sale. The group also posted leaked business data from organizations in several countries and partnered with ransomware operators. Australian authorities recently charged two individuals, while a US indictment was announced against one of them. The incident highlights the critical need for prompt credential rotation, as stolen tokens remained usable weeks after the malicious code was removed. Defenders should pin software revisions, limit credential access in build pipelines, and monitor outbound traffic to detect unauthorized data transfers before they leave the environment.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Initial Access | T1195.002 | Supply Chain Compromise | Compromise Software Supply Chain |
| Initial Access | T1566.001 | Phishing | Spearphishing Attachment |
| Execution | T1059.004 | Command and Scripting Interpreter | Python |
| Persistence | T1547.001 | Boot or Logon Autostart Execution | Registry Run Keys / Startup Folder |
| Persistence | T1078.004 | Valid Accounts | Cloud Accounts |
| Defense Evasion | T1055.008 | Process Injection | Process Hollowing |
| Defense Evasion | T1027 | Obfuscated Files or Information | - |
| Credential Access | T1552.001 | Credentials in Files | Credentials in Files |
| Lateral Movement | T1021.001 | Remote Services | SSH |
| Command and Control | T1071.004 | Application Layer Protocol | Dynamic Resolution |
| Exfiltration | T1041 | Exfiltration Over C2 Channel | - |
| Impact | T1486 | Data Encrypted for Impact | - |
| Objective | Behavior ID | Behavior |
|---|---|---|
| Collection | E1056 | Input Capture |
| Cryptography Micro-objective | C0027 | Encrypt Data |
| Communication Micro-objective | C0002 | HTTP Communication |
| Exfiltration | E1020 | Automated Exfiltration |
| Execution | E1569 | System Services |
| Impact | B0022 | Remote Access |
| Impact | B0018 | Resource Hijacking |
| File System Micro-objective | C0016 | Create File |
| Lateral Movement | E1195 | Supply Chain Compromise |
The following reports contain further technical details:
[/emaillocker]