When TeamPCP emerged in late 2025, few recognized the threat actor that would eventually compromise over 1,000 organizations. What distinguishes this financially motivated cybercrime group isn’t cutting-edge technology but strategic evolution a calculated shift from opportunistic cloud exploitation to coordinated supply chain attacks that fundamentally challenged conventional security assumptions.
Initially, TeamPCP operated as a fairly typical cloud-focused adversary. They scanned for exposed Docker APIs, misconfigured Kubernetes clusters, and unprotected Redis instances, exploiting whatever access they found to mine Monero and generate direct revenue. The approach was straightforward: high-volume targeting, low complexity, quick profits.
This strategy had obvious limitations. Within approximately three months, TeamPCP recognized something crucial: security and development tools operate in privileged contexts with access to sensitive credentials tokens, API keys, and publishing permissions that far exceed what a single compromised server could provide. Targeting one trusted tool could unlock access to dozens of organizations simultaneously.
This realization triggered a strategic pivot that would reshape their entire operation.
On February 27, 2026, a TeamPCP affiliate exploited a workflow vulnerability in Trivy’s CI/CD pipeline, stealing a Personal Access Token. When Aqua Security rotated the credentials, they failed to eliminate all access paths a critical oversight that left residual entry points intact.
By March 19, TeamPCP weaponized this remaining access by pushing malicious version 0.69.4 to Trivy’s repository. The compromised release propagated across GitHub Releases, Docker Hub, AWS ECR, and GitHub Container Registry within hours, reaching thousands of downstream pipelines.
This was transformative. Each affected environment automatically collected and exfiltrated stored credentials. But rather than stopping there, the attackers leveraged these stolen tokens to access npm accounts, triggering CanisterWorm a self-propagating worm that compromised dozens of npm packages in under a minute. Those credentials then enabled attacks on Checkmarx, PyPI, and other ecosystems.
By late April, the operation had evolved into a sophisticated machinery where every compromise created conditions for the next attack. Stolen PyPI tokens compromised LiteLLM (95+ million monthly downloads). Checkmarx credentials enabled simultaneous poisoning across Docker Hub, VS Code extensions, and GitHub Actions. The operation wasn’t a series of disconnected breaches it was a single cascading compromise of interconnected trust relationships.
The technical execution demonstrated operational maturity beyond simple credential theft. TeamPCP employed decentralized command and control through Internet Computer Protocol canisters reportedly the first documented use of blockchain for C2 activity. This provided resilience; even as infrastructure was seized, the blockchain-based fallback remained operational.
More significantly, TeamPCP established a business model that transformed stolen access into revenue. Rather than direct extortion, they functioned as an access-generation operation. Their announced partnership with Vect ransomware-as-a-service offered affiliates 80-88% of ransom payments. By April 15, Vect began publishing victims compromised through TeamPCP’s supply chain attacks the entire pipeline from initial compromise to extortion was functioning at operational scale.
Simultaneously, they operated CipherForce, their own ransomware brand, creating multiple monetization channels from each compromised environment. This dual-track approach allowed them to distribute risk while maximizing returns.
The numbers illustrate the severity. Over 1,000 SaaS environments were affected, approximately 500,000 credentials compromised, and over 300 GB of data exfiltrated. Notable victims included the European Commission, major technology companies, and financial services organizations. Nation-state-tier institutions fell victim to the same attack vector as smaller organizations, exposing a universal structural weakness.
The campaign’s effectiveness didn’t stem from revolutionary techniques. Long-lived service account tokens remained valid after detection and attempted remediation. CI/CD runners contained cloud credentials with weak monitoring compared to production systems. Mutable tags rather than pinned commit hashes created silent credential collection points. Teams operated under assumptions that signed artifacts and familiar package names provided security not recognizing these became vulnerabilities once the systems producing them were compromised.
Organizations must fundamentally rethink supply chain security.
TeamPCP may disappear, but the structural vulnerabilities it exploited will persist.
Addressing these gaps protects against an entire class of supply chain actors increasingly targeting the identities and automation underpinning modern software delivery.
More posts
Share this article
Found it interesting? Don’t hesitate to share it to wow your friends or colleagues
Subscribe to our blog newsletter to follow the latest posts
