TeamPCP
TeamPCP is a financially-motivated, cloud-native threat group that has been active since at least September 2025. Initially focused on ransomware and cryptocurrency theft, TeamPCP shifted in early 2026 to systematic, worm-driven credential theft and software supply chain attacks targeting Continuous Integration and Continuous Delivery (CI/CD) workflows. TeamPCP has monetized access through extortion and through partnerships with ransomware actors including Vect and CipherForce.
- ATT&CK ID
- G1056
- Techniques
- 30
- Tools
- 3
Also tracked as PCPCat · ShellForce · DeadCatx3 · SHADOW-WATER-058 · UNC6780
Vulnerabilities it has exploited
- CVE-2025-55182 Meta React Server ComponentsUnscored · exploited in the wild
- CVE-2026-33634 aquasecurity setup-trivyCritical 9.4 · EPSS 60% · exploited in the wild
Techniques
Resource Development
Acquire InfrastructureEstablish AccountsDevelop CapabilitiesStage CapabilitiesGenerate Content
Initial Access
Valid AccountsExploit Public-Facing ApplicationSupply Chain Compromise
Execution
Command and Scripting InterpreterDeploy ContainerPoisoned Pipeline Execution
Persistence
Valid AccountsAccount ManipulationSoftware ExtensionsCreate or Modify System ProcessEvent Triggered ExecutionBoot or Logon Autostart Execution
Privilege Escalation
Valid AccountsAccount ManipulationCreate or Modify System ProcessEvent Triggered ExecutionBoot or Logon Autostart Execution
Stealth
Obfuscated Files or InformationMasqueradingValid AccountsHide ArtifactsSocial Engineering
Defense Impairment
Credential Access
Steal Application Access TokenUnsecured CredentialsCredentials from Password Stores
Lateral Movement
Use Alternate Authentication Material
Collection
Command and Control
Impact
Data DestructionData Encrypted for ImpactFinancial Theft
Software
CanisterWorm · Mini Shai-Hulud · TeamPCP Cloud Stealer