TeamPCP
Also known asPCPcat · DeadCatx3 · ShellForce · SHADOW-WATER-058 · Storm-2999
Summary
Financially motivated criminal threat group executing systematic software supply chain attacks against CI/CD infrastructure. Google GTIG tracks as UNC6780; also known as PCPcat, ShellForce, DeadCatx3 and SHADOW-WATER-058 (Trend Micro); MITRE ATT&CK G1056. Sep 2025: Shai-Hulud worm — first self-replicating npm malware — marked end of nuisance-era supply chain attacks. Mar 19–27 2026: cascading campaign compromising Trivy (Aqua Security), KICS (Checkmarx), LiteLLM (AI gateway), Telnyx Python SDK, and 47+ npm packages — CVE-2026-33634 (CISA KEV, remediation deadline Apr 9). CanisterWorm's findNpmTokens() harvests long-lived npm tokens from CI/CD environments; these tokens were distributed to ~300,000 BreachForums users. Apr 21–23 2026: three simultaneous attacks on npm, PyPI, and Docker Hub. Apr 22–29 2026: Shai-Hulud Third Coming targeting SAP-related packages. May 11 2026: Mini Shai-Hulud — largest coordinated registry poisoning event of 2026: 170+ npm packages, 2 PyPI packages (TanStack router ecosystem 42 pkgs, Mistral AI SDK, UiPath 65 pkgs, OpenSearch 1.3M weekly downloads, Guardrails AI) — 404 malicious versions. Wiper component added. Source code open-sourced, enabling copycat campaigns. Announced operational partnerships with CipherForce and Vect ransomware for credential monetisation. TTPs: CI/CD token harvesting, dependency confusion, hijacking release pipelines, self-replicating worm propagation.
Attribution
No state link
Criminal or hacktivist group; no state sponsorship established.
- MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Financially motivated - Trend Micro (TrendAI Research) (Research, 2026-05-13)
Financially motivated cluster
Campaigns 4
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 14
Malware and tools 6
| Name | Description | Platform |
|---|---|---|
| Cryptominer Payloads | Miner | Linux/Container |
| SANDCLOCK (TeamPCP Cloud Stealer) | Credential stealer | Linux/macOS/Windows/Containers |
| CanisterWorm | Self-propagating worm / credential harvester (ICP canister C2) | Linux/Containers |
| Mini Shai-Hulud | Self-replicating supply-chain worm / credential stealer | Cross-platform (npm/PyPI) |
| Miasma | Self-propagating worm (Mini Shai-Hulud variant) | Cross-platform (npm/PyPI) |
| TeamPCP Cloud Stealer | Malware | Containers/Linux/macOS/SaaS/Windows |
Exploited vulnerabilities 2
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2025-55182 | 10 | React Server Components — React2Shell unauthenticated RCE (KEV 2025-12-05) |
| CVE-2026-33634 | 9.4 | Aqua Security Trivy / trivy-action / setup-trivy — embedded malicious code via hijacked release tags (KEV 2026-03-26) |
Highest CVSS first.
Infrastructure patterns
- Poisoned distribution channels — Docker Hub images, VS Code/OpenVSX extensions, GitHub Actions (Trend Micro, 2026)
- Typosquatted C2 and exfiltration domains, e.g. scan.aquasecurtiy[.]org, checkmarx[.]zone (Unit 42, 2026)
Reporting and advisories 5
- Unit 42
Cloud exploitation — React2Shell (CVE-2025-55182) and cryptomining - Wiz
Trivy / KICS / LiteLLM / Telnyx CI/CD supply-chain waves - Wiz
Mini Shai-Hulud — npm/PyPI registry poisoning - The Hacker News
Nx Console VS Code extension trojanization — GitHub internal repositories - MITRE ATT&CK
TeamPCP (G1056) group profile