TeamPCP

Also known as Altered Spider, PCPcat, ShellForce, DeadCatx3, CanisterWorm, SHADOW-WATER-058, UNC6780

0mentions, 7 days

0mentions, 30 days

nonelast mentioned

TeamPCP is a threat actor that has executed a coordinated series of supply chain attacks, compromising widely-used open source tools such as Trivy, KICS, and LiteLLM to deploy credential-stealing malware. They employed techniques like credential harvesting, lateral movement within Kubernetes environments, and audio steganography to evade detection. The group has demonstrated the ability to leverage stolen credentials to propagate attacks across multiple ecosystems, including npm and PyPI, using a self-propagating worm known as CanisterWorm. Their operations have included the use of AES-256 encryption and RSA-4096 for exfiltration of sensitive data.

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1005 Data from Local System T1027.003 Steganography T1036.005 Match Legitimate Resource Name or Location T1059.004 Unix Shell T1059.006 Python T1059.007 JavaScript T1059.013 Container CLI/API T1078 Valid Accounts T1078.004 Cloud Accounts T1098 Account Manipulation T1105 Ingress Tool Transfer T1176.002 IDE Extensions T1190 Exploit Public-Facing Application T1195.001 Compromise Software Dependencies and Development Tools T1485 Data Destruction T1486 Data Encrypted for Impact T1528 Steal Application Access Token T1543.002 Systemd Service T1546.016 Installer Packages T1547.001 Registry Run Keys / Startup Folder T1550.001 Application Access Token T1552.004 Private Keys T1553.002 Code Signing T1555.006 Cloud Secrets Management Stores T1564.001 Hidden Files and Directories T1583 Acquire Infrastructure T1583.001 Domains T1583.004 Server T1583.006 Web Services T1585.001 Social Media Accounts T1587.001 Malware T1608.001 Upload Malware T1610 Deploy Container T1657 Financial Theft T1677 Poisoned Pipeline Execution T1683.001 Written Content T1684.001 Impersonation

Recent activity

No posts or advisories have named this actor recently.

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.