Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
15 malware familiesExploits CVEs in the wild

TeamPCP

Also known asdeadcatx3pcpcatpersypcpshellforceTeam PCPunc6780

TeamPCP is a financially motivated cybercrime group focused on software supply chain attacks against open source ecosystems and developer tooling. Known aliases in the provided content include DeadCatx3, PCPcat, PersyPCP, ShellForce, team_pcp, and UNC6780; Mandiant tracks the cluster as UNC6780, and one source also notes Trend Micro tracking as SHADOW-WATER-058. The group is repeatedly linked to the Shai-Hulud / Mini Shai-Hulud malware family and later variants including Miasma and activity described as Hades, although multiple sources note attribution became less certain after TeamPCP publicly released the worm source code under an MIT license on May 12, 2026, turning it into public attack infrastructure. Based on the provided content, TeamPCP conducted or was linked with high confidence to multiple 2026 supply chain intrusions affecting developer ecosystems, including compromises involving GitHub internal repositories, Microsoft durabletask on PyPI, Aqua Security Trivy, Checkmarx KICS, LiteLLM, Telnyx, TanStack packages, Red Hat-related npm namespaces, and broader npm and PyPI package poisoning campaigns. The group also claimed responsibility for the GitHub breach in which a poisoned VS Code extension installed by a single employee led to exfiltration of roughly 3,800 internal repositories; GitHub said the attackers' claims were directionally consistent. Reporting in the content describes TeamPCP as targeting developer workstations, CI/CD systems, package registries, GitHub repositories, GitHub Actions, and trusted publishing workflows. Tactics and techniques directly described in the content include poisoning npm and PyPI packages; compromising developer accounts and contributor accounts; abusing GitHub Actions, OIDC trusted publishing, and SLSA/Sigstore provenance paths; exploiting pull_request_target misconfigurations; cache poisoning; stealing npm, PyPI, GitHub, SSH, cloud, Kubernetes, Vault, and CI/CD secrets; using malicious VS Code extensions; inserting malicious IDE and AI-tool configuration files such as .vscode/tasks.json, .claude/settings.json, .cursor/rules/setup.mdc, and .gemini/settings.json; using Python .pth persistence; downloading Bun to execute JavaScript stealers; scraping OIDC tokens from GitHub Actions runner memory; exfiltrating data via GitHub-based channels; and rapidly validating and operationalizing stolen credentials for cloud reconnaissance, repository cloning, workflow abuse, and further propagation. The content also states that TeamPCP open-sourced Mini Shai-Hulud / Shai-Hulud and announced a supply-chain attack contest on BreachForums, which researchers said lowered the barrier for copycat attacks and complicated later attribution.

Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

OPERATIONAL PROFILE

Targeting

Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.

Who they target

Sectors the actor has been observed targeting.

  • Software & Services
MITRE ATT&CK

Tradecraft

43 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

14 of 15 tactics63 techniques×N= number of intelligence reports citing this technique
MITRE ATT&CK
TA0042
Resource Development
2 techniques
T1584
Compromise Infrastructure
T1584.005
Botnet
T1586×2
Compromise Accounts
TA0001
Initial Access
2 techniques
T1078×4
Valid Accounts
T1195×21
Supply Chain Compromise
T1195.001×9
Compromise Software Dependencies and Development Tools
T1195.002×3
Compromise Software Supply Chain
TA0002
Execution
6 techniques
T1053
Scheduled Task/Job
T1053.006
Systemd Timers
T1059×2
Command and Scripting Interpreter
T1059.007
JavaScript
T1127
Trusted Developer Utilities Proxy Execution
T1129
Shared Modules
T1204
User Execution
T1204.002×2
Malicious File
T1574×2
Hijack Execution Flow
TA0003
Persistence
5 techniques
T1053
Scheduled Task/Job
T1053.006
Systemd Timers
T1078×4
Valid Accounts
T1505
Server Software Component
T1543
Create or Modify System Process
T1543.001
Launch Agent
T1556×2
Modify Authentication Process
TA0004
Privilege Escalation
5 techniques
T1053
Scheduled Task/Job
T1053.006
Systemd Timers
T1055
Process Injection
T1068
Exploitation for Privilege Escalation
T1078×4
Valid Accounts
T1543
Create or Modify System Process
T1543.001
Launch Agent
TA0005
Stealth
6 techniques
T1027×2
Obfuscated Files or Information
T1036
Masquerading
T1055
Process Injection
T1078×4
Valid Accounts
T1127
Trusted Developer Utilities Proxy Execution
T1574×2
Hijack Execution Flow
TA0112
Defense Impairment
2 techniques
T1553
Subvert Trust Controls
T1556×2
Modify Authentication Process
TA0006
Credential Access
7 techniques
T1528×5
Steal Application Access Token
T1539
Steal Web Session Cookie
T1552
Unsecured Credentials
T1555×6
Credentials from Password Stores
T1556×2
Modify Authentication Process
T1557
Adversary-in-the-Middle
T1649×5
Steal or Forge Authentication Certificates
TA0007
Discovery
2 techniques
T1526×3
Cloud Service Discovery
T1613
Container and Resource Discovery
TA0008
Lateral Movement
3 techniques
T1080
Taint Shared Content
T1210
Exploitation of Remote Services
T1570
Lateral Tool Transfer
TA0009
Collection
1 technique
T1557
Adversary-in-the-Middle
TA0011
Command and Control
4 techniques
T1071
Application Layer Protocol
T1102
Web Service
T1102.001
Dead Drop Resolver
T1105
Ingress Tool Transfer
T1219
Remote Access Tools
TA0010
Exfiltration
3 techniques
T1041×2
Exfiltration Over C2 Channel
T1048
Exfiltration Over Alternative Protocol
T1567×2
Exfiltration Over Web Service
T1567.001
Exfiltration to Code Repository
TA0040
Impact
3 techniques
T1485×2
Data Destruction
T1486
Data Encrypted for Impact
T1657
Financial Theft
ARSENAL

Associated malware families

15 malware families attributed to this actor across reporting.

FamilyContextEvidenceLast seen
Shai-HuludIn the Shai-Hulud / Miasma family of supply chain worms, the description stamped onto attacker-created GitHub dead-drop repos has functioned as a campaign signature since the original wave hit in September 2025.29Jun 25, 2026
MiasmaThe GitHub fingerprint the attackers left behind – a repository description reading “Alright Lets See If This Works” turned up on over 320 infected repositories before researchers began pulling the thread. That string is not something random. In the Shai-Hulud / Miasma family of supply chain worms, the description stamped onto attacker-created GitHub dead-drop repos has functioned as a campaign signature since the original wave hit in September 2025.27Jun 25, 2026
mini Shai-HuludWe have seen this in the past when Team PCP open sourced the Mini Shai-Hulud payload... We have been tracking TeamPCP, Mini Shai-Hulu, Miasma and other related campaigns.21Jun 10, 2026
CanisterWormAutomated propagation via worming across software dependencies (T1210 / T1105). Deploying self-propagating malware (e.g., CanisterWorm) to spread through npm and developer workflows at scale5Jun 5, 2026
IronWormСпециалисты компании JFrog обнаружили инфостилер IronWorm, который успел заразить 36 пакетов и был нацелен на кражу секретов разработчиков, учетных данных для облачных сервисов и ключей доступа.4Jun 10, 2026

10 additional families tracked in Mallory.

WEAPONIZED

Associated vulnerabilities

7 CVEs this actor has used in observed campaigns. 7 of them exploited in the wild.

CVE-2026-33634Trivy supply chain compromise via malicious release and retagged GitHub ActionsIn the wildEvidence39

ownCloud published a security notice confirming their build infrastructure -- the systems producing container images and client binaries -- was affected by CVE-2026-33634 (the Trivy compromise).

CVE-2026-45321TanStack GitHub Actions Trusted Publisher Supply Chain CompromiseIn the wildEvidence9

On 2026-05-27, CISA added three vulnerabilities to the KEV catalog, including CVE-2026-45321 (the TanStack / Mini Shai-Hulud tracking identifier) ... Treat the 2026-06-10 CISA remediation deadline for CVE-2026-45321 and CVE-2026-48027 as binding.

CVE-2025-55182React2Shell RCE in React Server Components Flight ProtocolIn the wildEvidence7

On December 19th 2025, Rubrik Zero Labs published PCPcat Campaign: Large-Scale Exploitation of React2Shell CVE and Cloud Infrastructure, detailing a campaign where TeamPCP weaponised CVE-2025-55182 (React2Shell) alongside exposed Docker APIs, Redis servers, Kubernetes clusters, and Ray AI dashboards.

CVE-2025-29927Next.js middleware authorization bypass via x-middleware-subrequest headerIn the wildEvidence5

Analysis of react.py This script is clearly set to exploit CVE-2025-29927, also known as React2Shell. ... This script implements a fully automated React/Next.js exploitation pipeline centered on abusing CVE-2025-29927 to achieve remote command execution at scale.

CVE-2026-48027Nx Console Embedded Malicious Code VulnerabilityIn the wildEvidence2

On 2026-05-27, CISA added three vulnerabilities to the KEV catalog ... CVE-2026-48027 (the malicious code embedded in the Nx Console v18.95.0 build) ... The next day, CISA published its first standalone advisory ... documenting the poisoned Nx Console VS Code extension auto-distributed through the editor update mechanism.

2 more CVEs tied to this actor tracked in Mallory.

IOCS

Observables

532 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.

IOC values are gated. View more in Mallory for domains, IPs, hashes, and other artifacts, or pipe them straight into your SIEM.

ACTIVITY FEED

Recent activity

20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

gurucul threat researchNews
Jun 15, 2026
Shai-Hulud Campaign Evolution: Miasma, Hades, and AI Scanner Evasion | Community Portal | Gurucul

Linked to the early waves of the Shai-Hulud V2 campaign, which expanded from npm into PyPI and shifted toward CI/CD abuse, undermining trust in SLSA provenance and OIDC-based publishing workflows. The campaign also extended malicious execution into IDE configuration files and used prompt injection to evade AI security scanners.

Read more
malware newsNews
Jun 12, 2026
Shai-Hulud Campaign Evolution: Miasma, Hades, and AI Scanner Evasion - Malware News - Malware Analysis, News and Indicators

Operator assessed as responsible for earlier Shai-Hulud supply-chain attack waves, including expansion from npm to PyPI, CI/CD abuse, OIDC token scraping, malicious package publishing with valid provenance, IDE configuration abuse, and prompt-injection-based evasion of AI security scanners.

Read more
xakepNews
Jun 11, 2026
Исходный код червя Miasma опубликован на GitHub - Хакер

Associated with publicly releasing the source code of the Shai-Hulud worm, which is described as a precursor/variant basis for Miasma and enables supply-chain style compromise of open-source ecosystems.

Read more
gurucul threat researchNews
Jun 11, 2026
TeamPCP Compromises Microsoft’s DurableTask PyPI Package to Deploy Multi-Stage Credential Theft Malware | Community Portal | Gurucul

Associated with compromising Microsoft's DurableTask PyPI package to deploy a sophisticated multi-stage supply chain attack focused on credential theft and access to cloud infrastructure, developer environments, GitHub, Kubernetes, and Vault.

Read more
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping43

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal15

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs7

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables532

Domains, IPs, and hashes tied to this actor, refreshed continuously.