TeamPCP
TeamPCP is a financially motivated cybercriminal group focused on large-scale software supply-chain compromise and credential theft. It first appeared in late December 2025, initially exploiting misconfigured Docker APIs and Kubernetes clusters in cloud environments, and escalated in March 2026 into a multi-stage campaign poisoning widely used open-source security and developer tools across GitHub Actions, Docker Hub, npm, PyPI, and OpenVSX. The group is also tracked as storm_2999, UNC6780, Replicating Marauder, and TGR-CRI-1135, and reporting also associates it with the aliases DeadCatx3, PCPcat, ShellForce, CipherForce, and Persy_PCP. High-confidence activity attributed to TeamPCP includes the March 2026 compromise of Aqua Security’s Trivy vulnerability scanner and associated GitHub Actions, where credential-stealing payloads were distributed through official channels and injected into CI/CD pipelines. Reporting also ties TeamPCP to related compromises affecting Checkmarx KICS GitHub Actions, LiteLLM on PyPI, TanStack-related incidents, OpenVSX extensions, and expansion into npm via the self-propagating CanisterWorm worm using stolen publish tokens. TeamPCP is described as specializing in poisoning trusted open-source software and abusing CI/CD trust paths, often by injecting malicious workflows into GitHub Actions. The group’s malware and campaigns are associated with Shai-Hulud and Mini Shai-Hulud, described as credential-stealing and self-propagating supply-chain malware targeting developer environments and CI/CD systems. TeamPCP publicly released the source code for Shai-Hulud / Mini Shai-Hulud in May 2026, after which multiple copycat and derivative campaigns emerged, including Miasma, which researchers described as a descendant or derivative of TeamPCP’s Mini Shai-Hulud malware family. TeamPCP has been described as one of the most consequential open-source supply-chain threat actors of 2026, compromising more than 1,000 software packages and weaponizing trusted development channels at scale. CERT-EU reporting cited in the content also links the Trivy supply-chain compromise to the breach of the European Commission’s Europa AWS hosting platform.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Software & Services
Tradecraft
55 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
15 malware families attributed to this actor across reporting.
10 additional families tracked in Mallory.
Associated vulnerabilities
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
TeamPCP used the residual access on March 19 to push a malicious v0.69.4 tag to the Trivy repository, an incident tracked as CVE-2026-33634 (CVSS 9.4), using imposter commits.
In December 2025, TeamPCP exploited CVE-2025-29927 (CVSS 10.0), a critical React2Shell vulnerability in Next.js, to compromise over 59,000 servers in under 48 hours during Operation PCPcat.
Observables
124 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Attributed operator behind the Shai Hulud supply chain campaign targeting npm and PyPI packages, harvesting CI/CD and cloud credentials, and enabling follow-on cloud intrusion, privilege escalation, and data exfiltration in AWS environments.
Open-sourced the Mini Shai-Hulud supply chain worm tooling; the current Leo Platform wave may be operated by TeamPCP or by a copycat using the same codebase and key material.
Supply-chain intrusion campaign targeting open-source repositories, CI/CD runners, package registries, and developer infrastructure to distribute credential-stealing malware and maximize downstream exposure across software ecosystems.
Associated with building the Shai-Hulud self-replicating worm used in npm-focused software supply-chain attacks.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.