TeamPCP Linked To Redis Attacks Dating Back To 2020 And Later Supply Chain Campaign

Six Years in the Making

New research from Oligo Security has connected the threat actor TeamPCP to a chain of cloud infrastructure attacks stretching back to 2020, substantially extending the group's known history and recontextualizing its 2026 supply chain campaign as the endpoint of a long, deliberate escalation.

The critical linking indicator is the masscan[.]cloud domain — found in infrastructure used by a cryptojacking operation tracked as TA-NATALSTATUS as far back as 2020, which later appeared in ShadowRay 2.0 activity in late 2025, and was ultimately listed on TeamPCP's own GitHub repository. Certificate transparency records dated May 11, 2025 confirmed the infrastructure overlap.

Origins: Redis and Docker Cryptojacking (2020–2025)

TeamPCP (also tracked as DeadCatx3, PCPcat, UNC6780, Replicating Marauder, and TGR-CRI-1135) began as an opportunistic cryptojacking operation. The group scanned the internet for:

• Exposed Docker APIs (unauthenticated Docker daemon sockets)
• Kubernetes control planes with public exposure
• Redis databases without authentication

When found, targets were infected with Monero cryptocurrency miners. The group's deployment framework used distinctive directory paths and staging scripts that persisted largely unchanged across years — a forensic signature that ultimately enabled attribution.

ShadowRay 2.0 (Late 2025)

Oligo assessed TeamPCP was responsible for ShadowRay 2.0, a November 2025 campaign targeting exposed Ray ML cluster dashboards, previously attributed to the threat actor "IronErn440." The shared masscan[.]cloud infrastructure resolved the attribution ambiguity.

Escalation: Cloud Worm Campaign (December 2025)

Around December 25, 2025, activity consistent with TeamPCP deployed a self-propagating worm targeting:

• Exposed Docker APIs
• Kubernetes clusters
• Ray ML dashboards
• Redis servers
• Systems vulnerable to CVE-2025-55182 (React2Shell, CVSS 10.0)

Rather than pure cryptojacking, this campaign built criminal proxy infrastructure for data theft and ransomware staging. Primary targets were AWS and Microsoft Azure cloud environments.

The Supply Chain Pivot (February–June 2026)

The group's most significant strategic shift was its pivot into software supply chain attacks — compromising the tools and packages that developers and security teams trust.

Security Tool Compromises

Trivy and KICS are security scanning tools used in CI/CD pipelines. Compromising them converts defenders' own security processes into an attack vector — a particularly damaging form of supply chain attack.

PyPI Package Poisoning

TeamPCP published malicious versions of popular Python packages to PyPI:

LiteLLM (versions 1.82.7 and 1.82.8): An infostealer payload was embedded that activated on install or update, targeting developer machines.

Telnyx (versions 4.87.1 and 4.87.2, March 27, 2026): A credential harvesting payload was concealed inside a WAV audio file within the package. The payload was cross-platform, targeting Windows, Linux, and macOS.

npm Supply Chain Attacks

In April 2026, TeamPCP poisoned SAP-related npm packages with a preinstall hook that downloaded and executed the Bun JavaScript runtime to run a credential stealer — a technique designed to evade static detection of malicious scripts.

The Shai-Hulud Worm (May 2026)

The group's most ambitious campaign targeted major open-source ecosystems simultaneously:

• 42 packages across 84 versions published to PyPI and npm
• Ecosystems targeted: TanStack, UiPath, Mistral AI, OpenSearch, Guardrails AI
• TanStack CVE-2026-45321 received a CVSS score of 9.6

In a move that significantly increased the threat landscape, TeamPCP open-sourced the Shai-Hulud worm tools in June 2026 — expanding the pool of potential attackers and complicating future attribution.

GitHub Breach (May 2026)

TeamPCP claimed a breach of GitHub's internal infrastructure via an employee device compromise, exfiltrating approximately 3,800 internal repositories. The stolen data was listed for sale on a cybercrime forum for $50,000+.

Tactics, Techniques, and Procedures

Competitive Threat: PCPJack

SentinelLABS documented a separate cloud worm called PCPJack that actively evicts TeamPCP from compromised cloud infrastructure, taking over victim environments for its own credential theft operations. The existence of PCPJack indicates that TeamPCP's compromised infrastructure has become valuable enough to attract competing criminal actors.

Indicators of Compromise

Infrastructure:

• masscan[.]cloud (domain — linked across TA-NATALSTATUS, ShadowRay 2.0, TeamPCP campaigns)

Malicious PyPI packages:

• litellm==1.82.7, litellm==1.82.8
• telnyx==4.87.1, telnyx==4.87.2

MITRE ATT&CK Techniques:

• T1195.002 — Supply Chain Compromise: Compromise Software Supply Chain
• T1072 — Software Deployment Tools
• T1190 — Exploit Public-Facing Application
• T1496 — Resource Hijacking (cryptojacking)

Defensive Recommendations

1. Audit PyPI and npm packages — check dependency lock files against known malicious versions listed above
2. Review CI/CD pipeline security — restrict GitHub Actions token permissions; use pinned action SHAs
3. Harden cloud exposure — Docker daemon sockets, Kubernetes API servers, Redis, and Ray dashboards must not be internet-accessible without authentication
4. Monitor for unusual process spawning — particularly from package install hooks or CI job runners
5. Verify scanner integrity — if using Aqua Trivy or Checkmarx KICS, verify binary hashes against official releases
6. Restrict development environment credentials — developer machines are the primary initial access target in these campaigns

References

• Oligo Security — TeamPCP Traced to 2020 Cryptojacking Operation
• Palo Alto Unit 42 — Weaponizing the Protectors: TeamPCP Multi-Stage Supply Chain Attack
• SentinelLABS — PCPJack Cloud Worm Evicts TeamPCP
• The Hacker News — TeamPCP Linked to Redis Attacks Dating Back to 2020