TeamPCP: Linked to attacks on Redis servers since 2020

TeamPCP is one of the most dangerous cybercriminal groups to emerge in recent years, and new research reveals that its activity dates back at least to 2020 — much earlier than previously thought. Oligo Security have identified connections between early attacks on exposed Redis servers and the group’s more recent supply chain , demonstrating a gradual evolution from simple cloud infrastructure exploitation to complex software supply chain attacks. The discovery fundamentally changes our understanding of the group’s profile and capabilities.

See also: Supply Chain Attack: TeamPCP Targets Developer Tools

Researchers Avi Lumelsky and Gal Elbaz of Oligo Security documented the connection through overlapping domains , common malware development paths , staging techniques , shared backend infrastructure, and operational methods. Their analysis reveals two significant campaigns from the second half of 2025 : ShadowRay 2.0 (aka IronErn ), which turned AI infrastructure into a self-replicating botnet , and TA-NATALSTATUS , which targeted exposed Redis servers to install cryptocurrency miners . Both campaigns are directly linked to the same group that later became known as TeamPCP .

The TA-NATALSTATUS campaign is considered an evolution of an earlier operation documented by Trend Micro in April 2020 , which involved targeting Redis servers for malware development . This means that TeamPCP was actively targeting internet-accessible infrastructures on Ray, Docker, Redis , and React long before it acquired its current identity. The group appears to have gradually built its capabilities, leveraging every new technology that emerged in the cloud and developer ecosystem.

TeamPCP: From Redis attacks to the supply chain

TeamPCP first emerged publicly in late 2025 , when the group was linked to exploiting vulnerabilities in React Server Components (RSC) and Next.js to extract credentials and sensitive data from compromised environments — an operation dubbed Operation PCPcat . In early 2026 , Flare reported a massive campaign by the group that systematically targeted cloud-native environments to create malicious infrastructure. According to Flare security researcher Assaf Morag , the goals of the operation included creating distributed proxy and scanning infrastructure, compromising servers to extract data, deploying ransomware , extorting , and mining cryptocurrency.

The group then expanded into supply chain , exploiting the interconnectedness of modern software to massively infect developer systems by poisoning popular open-source libraries, using a combination of GitHub Actions and token theft. One of the most notable attacks involved the Trivy, where a compromised CI/CD workflow was used to spread malware across multiple ecosystems, affecting GitHub Actions, Docker Hub, npm, PyPI , and other platforms. According to Reco AI, this campaign resulted in the theft of approximately 500,000 credentials.

Particularly concerning was CyberScoop ’s report that TeamPCP compromised and injected malicious code into more than 440 npm packages in less than four hours , using a self-replicating worm based on the open-source Mini Shai-Hulud repository that the group itself had published in May. Google attributed the activity to a key operator who was located in South Africa during at least part of the attacks, suggesting a relatively centralized operational structure.

See also: QuickFox: Supply Chain attack with FDMTP backdoor

TeamPCP: Technical details and the malicious arsenal

Technically, TeamPCP exploited a number of known vulnerabilities and misconfigurations. The attacks leveraged misconfigured Docker APIs , unprotected Redis instances , misconfigured Kubernetes clusters , exposed Ray dashboards , and abused CI/CD workflows . SafeBreach specifically cited CVE-2026-33634 , CVE-2026-48027 , CVE-2026-45321 , and CVE-2025-55182 as part of the group’s arsenal. The 2026 FBI FLASH reports described TeamPCP as a group that conducts large-scale software supply chain compromises and steals cloud access tokens, SSH keys , and Kubernetes secrets from victim environments.

Of particular interest is the evolution of the group's malware arsenal. A Python script named kube.py is used specifically after Kubernetes environments are compromised. While older versions of the script focused on propagation and persistence creation, new variants observed in March 2026 incorporated wiper -like functionality . This malicious code checks whether the victim system is configured for the Iranian time zone and, if so, executes a DaemonSet that wipes every node in the cluster via a wiper named Kamikaze . On Kubernetes nodes outside of Iran, it deploys the CanisterWorm backdoor , while for non-Kubernetes Iranian systems it executes a poison_pill() routine that wipes the entire file system.

The impact of TeamPCP ’s attacks is impressive in scale. According to ThreatMon , the group affected over 1,000 SaaS environments , compromised approximately 500,000 credentials , and exported over 300 GB of data . Reports linked to NHIMG estimate that TeamPCP is linked to over 59,000 compromised systems in one campaign and 3,800 internal repositories in another. Even more concerning is the report that the European Commission suffered a breach of its AWS environment, with CERT-EU attributing the attack to TeamPCP after using a stolen AWS API key from the Trivy campaign — an event that affected up to 71 clients of the Europa web hosting service .

How to protect yourself from TeamPCP

Given the widespread activity of TeamPCP , organizations and developers should take immediate steps to protect themselves. First, it is critical to pin GitHub Actions workflows to verified commit SHA hashes instead of floating tags or branch references, as this is one of the team’s primary methods of compromise. Phishing-resistant MFA is also required for all accounts with access to repositories or package publishing permissions. Security teams should review CI/CD workflows for unsafe patterns, such as using pull_request_target in conjunction with checkout of untrusted code.

Additionally, it is recommended to search for suspicious repositories created by the worm, including names such as tpcp-docs or docs-tpcp​​, and immediately isolate them. Monitoring CI/CD runners for unexpected outbound connections and other anomalous behavior is also essential. Finally, it is important to harden internet-facing services by limiting or removing public exposure of Redis, Docker APIs, Kubernetes dashboards, Ray dashboards , and similar management interfaces. Scanning repositories, logs, and build artifacts for exposed secrets, followed by revocation and key rotation, is a key defense practice against this group.

See also: AWS Security Hub Extended: New Supply Chain Security Category with Chainguard and Socket

Overall, the TeamPCP case is a typical example of the evolution of a cybercriminal group: from relatively simple attacks on exposed Redis services in 2020 , the group escalated to complex supply chain attacks that threaten entire software ecosystems. Oligo Security ’s analysis highlights that such groups do not “appear” suddenly — they develop gradually, exploiting every new attack surface offered by the modern cloud and developer ecosystem.