Cybersecurity articles tagged #TeamPCP on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/teampcp-hackers-arrested-in-australia-over-supply-chain-attackshttps://runtimerebel.com/blog/teampcp-hackers-arrested-in-australia-over-supply-chain-attacksAustralian Federal Police arrest two men linked to TeamPCP, a cybercrime syndicate behind major software supply chain attacks and data extortion.Tue, 01 Sep 2026 02:41:36 GMTTeamPCPSupply Chain AttackShai HuludGitHubLiteLLMhttps://runtimerebel.com/blog/teampcp-supply-chain-attack-trivy-compromise-impacts-2500-orgshttps://runtimerebel.com/blog/teampcp-supply-chain-attack-trivy-compromise-impacts-2500-orgsA supply chain attack attributed to TeamPCP compromised over 2,500 organizations, primarily through Aqua Security's Trivy scanner, not LiteLLM.Sat, 15 Aug 2026 00:42:24 GMTTeamPCPTrivyLiteLLMSupply Chain AttackShai Huludhttps://runtimerebel.com/blog/malicious-litellm-pypi-releases-steal-cloud-credentials-via-teampcphttps://runtimerebel.com/blog/malicious-litellm-pypi-releases-steal-cloud-credentials-via-teampcpMalicious LiteLLM PyPI releases 1.82.7 and 1.82.8 exfiltrated cloud keys, SSH keys, and tokens from 2,100+ organizations in the TeamPCP supply chain campaign.Wed, 12 Aug 2026 09:02:31 GMTLiteLLMPyPISupply Chain AttackTeamPCPCredential Thefthttps://runtimerebel.com/blog/npm-supply-chain-attacks-shai-hulud-miasma-and-ci-cd-compromiseshttps://runtimerebel.com/blog/npm-supply-chain-attacks-shai-hulud-miasma-and-ci-cd-compromisesThe npm ecosystem faces escalating supply chain attacks like Shai-Hulud and Miasma RAT, leading to credential theft and widespread package compromise.Sat, 08 Aug 2026 16:26:28 GMTNPMSupply Chain AttackShai HuludTeamPCPCI CD Securityhttps://runtimerebel.com/blog/teampcp-s-evolving-threat-redis-cloud-native-supply-chain-attackshttps://runtimerebel.com/blog/teampcp-s-evolving-threat-redis-cloud-native-supply-chain-attacksTeamPCP, active since 2020, now targets Redis, Docker, Kubernetes, and supply chains, deploying wipers and backdoors.Fri, 07 Aug 2026 08:47:09 GMTTeamPCPCloud NativeSupply Chain AttackKubernetesWiperhttps://runtimerebel.com/blog/teampcp-campaign-update-mini-shai-hulud-framework-gains-adoptionhttps://runtimerebel.com/blog/teampcp-campaign-update-mini-shai-hulud-framework-gains-adoptionAnalysis of the TeamPCP supply chain campaign, the open-sourcing of the Mini Shai-Hulud framework, and its adoption by diverse threat actor groups in 2026.Mon, 08 Jun 2026 17:14:51 GMTTeamPCPMini Shai HuludSupply Chain AttackVulnerability ScannerThreat Intelligencehttps://runtimerebel.com/blog/shai-hulud-campaign-teampcp-targets-open-source-supply-chainhttps://runtimerebel.com/blog/shai-hulud-campaign-teampcp-targets-open-source-supply-chainAnalysis of the Shai-Hulud campaign by TeamPCP, detailing their open-source supply chain attacks, TTPs, and critical mitigation strategies.Tue, 26 May 2026 20:47:57 GMTTeamPCPShai HuludSupply Chain AttackOpen Source SecurityNPMPyPIMalicious Packageshttps://runtimerebel.com/blog/teampcp-supply-chain-attack-targets-microsoft-sdks-and-githubhttps://runtimerebel.com/blog/teampcp-supply-chain-attack-targets-microsoft-sdks-and-githubTeamPCP expands its supply chain campaign to trojanize official Microsoft Python SDKs and infiltrate GitHub, requiring immediate dependency audits.Mon, 25 May 2026 16:52:00 GMTTeamPCPSupply Chain AttackPython SDKGitHubPyPINPMhttps://runtimerebel.com/blog/github-data-breach-analysis-of-teampcp-internal-repository-thefthttps://runtimerebel.com/blog/github-data-breach-analysis-of-teampcp-internal-repository-theftGitHub confirms the theft of 4,000 internal repositories by threat actor TeamPCP. Learn the technical implications and defense strategies for security teams.Thu, 21 May 2026 09:16:24 GMTGitHubTeamPCPSource Code TheftInternal RepositoriesData Exfiltrationhttps://runtimerebel.com/blog/github-internal-repo-breach-claimed-by-teampcp-code-at-riskhttps://runtimerebel.com/blog/github-internal-repo-breach-claimed-by-teampcp-code-at-riskGitHub investigates TeamPCP's claim of breaching internal repositories, potentially exposing 4,000 private codebases. Defenders must secure supply chains.Wed, 20 May 2026 05:27:49 GMTGitHubTeamPCPData BreachSupply ChainSource Codehttps://runtimerebel.com/blog/github-investigates-claimed-teampcp-breach-of-4000-internal-reposhttps://runtimerebel.com/blog/github-investigates-claimed-teampcp-breach-of-4000-internal-reposGitHub is investigating a potential breach of 4,000 internal repositories claimed by TeamPCP, highlighting the risk of source code leaks for enterprises.Wed, 20 May 2026 05:27:11 GMTGitHubTeamPCPSource Code LeakData BreachCybercrimehttps://runtimerebel.com/blog/teampcp-jenkins-plugin-compromise-and-mini-shai-hulud-worm-analysishttps://runtimerebel.com/blog/teampcp-jenkins-plugin-compromise-and-mini-shai-hulud-worm-analysisTeamPCP escalates its supply chain campaign with a confirmed Jenkins plugin compromise and a self-spreading worm targeting the npm and PyPI ecosystems.Mon, 18 May 2026 20:38:04 GMTTeamPCPJenkinsNPMPyPIMini Shai HuludSupply Chain Attackhttps://runtimerebel.com/blog/teampcp-threatens-sale-of-mistral-ai-source-code-repositorieshttps://runtimerebel.com/blog/teampcp-threatens-sale-of-mistral-ai-source-code-repositoriesTeamPCP hackers claim to have exfiltrated 22GB of source code from Mistral AI. This report analyzes the breach impact and API key security risks.Fri, 15 May 2026 00:52:30 GMTTeamPCPMistral AIData BreachSource Code TheftAPI Securityhttps://runtimerebel.com/blog/mini-shai-hulud-worm-compromises-tanstack-and-mistral-ai-packageshttps://runtimerebel.com/blog/mini-shai-hulud-worm-compromises-tanstack-and-mistral-ai-packagesTeamPCP actor compromises major npm and PyPI packages including TanStack and Mistral AI via the Mini Shai-Hulud worm, deploying profiling malware.Tue, 12 May 2026 09:04:37 GMTTeamPCPMini Shai HuludNPMPyPISupply Chain Attackhttps://runtimerebel.com/blog/checkmarx-jenkins-ast-plugin-compromised-in-teampcp-attackhttps://runtimerebel.com/blog/checkmarx-jenkins-ast-plugin-compromised-in-teampcp-attackTeamPCP compromised the Checkmarx Jenkins AST plugin on the Jenkins Marketplace. Defenders must revert to version 2.0.13 to secure CI/CD pipelines.Mon, 11 May 2026 20:39:30 GMTCheckmarxJenkinsTeamPCPSupply Chain AttackCI CD Securityhttps://runtimerebel.com/blog/ai-augmented-zero-day-exploitation-and-autonomous-malware-orchestrationhttps://runtimerebel.com/blog/ai-augmented-zero-day-exploitation-and-autonomous-malware-orchestrationGTIG report reveals how threat actors leverage generative AI for zero-day discovery, autonomous Android malware orchestration, and AI supply chain attacks.Mon, 11 May 2026 13:13:41 GMTPROMPTSPYAI SecurityZero-DayTeamPCPAPT45https://runtimerebel.com/blog/pcpjack-malware-stealing-cloud-secrets-via-parquet-file-discoveryhttps://runtimerebel.com/blog/pcpjack-malware-stealing-cloud-secrets-via-parquet-file-discoveryPCPJack malware replaces TeamPCP, utilizing Apache Parquet files for stealthy cloud secret theft across multiple service providers and environments.Fri, 08 May 2026 08:39:33 GMTPCPJackTeamPCPCloud SecurityCredential TheftApache Parquethttps://runtimerebel.com/blog/pcpjack-worm-analyzing-the-malware-displacement-in-cloud-environmentshttps://runtimerebel.com/blog/pcpjack-worm-analyzing-the-malware-displacement-in-cloud-environmentsPCPJack is a new Golang-based worm targeting AWS, Docker, and Kubernetes. Learn how it removes TeamPCP and steals credentials to compromise cloud infrastructure.Fri, 08 May 2026 08:38:51 GMTPCPJackTeamPCPCloud SecurityDockerKubernetesCredential Thefthttps://runtimerebel.com/blog/pcpjack-worm-steals-cloud-credentials-cleans-teampcp-accesshttps://runtimerebel.com/blog/pcpjack-worm-steals-cloud-credentials-cleans-teampcp-accessNew PCPJack worm actively targets exposed cloud infrastructure, stealing credentials and removing existing TeamPCP infections. Understand its TTPs and mitigation.Thu, 07 May 2026 20:32:45 GMTPCPJackTeamPCPCredential TheftCloud SecurityWormMalwarehttps://runtimerebel.com/blog/pcpjack-credential-stealer-cloud-system-exploitation-spreadhttps://runtimerebel.com/blog/pcpjack-credential-stealer-cloud-system-exploitation-spreadPCPJack, a new credential stealer, leverages 5 unspecified CVEs to achieve worm-like spread across cloud, container, developer, and financial service environments…Thu, 07 May 2026 20:32:23 GMTPCPJackCredential StealerCloud SecurityWormTeamPCPhttps://runtimerebel.com/blog/teampcp-targets-sap-npm-packages-mini-shai-hulud-supply-chain-attackhttps://runtimerebel.com/blog/teampcp-targets-sap-npm-packages-mini-shai-hulud-supply-chain-attackTeamPCP broadens supply chain attacks, compromising npm packages in SAP's cloud development ecosystem with the 'Mini Shai-Hulud' malicious code injection.Fri, 01 May 2026 00:54:59 GMTTeamPCPSAPNPMSupply Chain AttackMini Shai HuludCloud Securityhttps://runtimerebel.com/blog/official-sap-npm-packages-compromised-in-teampcp-supply-chain-attackhttps://runtimerebel.com/blog/official-sap-npm-packages-compromised-in-teampcp-supply-chain-attackAttackers compromised official SAP npm packages to exfiltrate developer credentials and tokens. Learn how to detect and remediate this supply chain threat.Thu, 30 Apr 2026 00:50:55 GMTSAPNPMTeamPCPCredential TheftMalicious Packageshttps://runtimerebel.com/blog/teampcp-supply-chain-checkmarx-kics-bitwarden-cli-xinference-pypi-attackshttps://runtimerebel.com/blog/teampcp-supply-chain-checkmarx-kics-bitwarden-cli-xinference-pypi-attacksTeamPCP resumes supply chain attacks with new compromises targeting Checkmarx KICS, Bitwarden CLI, and xinference PyPI. UNC6780 credential theft campaign continues.Mon, 27 Apr 2026 16:42:13 GMTTeamPCPUNC6780SANDCLOCKSupply Chain AttackCheckmarx KICSBitwarden CLIXinference PyPINPMPyPICredential TheftCVE-2026-33634https://runtimerebel.com/blog/bitwarden-npm-supply-chain-attack-analyzing-the-teampcp-campaignhttps://runtimerebel.com/blog/bitwarden-npm-supply-chain-attack-analyzing-the-teampcp-campaignA malicious npm package impersonating Bitwarden was discovered exfiltrating sensitive data via the Shai-Hulud worm in a recent supply chain attack.Fri, 24 Apr 2026 08:49:11 GMTNPMBitwardenTeamPCPShai HuludSupply Chain Securityhttps://runtimerebel.com/blog/teampcp-supply-chain-attack-from-credential-theft-to-payroll-fraudhttps://runtimerebel.com/blog/teampcp-supply-chain-attack-from-credential-theft-to-payroll-fraudTeamPCP leverages supply chain attacks to compromise trusted software, facilitating large-scale credential harvesting, logistics theft, and payroll fraud.Wed, 15 Apr 2026 16:30:57 GMTTeamPCPSupply Chain AttackCredential HarvestingPayroll FraudFinancial Crimehttps://runtimerebel.com/blog/teampcp-supply-chain-campaign-cisco-source-code-stolen-unc6780-activityhttps://runtimerebel.com/blog/teampcp-supply-chain-campaign-cisco-source-code-stolen-unc6780-activityAnalysis of the TeamPCP supply chain campaign, including the theft of Cisco source code and over 1,000 compromised SaaS environments tracked by Google GTIG as UNC6780.Thu, 09 Apr 2026 00:37:07 GMTTeamPCPUNC6780Supply Chain AttackCiscoSource Code TheftTrivyShinyHuntersSaaS Compromisehttps://runtimerebel.com/blog/teampcp-supply-chain-cert-eu-confirms-cloud-breach-1000-saas-environments-affectedhttps://runtimerebel.com/blog/teampcp-supply-chain-cert-eu-confirms-cloud-breach-1000-saas-environments-affectedCERT-EU confirms European Commission cloud breach via TeamPCP supply chain campaign. Mandiant identifies over 1,000 compromised SaaS environments.Fri, 03 Apr 2026 16:19:26 GMTTeamPCPSupply Chain AttackCloud SecuritySaaSEuropean CommissionDPRKhttps://runtimerebel.com/blog/teampcp-supply-chain-attacks-escalate-amidst-hacker-infightinghttps://runtimerebel.com/blog/teampcp-supply-chain-attacks-escalate-amidst-hacker-infightingRuntime Rebel details how TeamPCP's supply chain attacks are leading to breaches, with ShinyHunters and Lapsus$ adding to the chaos.Fri, 03 Apr 2026 16:18:40 GMTTeamPCPShinyHuntersLapsusSupply Chain AttackBreachThreat Actorhttps://runtimerebel.com/blog/teampcp-breach-of-european-commission-affects-30-eu-entitieshttps://runtimerebel.com/blog/teampcp-breach-of-european-commission-affects-30-eu-entitiesCERT-EU attributes a major cloud security breach at the European Commission to threat group TeamPCP, impacting data across 30 European Union organizations.Fri, 03 Apr 2026 08:25:00 GMTTeamPCPEuropean CommissionCERT EUCloud SecurityData Breachhttps://runtimerebel.com/blog/teampcp-supply-chain-campaign-first-victim-cloud-enumeration-ransomwarehttps://runtimerebel.com/blog/teampcp-supply-chain-campaign-first-victim-cloud-enumeration-ransomwareDetailed analysis of TeamPCP supply chain campaign, covering the first confirmed victim, post-compromise cloud enumeration tactics, and dual ransomware operations.Wed, 01 Apr 2026 16:28:28 GMTTeamPCPSupply Chain AttackCloud SecurityRansomwareAstraZenecaDatabricksData Breachhttps://runtimerebel.com/blog/teampcp-supply-chain-campaign-databricks-and-astrazeneca-impacthttps://runtimerebel.com/blog/teampcp-supply-chain-campaign-databricks-and-astrazeneca-impactTeamPCP's supply chain campaign weaponizes security scanners for dual ransomware operations, impacting Databricks and AstraZeneca in a major breach.Mon, 30 Mar 2026 16:29:39 GMTTeamPCPDatabricksAstraZenecaSupply Chain AttackDual Ransomwarehttps://runtimerebel.com/blog/teampcp-supply-chain-campaign-weaponized-scanners-and-pypi-compromisehttps://runtimerebel.com/blog/teampcp-supply-chain-campaign-weaponized-scanners-and-pypi-compromiseAnalysis of the TeamPCP campaign transition to monetization following the Telnyx PyPI compromise and Vect ransomware partnership affecting security tools.Sat, 28 Mar 2026 16:14:20 GMTTeamPCPPyPIVect RansomwareTelnyxSupply Chain Attackhttps://runtimerebel.com/blog/backdoored-telnyx-pypi-package-uses-steganography-to-deliver-malwarehttps://runtimerebel.com/blog/backdoored-telnyx-pypi-package-uses-steganography-to-deliver-malwareSecurity researchers discovered malicious versions of the Telnyx PyPI package delivering infostealers via steganography hidden in WAV audio files.Sat, 28 Mar 2026 00:36:31 GMTPyPITelnyxSteganographyInfostealerTeamPCPPython Securityhttps://runtimerebel.com/blog/telnyx-pypi-package-compromised-by-teampcp-via-steganographyhttps://runtimerebel.com/blog/telnyx-pypi-package-compromised-by-teampcp-via-steganographyTeamPCP threat actors distributed malicious Telnyx Python package versions 4.87.1 and 4.87.2 on PyPI to harvest credentials using hidden WAV files.Fri, 27 Mar 2026 20:15:00 GMTTelnyxPyPITeamPCPPythonSteganographyCredential Thefthttps://runtimerebel.com/blog/teampcp-supply-chain-attack-telnyx-pypi-compromise-and-vect-ransomwarehttps://runtimerebel.com/blog/teampcp-supply-chain-attack-telnyx-pypi-compromise-and-vect-ransomwareTeamPCP campaign escalates with Telnyx PyPI compromise and Vect Ransomware mass affiliate program. Critical update for software developers and SOC teams.Fri, 27 Mar 2026 16:27:06 GMTTeamPCPTelnyxPyPIVect RansomwareSupply Chain Securityhttps://runtimerebel.com/blog/teampcp-supply-chain-checkmarx-wider-scope-litellm-pypi-compromisehttps://runtimerebel.com/blog/teampcp-supply-chain-checkmarx-wider-scope-litellm-pypi-compromiseAn update on the TeamPCP supply chain campaign details wider Checkmarx impact, LiteLLM PyPI compromise, and a CISA KEV entry.Thu, 26 Mar 2026 20:16:14 GMTTeamPCPSupply Chain AttackCheckmarxLiteLLMPyPICISA KEVhttps://runtimerebel.com/blog/teampcp-supply-chain-attacks-target-docker-hub-pypi-and-vs-codehttps://runtimerebel.com/blog/teampcp-supply-chain-attacks-target-docker-hub-pypi-and-vs-codeTeamPCP expands supply chain attack tactics from GitHub Actions to Docker Hub, PyPI, and VS Code extensions, collaborating with the Lapsus$ hacking group.Wed, 25 Mar 2026 12:24:38 GMTTeamPCPLapsusSupply Chain AttackDocker HubGitHub ActionsVS Codehttps://runtimerebel.com/blog/checkmarx-kics-vs-code-plugin-targeted-in-supply-chain-attackhttps://runtimerebel.com/blog/checkmarx-kics-vs-code-plugin-targeted-in-supply-chain-attackTeamPCP exploited Checkmarx KICS, VS Code plugins, and LiteLLM in a supply chain attack targeting code scanners and AI libraries, indicating expanding threats.Wed, 25 Mar 2026 00:37:08 GMTTeamPCPCheckmarx KICSVS CodeLiteLLMSupply Chain Attackhttps://runtimerebel.com/blog/litellm-pypi-supply-chain-attack-teampcp-steals-credentialshttps://runtimerebel.com/blog/litellm-pypi-supply-chain-attack-teampcp-steals-credentialsTeamPCP compromised the LiteLLM PyPI package, backdooring it to steal credentials and auth tokens from hundreds of thousands of devices.Wed, 25 Mar 2026 00:36:46 GMTLiteLLMPyPITeamPCPSupply Chain AttackCredential TheftPython Packagehttps://runtimerebel.com/blog/teampcp-backdoors-litellm-1-82-7-1-82-8-via-ci-cd-compromisehttps://runtimerebel.com/blog/teampcp-backdoors-litellm-1-82-7-1-82-8-via-ci-cd-compromiseTeamPCP threat actors compromised LiteLLM versions 1.82.7 and 1.82.8, deploying credential harvesters and Kubernetes lateral movement tools via CI/CD.Tue, 24 Mar 2026 20:18:30 GMTLiteLLMTeamPCPSupply Chain AttackPython SecurityKuberneteshttps://runtimerebel.com/blog/teampcp-targets-kubernetes-clusters-with-iran-specific-wiper-malwarehttps://runtimerebel.com/blog/teampcp-targets-kubernetes-clusters-with-iran-specific-wiper-malwareTeamPCP is targeting misconfigured Kubernetes clusters to deploy a data-wiping script that specifically triggers on Iranian system configurations and locales.Mon, 23 Mar 2026 20:17:25 GMTTeamPCPKubernetesWiper MalwareCloud SecurityIranhttps://runtimerebel.com/blog/trivy-supply-chain-attack-teampcp-pushes-infostealer-via-githubhttps://runtimerebel.com/blog/trivy-supply-chain-attack-teampcp-pushes-infostealer-via-githubThreat actor TeamPCP compromised the Trivy-action repository to distribute infostealer malware through GitHub Actions, targeting CI/CD pipelines and secrets.Sat, 21 Mar 2026 20:08:15 GMTTrivy ScannerGitHub ActionsTeamPCPInfostealerCI CD Security