Overview: TeamPCP’s Evolving Threat Landscape
Recent analysis by Oligo Security researchers Avi Lumelsky and Gal Elbaz has illuminated the extensive and evolving operations of the threat actor known as TeamPCP, revealing activity dating back to 2020. This group has consistently targeted internet-facing infrastructure, demonstrating a clear progression from compromising systems for cryptocurrency mining to sophisticated supply chain attacks and deploying destructive wiper malware. Their operational tradecraft, characterized by overlapping infrastructure, malware deployment paths, and staging techniques, underscores a persistent and adaptive threat to a wide array of digital environments, as detailed by The Hacker News.
Initially identified towards the end of 2025 for exploiting flaws in React Server Components (RSC) and Next.js, TeamPCP’s historical footprint now extends to earlier campaigns, indicating a long-standing presence in the cybercrime ecosystem. The evolution of their TTPs (Tactics, Techniques, and Procedures) from opportunistic exploitation to weaponizing software supply chains highlights a significant and escalating risk for organizations globally.
The Evolution of TeamPCP’s Operations
Early Infrastructure Exploitation and Securing Redis Servers Against TA-NATALSTATUS
TeamPCP’s initial campaigns, preceding their formal branding, focused heavily on exploiting internet-accessible infrastructure. Evidence suggests the actor was actively targeting Redis, Docker, React, and Ray servers since 2020. A prominent example is the TA-NATALSTATUS campaign, which specifically exploited exposed Redis servers to deploy cryptocurrency miners. This campaign is considered an evolution of earlier Redis-targeting activities detailed by Trend Micro, confirming TeamPCP’s long-term interest in leveraging these vulnerable services.
Another related campaign, ShadowRay 2.0 (also known as IronErn), observed in the second half of 2025, involved hijacking artificial intelligence (AI) infrastructure to establish a self-propagating botnet. These early activities established a foundation of automated and wormable exploitation techniques that the group would later refine and apply to more complex targets.
Cloud Native and Supply Chain Expansion
The threat actor later diversified its focus, moving into more complex cloud-native environments and supply chain compromises. Operation PCPcat, for instance, involved exploiting security flaws in React Server Components and Next.js to extract credentials and sensitive data from compromised environments. Flare researchers also detailed a massive campaign by TeamPCP targeting cloud-native environments to build extensive proxy and scanning infrastructure, ultimately aiming to exfiltrate data, deploy ransomware, conduct extortion, and mine cryptocurrency.
A critical pivot for TeamPCP has been its expansion into high-profile supply chain attacks. By weaponizing the interconnected nature of modern software development, the group has engaged in poisoning popular open-source libraries through a combination of GitHub Actions and token theft abuse. This allows them to infect developer systems en masse, leveraging legitimate cloud infrastructure and repurposing established exploitation methods to achieve broader impact. Mitigating TeamPCP supply chain attacks requires a multi-layered security approach that extends beyond traditional perimeter defenses.
Malware Arsenal: Kube.py and Destructive Capabilities
TeamPCP’s operational sophistication is also reflected in its malware arsenal, particularly a Python script named kube.py. This tool is specifically designed for post-breach activities within Kubernetes environments. While earlier versions of kube.py concentrated on propagation and establishing persistence, new variants observed as recently as March 2026 have incorporated dangerous wiper-like functionality.
These destructive capabilities include a check for the Iran timezone on victim systems. If detected, the malware deploys a DaemonSet that wipes every node in the cluster using a component named Kamikaze. For non-Kubernetes Iranian systems, a poison_pill() routine is executed to erase the entire file system. In Kubernetes nodes located outside of Iran, the kube.py variant deploys the CanisterWorm backdoor. Understanding how to detect TeamPCP Kubernetes exploits and associated malware is paramount for organizations utilizing containerized environments.
Actionable Recommendations for Defenders
Given the breadth and severity of TeamPCP’s activities, organizations must adopt a proactive and comprehensive security posture:
- Patch Management: Immediately apply security updates for all internet-facing infrastructure, especially Redis, Docker, React, Next.js, and Ray, to address known vulnerabilities that TeamPCP exploits.
- Cloud Native Security: Implement rigorous security configurations, continuous monitoring, and access controls for Kubernetes and other cloud-native environments. Regularly audit configurations for misconfigurations that could facilitate initial access or lateral movement.
- Supply Chain Security: Enhance vigilance over software supply chains. This includes verifying the integrity of open-source libraries, securing GitHub and GitLab environments against token theft, and implementing strict access controls for CI/CD pipelines.
- Network Segmentation: Isolate critical systems and development environments from general networks to limit the blast radius of any potential compromise.
- Endpoint Detection and Response (EDR): Deploy and configure EDR solutions to detect and respond to suspicious activity, particularly the execution of unusual scripts like
kube.pyor indicators of cryptocurrency mining. - Incident Response Planning: Develop and regularly test incident response plans specifically addressing data exfiltration, ransomware, and destructive wiper attacks to minimize potential damage and recovery time.
Related: TeamPCP Campaign Update: Mini Shai-Hulud Framework Gains Adoption, Checkmarx Jenkins AST Plugin Compromised in TeamPCP Attack