Listen to this Post
A New Warning From the AI Security Front
The cybersecurity landscape is changing quickly, and attackers are increasingly targeting the infrastructure that powers artificial intelligence rather than simply going after traditional endpoints. A new report attributed to Oligo Security has drawn attention to TeamPCP, a threat group that researchers say has been active for years and has connections to other operations through overlapping infrastructure.
According to the August 5, 2026 report shared by Cybersecurity News Everyday, Oligo Security links TeamPCP to groups or threat clusters identified as TA-NATALSTATUS and IronErn. The alleged connections are based on shared IP addresses, domains, servers and other infrastructure indicators. The report also associates the activity with the ShadowRay botnet campaign.
This development matters because ShadowRay demonstrated that exposed AI infrastructure can become an extremely valuable target. Oligo previously documented attacks against publicly exposed Ray servers, showing how attackers could abuse AI workloads to steal computing resources, access sensitive credentials and deploy cryptocurrency miners.
TeamPCP Has Become More Than a Supply-Chain Threat
TeamPCP has already attracted significant attention from security researchers because of its activity against open-source software ecosystems.
In research published by Oligo in April 2026, TeamPCP was associated with a coordinated series of supply-chain attacks affecting several developer tools, including Trivy, KICS, LiteLLM and Telnyx-related infrastructure. Oligo described the campaign as a rapid sequence of compromises that demonstrated how attackers can move through the software ecosystem rather than attacking organizations one victim at a time.
That history makes the latest reported TeamPCP connection especially concerning. If the same broader ecosystem of attackers is simultaneously interested in software supply chains, AI infrastructure and exposed compute resources, defenders may be dealing with an increasingly interconnected threat model.
The ShadowRay Connection Changes the Picture
ShadowRay is not simply another malware campaign. It represents an important example of attackers discovering that AI infrastructure can provide enormous computing power and access to valuable corporate information.
Oligo reported that thousands of publicly exposed Ray servers had been compromised during the original ShadowRay campaign. Researchers observed cryptocurrency mining, reverse shells and access to sensitive information, including cloud credentials, database credentials, SSH keys, AI workloads and other secrets.
The fundamental lesson was uncomfortable: an AI cluster does not have to contain a traditional ransomware payload to become extremely profitable for criminals.
AI Compute Has Become a Criminal Commodity
The economics behind these attacks are straightforward.
Modern AI systems depend on expensive CPUs, GPUs, cloud resources, storage and networking infrastructure. When attackers gain control of those resources, they can potentially convert stolen compute into cryptocurrency mining, unauthorized AI workloads or other forms of monetization.
Oligo previously estimated that the computing resources exposed in the ShadowRay campaign represented potentially enormous economic value. The researchers also documented cases where attackers could obtain credentials that opened pathways into additional systems.
For cybercriminals, compromising an AI cluster can therefore be equivalent to finding a warehouse filled with expensive computing equipment that someone else is paying to operate.
IronErn Shows How ShadowRay Evolved
The connection to IronErn is particularly significant because Oligo has previously described IronErn440 activity as part of a later evolution of ShadowRay.
In its ShadowRay 2.0 research, Oligo said attackers turned exposed Ray infrastructure into a self-propagating botnet. Rather than relying solely on conventional exploitation, the operation abused legitimate Ray functionality exposed to untrusted networks.
That campaign demonstrated a dangerous principle: attackers do not always need to discover a brand-new vulnerability when an existing system is deployed in an unsafe way.
The Real Weakness May Be Exposure
One of the most important lessons from ShadowRay is that security problems do not always begin with a software bug.
Ray’s architecture includes powerful capabilities intended for trusted environments. When those capabilities become accessible from the public internet without adequate authentication, segmentation or access controls, functionality intended for legitimate users can become an attack surface.
Oligo previously warned that exposed Ray dashboards could allow unauthorized parties to submit jobs and execute commands. The company recommended network isolation, firewall controls, security groups and authorization layers around exposed Ray infrastructure.
This is why AI security cannot be reduced to patch management alone.
Why Shared Infrastructure Matters
The reported use of common IP addresses, domains and servers is another important signal.
Threat researchers frequently use infrastructure overlaps to connect seemingly separate campaigns. A reused server, domain, certificate, hosting provider or network address can provide clues that different attacks may be operated by the same actor or by groups sharing tools and infrastructure.
However, infrastructure overlap should not automatically be interpreted as definitive proof of common ownership. Shared hosting, compromised servers and reused public services can create false connections.
That distinction is particularly important when discussing threat-intelligence claims attributed to social-media reports.
TeamPCP’s Bigger Lesson for Open Source
The TeamPCP story also reflects a broader transformation in cybersecurity.
Open-source software has become fundamental to cloud computing, DevOps and artificial intelligence. A single compromised project can potentially reach thousands of developers and organizations downstream.
That makes the software supply chain attractive because attackers can pursue leverage instead of volume.
Rather than breaking into 1,000 companies individually, an attacker may attempt to compromise one widely used project and allow trusted software distribution mechanisms to carry malicious code toward many victims.
AI Infrastructure Creates a Second Supply Chain
The problem becomes even more complicated when open-source software is used to construct AI infrastructure.
A modern AI environment can contain operating systems, container images, Python packages, orchestration frameworks, model libraries, inference servers, cloud credentials, APIs and GPU management systems.
Each component introduces another dependency.
If an attacker compromises one layer, the consequences may extend far beyond the original application.
The Shadow Vulnerability Problem
Oligo has previously used the term “shadow vulnerabilities” to describe security weaknesses that may not fit neatly into conventional CVE-based vulnerability management.
The
ShadowRay became a prominent example because attackers were able to exploit exposed functionality in real environments.
The lesson for defenders is simple: a vulnerability database cannot describe everything that can go wrong in production.
Why Static Scanning Is Not Enough
Traditional security programs often focus heavily on identifying vulnerable software versions.
That remains essential.
But an organization can have perfectly patched software that is still dangerously exposed because of incorrect network configuration, excessive permissions or an internet-facing management interface.
This is particularly important for AI platforms because many of them are designed to perform powerful operations.
Security teams therefore need visibility into both what software is installed and what that software is actually doing at runtime.
The Rise of AI-on-AI Attacks
The ShadowRay 2.0 research also highlighted another emerging trend: attackers using AI-assisted techniques while attacking AI infrastructure.
Oligo reported evidence suggesting that some malicious payloads were generated or accelerated with the assistance of large language models.
This creates an uncomfortable feedback loop.
Defenders are using AI to identify threats.
Attackers are using AI to develop malware.
AI infrastructure itself is becoming a target.
The battlefield is increasingly circular.
What Makes the Latest Report Important
The August 5 report is important not necessarily because it proves a completely new attack technique, but because it potentially connects several previously observed pieces of the threat landscape.
TeamPCP.
TA-NATALSTATUS.
IronErn.
ShadowRay.
AI infrastructure.
Open-source supply-chain attacks.
Individually, these subjects are already concerning.
Together, they suggest a threat ecosystem in which attackers can move between software supply chains, cloud infrastructure and AI compute environments.
A Threat Actor Does Not Need to Stay in One Lane
Modern cybercriminal groups increasingly behave less like traditional malware gangs and more like flexible criminal enterprises.
They may steal credentials in one campaign, compromise open-source packages in another, hijack cloud infrastructure elsewhere and use stolen computing power for cryptocurrency mining.
The boundaries between these operations are becoming increasingly difficult to define.
That is why defenders should pay attention to infrastructure relationships instead of focusing only on malware names.
The Cost of Ignoring AI Infrastructure Security
Organizations often spend significant resources protecting employee laptops, email accounts and public websites.
AI clusters can receive less attention because they are frequently considered specialized infrastructure.
That assumption is dangerous.
AI servers may contain API credentials, model weights, proprietary datasets, customer information and enormous amounts of computational capacity.
A compromised AI cluster could therefore become both a data-security incident and a financial-security incident.
What Security Teams Should Watch
Organizations operating Ray or similar AI infrastructure should immediately review whether management interfaces are exposed to the public internet.
Network exposure should be minimized.
Authentication should be enforced wherever possible.
Cloud credentials should be stored securely and granted only the permissions required for the workload.
Unexpected GPU consumption should be investigated.
Sudden increases in CPU usage should also be investigated.
Unknown processes running inside AI containers deserve attention.
Unexpected outbound connections can provide another useful signal.
New SSH keys should be reviewed.
Unexpected scheduled jobs should be investigated.
And unexplained cryptocurrency-mining activity should never be dismissed as an ordinary performance problem.
Defensive Commands for Investigation
For Linux-based AI servers, defenders can begin with basic defensive checks such as reviewing listening services, active processes, scheduled tasks and recent authentication activity.
ss -tulpn ps aux --sort=-%cpu | head ps aux --sort=-%mem | head crontab -l systemctl list-units --type=service --state=running last
These commands are not a substitute for an enterprise investigation, but they can help administrators identify obvious signs of unexpected exposure or resource abuse.
Security teams should also correlate endpoint telemetry with cloud logs, identity events, container activity and network traffic rather than relying on a single source of evidence.
The Most Important Defensive Command Is Isolation
The strongest defense is often not a complicated security product.
It is reducing unnecessary exposure.
AI management interfaces should not be directly reachable from the public internet unless there is a compelling reason and appropriate authentication and access controls are in place.
Private networking, VPN access, firewall policies, security groups and strict identity controls can dramatically reduce the number of systems an attacker can reach.
Oligo has repeatedly emphasized the importance of protecting AI infrastructure at runtime and preventing unauthorized access to sensitive services.
Incident Response Should Assume Credential Exposure
When an AI server is compromised, organizations should not assume that only the server itself was affected.
Attackers may search for environment variables, API tokens, cloud credentials, SSH keys, configuration files and other secrets.
That means incident response should include credential rotation and investigation of connected systems.
Simply deleting a suspicious process may leave the attacker with another route back into the environment.
The Bigger Cybersecurity Trend
The TeamPCP and ShadowRay story fits into a much larger trend in cybersecurity: attackers are targeting the infrastructure that organizations increasingly depend on to build and operate technology.
The target is no longer just the employee.
It can be the developer.
It can be the package repository.
It can be the container.
It can be the cloud account.
It can be the GPU cluster.
It can be the AI framework itself.
Why AI Security Is Becoming Infrastructure Security
The security industry has spent years treating artificial intelligence primarily as an application-security problem.
That definition is becoming outdated.
AI security now includes operating systems, networking, cloud infrastructure, software dependencies, identity systems, model-serving platforms and compute resources.
The model is only one part of the attack surface.
The infrastructure surrounding it may be even more valuable.
The Human Factor Still Matters
Even highly sophisticated attacks frequently depend on ordinary configuration mistakes.
An administrator exposes a management port.
A developer leaves a cloud credential in an environment variable.
A production system inherits permissions from a development environment.
A forgotten server remains online.
A security team trusts a vulnerability scanner that does not recognize a particular runtime behavior.
These small decisions can create the opening that sophisticated attackers need.
What Undercode Says:
- AI Infrastructure Has Become a High-Value Target
The most important takeaway is that AI infrastructure should now be treated as critical production infrastructure, not as an experimental technology sitting outside the traditional security program.
2. ShadowRay Was an Early Warning
The ShadowRay campaign showed that attackers could monetize exposed AI infrastructure through stolen compute, credentials and workloads.
3. TeamPCP Represents a Broader Problem
TeamPCP’s documented supply-chain activity demonstrates how attackers can exploit trust relationships within open-source ecosystems.
4. Infrastructure Overlap Is a Valuable Signal
Shared infrastructure between threat campaigns can help researchers identify relationships that would otherwise remain hidden.
5. But Attribution Requires Caution
An IP address or server appearing in multiple investigations does not automatically prove that the same individual or organization controls every associated campaign.
6. IronErn Is Particularly Relevant
Oligo’s previous ShadowRay 2.0 research directly associated IronErn440 activity with the evolution of attacks against Ray infrastructure.
7. The Attack Surface Is Expanding
AI systems create an ecosystem of APIs, models, clusters, containers, credentials and orchestration tools that can all become potential attack surfaces.
8. Configuration Can Become Exploitation
A legitimate feature can become dangerous when exposed to an untrusted network.
9. CVEs Are Not the Entire Story
Security teams cannot rely exclusively on CVE databases because insecure deployments and dangerous configurations may never receive a conventional vulnerability identifier.
10. Runtime Visibility Matters
Defenders need to know what applications are actually doing after deployment, not merely whether their packages appear patched.
11. Compute Theft Is Financially Attractive
Attackers can monetize stolen GPU and CPU resources without stealing traditional corporate data.
12. AI Makes Compute More Valuable
The enormous demand for AI processing increases the financial incentive to hijack cloud and private compute resources.
- Supply Chain and AI Security Are Converging
A compromised developer dependency can eventually reach the infrastructure responsible for running AI workloads.
14. Credentials Are the Bridge
API keys, cloud tokens and SSH credentials can allow an attacker to move from one compromised component into another environment.
15. Organizations Need Better Segmentation
AI clusters should be isolated from unrelated corporate infrastructure whenever possible.
16. Public Exposure Should Be Minimized
Management dashboards and orchestration interfaces should never be casually exposed to the internet.
17. Authentication Must Be Meaningful
A network-accessible administrative service without strong access controls can become an attractive target.
18. Monitoring GPU Usage Is Security Monitoring
Unexpected GPU consumption can be an indicator of cryptomining or unauthorized workloads.
19. Logs Can Reveal the Attack
Job histories, authentication records, container logs and network telemetry can help reconstruct suspicious activity.
20. Persistence Is a Major Concern
A compromised server may contain scheduled jobs, services or other mechanisms designed to survive a reboot.
21. Malware Can Hide Behind Legitimate Tools
Attackers increasingly use trusted infrastructure and legitimate services to make malicious activity harder to distinguish from normal operations.
22. Open Source Remains a Double-Edged Sword
Open-source software accelerates innovation, but its enormous reach also creates opportunities for supply-chain attacks.
23. AI Accelerates Both Sides
Defenders can use AI for detection and analysis, while attackers can use AI to generate, modify and adapt malicious code.
24. Security Teams Need Behavioral Detection
Knowing that a particular package exists is less useful than knowing whether that package suddenly behaves in an unexpected way.
25. Identity Has Become Central
Strong identity controls can prevent a compromised service from turning into a much larger breach.
26. Secrets Should Never Be Assumed Safe
If an attacker obtains administrative access to an AI server, every credential accessible from that environment should be considered potentially exposed.
27. Cloud Resources Need Continuous Monitoring
Attackers can exploit stolen accounts without immediately triggering obvious malware alerts.
28. AI Clusters Deserve Incident-Response Playbooks
Organizations should prepare specific procedures for compromised AI infrastructure before an incident occurs.
29. Security Budgets Must Follow Business Value
The most valuable infrastructure should receive the strongest protection, and modern AI clusters can represent enormous financial and intellectual value.
30. The Threat Is Becoming More Automated
Self-propagating behavior and automated infrastructure updates allow malicious operations to evolve faster than traditional manual campaigns.
31. Attackers Are Borrowing DevOps Practices
Continuous deployment, automated updates and distributed infrastructure are no longer exclusive to legitimate software teams.
32. Cybercrime Is Becoming More Operationally Mature
Threat actors increasingly build infrastructure that resembles legitimate technology operations.
33. Detection Must Become Continuous
Periodic vulnerability scans are useful, but they cannot provide complete visibility into changing runtime behavior.
34. Security Must Follow the Workload
Wherever AI workloads move—from private servers to cloud platforms to containers—the security controls need to move with them.
35. Shadow Vulnerabilities Are a Strategic Warning
The ShadowRay story demonstrates why organizations must look beyond conventional vulnerability databases.
36. AI Security Cannot Be an Afterthought
Organizations that build AI systems first and attempt to secure them later may discover that security controls are much harder to retrofit.
37. Infrastructure Relationships Matter
Understanding how domains, servers, credentials and software dependencies interact can reveal threats that isolated security alerts miss.
38. Attribution Should Remain Evidence-Based
The reported TeamPCP relationships are important intelligence leads, but individual claims should be distinguished from independently verified facts.
39. The Next Target Could Be Smaller
Attackers do not necessarily need a major AI company. A poorly protected AI server belonging to a smaller organization could provide useful compute and credentials.
- The Future of AI Security Is Runtime Security
The most important question may no longer be simply, “Is this software vulnerable?”
It is becoming:
“What is this software doing right now, who is controlling it, and what can it reach?”
Deep Analysis: What This Means for the Next Generation of Cyberattacks
The AI Attack Surface Is Becoming a Strategic Battlefield
The continued evolution of ShadowRay demonstrates that AI infrastructure is moving from an emerging technology category into a strategic cybersecurity battlefield.
Supply-Chain Attacks Can Become Infrastructure Attacks
A malicious dependency does not necessarily stop at the developer workstation. If that dependency reaches production AI systems, the compromise can potentially move directly into highly valuable compute infrastructure.
Threat Actors Can Monetize Access Without Ransomware
Cryptomining, stolen cloud resources, credential theft and unauthorized workloads provide alternative revenue streams that do not require encrypting a victim’s files.
AI Clusters Offer a Unique Combination of Assets
A single compromised AI environment may contain computational power, sensitive data, proprietary models and credentials simultaneously.
The Security Model Must Change
Traditional perimeter security assumes that internal infrastructure is relatively trusted. AI infrastructure requires a more granular approach in which workloads, identities, services and network paths are continuously evaluated.
The Biggest Risk May Be Invisible Activity
A compromised AI server may continue processing legitimate workloads while quietly performing unauthorized computations in the background.
Defensive Automation Will Become Essential
As attackers automate their operations, defenders will increasingly need automated detection, isolation and response mechanisms capable of reacting in seconds rather than hours.
The Economics Favor Attackers
If cloud compute remains expensive and AI demand continues increasing, stolen compute becomes an increasingly attractive commodity.
Supply Chains Will Remain Under Pressure
The TeamPCP activity documented by Oligo shows that open-source ecosystems remain a powerful target because one successful compromise can potentially affect a large downstream population.
Runtime Security Will Become a Core Requirement
Static analysis, dependency scanning and vulnerability management will remain important, but organizations will increasingly combine them with runtime monitoring.
AI Security Will Become Cloud Security
Because much AI infrastructure operates on cloud platforms, securing AI environments will increasingly require close integration between application security, cloud security and identity security.
The Most Dangerous Combination Is Access Plus Compute
A stolen credential is serious.
A compromised server is serious.
A stolen GPU cluster is serious.
Combining all three can create a much more powerful attack platform.
Attackers Will Continue Reusing Infrastructure
When criminal infrastructure is effective, threat actors have strong incentives to reuse domains, hosting patterns and deployment techniques.
That makes infrastructure intelligence increasingly valuable.
Defenders Should Track Behavior, Not Just Names
Threat actors change names.
Domains disappear.
Servers move.
Malware gets rewritten.
Behavioral indicators can remain useful even when the branding around an operation changes.
ShadowRay Is a Warning for AI Builders
Organizations building AI systems should treat security architecture as part of the initial design rather than something added after deployment.
The New Security Question
The critical question for AI operators is no longer only whether their software contains a known vulnerability.
The bigger question is whether an attacker can reach, control or abuse the infrastructure surrounding that software.
The Bottom Line
The reported TeamPCP connection to TA-NATALSTATUS, IronErn and ShadowRay should be viewed as a serious threat-intelligence signal, while keeping a clear distinction between reported attribution and independently confirmed facts.
What is already established from
The message for organizations is straightforward: protect the AI infrastructure as aggressively as you protect the data it processes.
✅ ShadowRay Is a Documented Campaign
Oligo has publicly documented ShadowRay activity targeting exposed Ray infrastructure and described compromises involving computing resources, credentials and sensitive workloads.
✅ TeamPCP Activity Is Documented by Oligo
Oligo has published research connecting TeamPCP to multiple 2026 open-source supply-chain compromises, including attacks involving widely used developer tools.
⚠️ The August 5 Attribution Requires Caution
The specific claim that TeamPCP, TA-NATALSTATUS and IronErn are connected through shared infrastructure comes from the supplied report. Oligo’s public research independently documents TeamPCP and IronErn-related ShadowRay activity, but the complete attribution described in the supplied social-media post should be treated as a reported intelligence assessment rather than an independently proven fact.
Prediction
(+1) AI Infrastructure Security Will Become a Top Enterprise Priority
As AI workloads consume increasingly valuable compute and process sensitive information, organizations will invest more heavily in protecting AI clusters, inference servers, orchestration platforms and model-serving infrastructure.
(+1) Runtime Monitoring Will Grow Rapidly
Security teams will increasingly monitor what AI infrastructure actually does in production instead of relying only on vulnerability scanners and software inventories.
(+1) Attackers Will Continue Targeting Compute
As the price and strategic value of AI compute increase, criminals will have stronger incentives to hijack GPUs and cloud resources for unauthorized workloads.
(+1) Supply-Chain and AI Attacks Will Converge
The boundary between software supply-chain compromise and AI infrastructure compromise is likely to become increasingly blurred.
(-1) AI Environments With Weak Network Controls Will Face Greater Risk
Organizations that leave administrative interfaces publicly exposed or provide excessive privileges to AI workloads could become increasingly attractive targets.
(-1) Traditional Vulnerability Management Alone Will Not Be Enough
Organizations that depend exclusively on CVE scanning may miss dangerous deployment configurations, runtime abuse and shadow vulnerabilities.
(-1) Threat Attribution Will Become More Difficult
As attackers reuse compromised infrastructure, cloud platforms, public repositories and shared hosting services, determining who is actually behind a campaign will become increasingly challenging.
(+1) The Biggest Defensive Advantage Will Be Visibility
Organizations that know which AI systems are exposed, what they are running, which identities can access them and where their data can move will have a substantially stronger position against the next generation of AI-focused cyberattacks.
▶️ Related Video (84% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: x.com
Extra Source Hub (Possible Sources for article):
https://www.medium.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
