Listen to this Post
Introduction
Cybercrime rarely appears overnight. Behind every major attack campaign is often years of silent preparation, experimentation, and infrastructure building. New research has now revealed that the threat actor known as TeamPCP has likely been operating far longer than previously believed, transforming from an infrastructure-focused attacker into one of the most dangerous software supply chain threats in recent years.
Security researchers have connected multiple campaigns dating back to 2020, showing that TeamPCP systematically targeted internet-facing technologies, including Redis, Docker, Ray, React, and Kubernetes, long before the group became publicly associated with supply chain compromises. Rather than launching isolated attacks, the evidence suggests a long-term strategy focused on building scalable attack infrastructure capable of infecting thousands of systems simultaneously.
TeamPCP’s Origins Stretch Back to 2020
According to new findings published by Oligo Security researchers Avi Lumelsky and Gal Elbaz, TeamPCP’s operational history extends several years beyond its public emergence in late 2025.
The investigation uncovered significant overlaps between historical campaigns and TeamPCP’s later operations. Researchers identified matching infrastructure, malware deployment paths, staging environments, operational behaviors, backend services, and domain registrations. Collectively, these indicators paint the picture of a threat actor that has continuously evolved rather than appearing as an entirely new cybercriminal organization.
Instead of viewing TeamPCP as a recently formed hacking collective, investigators now believe it represents the continuation of a mature cybercriminal ecosystem that has steadily expanded its capabilities over multiple years.
From Infrastructure Exploitation to Large-Scale Campaigns
Throughout its evolution, TeamPCP demonstrated a consistent pattern of abusing exposed internet infrastructure.
Researchers linked the group to two major campaigns conducted during the second half of 2025.
ShadowRay 2.0 (IronErn)
ShadowRay 2.0 focused on exploiting artificial intelligence infrastructure, particularly exposed Ray clusters.
Rather than simply compromising systems, attackers transformed vulnerable AI environments into self-propagating botnets capable of expanding automatically across connected infrastructure.
This represented an important shift in modern cybercrime, where AI computing resources became attractive targets not only for data theft but also for building resilient criminal infrastructure.
TA-NATALSTATUS
Another campaign targeted exposed Redis servers.
Instead of merely stealing information, compromised servers were primarily used to deploy cryptocurrency mining malware, allowing attackers to monetize infected infrastructure over extended periods.
Researchers now believe this campaign evolved directly from malware operations first documented in 2020 by Trend Micro, suggesting remarkable operational continuity.
A Consistent Strategy Across Multiple Technologies
One of the strongest conclusions from the investigation is that TeamPCP repeatedly targeted the same categories of technologies.
Rather than depending on zero-day vulnerabilities alone, the group frequently exploited publicly known weaknesses affecting:
Redis Servers
Exposed Redis instances became initial entry points into enterprise environments, enabling malware deployment and persistent access.
Docker Infrastructure
Container environments provided attackers with opportunities to move laterally across cloud-native deployments while maintaining persistence.
Ray AI Platforms
Distributed AI computing frameworks were weaponized into botnets capable of autonomous propagation.
React and Next.js
The group later exploited weaknesses affecting React Server Components and Next.js applications, enabling credential theft and extraction of sensitive information from compromised developer environments.
This consistent targeting strategy demonstrates a deep understanding of modern cloud-native architecture.
Operation PCPcat Marked a Turning Point
Near the end of 2025, researchers publicly connected TeamPCP to vulnerabilities affecting React Server Components and Next.js.
The campaign, named Operation PCPcat, highlighted a major evolution in the group’s objectives.
Rather than focusing solely on compromised infrastructure, TeamPCP increasingly targeted developers themselves, recognizing that developer credentials provide privileged access into software ecosystems.
By stealing authentication tokens and sensitive credentials, attackers dramatically expanded the potential impact of each successful intrusion.
Cloud Infrastructure Became the Next Battlefield
Earlier research published by Flare documented another extensive operation carried out by TeamPCP.
The campaign systematically targeted cloud-native infrastructure worldwide.
Its objectives included:
Building large-scale distributed proxy networks.
Establishing scanning infrastructure.
Collecting sensitive organizational data.
Deploying ransomware.
Conducting cyber extortion.
Mining cryptocurrency.
Preparing future attack infrastructure.
Instead of treating each compromised server as an isolated victim, TeamPCP converted infected machines into components of an expanding cybercrime platform.
Supply Chain Attacks Represented a Natural Evolution
Perhaps the most alarming development was
Researchers discovered that the group poisoned trusted open-source packages by abusing GitHub Actions workflows alongside stolen authentication tokens.
This approach allowed malicious code to spread through legitimate software development pipelines.
Because developers frequently trust widely used open-source components, even a single compromised package can silently infect thousands of downstream systems.
Supply chain compromises amplify attacker reach exponentially while reducing the need for direct exploitation of individual victims.
Strong Evidence Connects Earlier Campaigns
Oligo researchers identified several technical links connecting historical campaigns with TeamPCP.
Among the strongest indicators were:
Shared GitHub and GitLab Identities
Operational accounts observed during ShadowRay 2.0 reappeared within TeamPCP infrastructure.
Common Command-and-Control Systems
Backend servers responsible for malware communication showed substantial overlap.
Similar Reverse Shell Operations
Attack techniques remained remarkably consistent across campaigns separated by several years.
Identical Malware Staging Infrastructure
Researchers observed repeated use of similar deployment methodologies, reinforcing the conclusion that these operations originated from the same operational ecosystem.
Automation Became the Core of TeamPCP Operations
Another defining characteristic is automation.
Instead of relying on manual intrusion techniques, TeamPCP invested heavily in wormable malware capable of spreading independently.
Automated exploitation significantly increases infection speed while reducing operational costs for attackers.
As organizations continue exposing cloud services to the internet, automated malware becomes increasingly effective at identifying and exploiting vulnerable targets within minutes.
Kubernetes Malware Grew More Dangerous
Researchers also tracked the evolution of
One important component is a Python-based script called kube.py, specifically designed for Kubernetes environments.
Earlier versions focused on:
Persistence
Maintaining long-term access after initial compromise.
Propagation
Automatically expanding infections across clusters.
However, newer variants observed during March 2026 introduced destructive capabilities previously unseen.
Kamikaze Wiper Added a Destructive Dimension
The latest malware versions introduced sophisticated logic based on victim location.
If compromised Kubernetes environments were configured for the Iran timezone, the malware launched a DaemonSet named Kamikaze, designed to wipe every node throughout the Kubernetes cluster.
This behavior transformed the campaign from financially motivated cybercrime into potentially destructive cyber sabotage.
Outside Iranian environments, compromised Kubernetes systems instead received the CanisterWorm backdoor, preserving long-term access for future operations.
Poison Pill Routine Targeted Iranian Systems
The malware also contained another dangerous function called poison_pill().
For non-Kubernetes systems configured within the Iran timezone, this routine completely erased the local file system.
Such geographically aware destructive logic is relatively uncommon and demonstrates increasingly sophisticated operational decision-making.
Rather than deploying identical payloads everywhere, TeamPCP dynamically selected different malware behaviors depending on environmental characteristics.
Researchers Stop Short of Confirming a Complete Rebrand
Although technical evidence strongly links historical campaigns to TeamPCP, researchers remain cautious.
They acknowledge that available evidence cannot definitively prove whether TeamPCP represents:
A direct rebranding.
The same operators using new identities.
Closely collaborating threat groups.
A long-standing cybercrime partnership.
Nevertheless, the operational similarities are too extensive to ignore.
The evidence overwhelmingly suggests continuity rather than coincidence.
Why This Matters
TeamPCP demonstrates how modern cybercriminal organizations evolve over time.
What began as infrastructure exploitation gradually expanded into cloud compromise, AI infrastructure abuse, automated malware deployment, developer credential theft, software supply chain poisoning, ransomware deployment, cryptocurrency mining, cyber extortion, and destructive malware.
This progression reflects a broader trend across
What Undercode Say:
The TeamPCP investigation highlights a significant transformation in modern cyber operations. Instead of operating as opportunistic hackers, today’s advanced threat actors are building long-term ecosystems that evolve over years.
One of the most notable observations is the group’s patience. Rather than immediately targeting high-value software supply chains, TeamPCP first mastered internet-facing infrastructure, learning how cloud services, containers, AI frameworks, and Kubernetes clusters interact.
This gradual evolution is strategically intelligent.
Every compromised Redis server became a future staging point.
Every exposed Docker environment became another foothold.
Every vulnerable Ray cluster became another botnet node.
Every developer credential became another gateway into trusted software.
The shift toward supply chain attacks was almost inevitable.
Software ecosystems have become deeply interconnected, meaning compromising one trusted dependency may affect thousands of downstream organizations simultaneously.
Another important takeaway is automation.
Self-propagating malware dramatically changes the economics of cybercrime.
Instead of manually compromising hundreds of servers, attackers can compromise millions of internet-facing assets using automated exploitation pipelines.
The Kubernetes-focused malware also deserves attention.
Container infrastructure has become critical for enterprise workloads, making Kubernetes an increasingly attractive target.
The introduction of geographic logic inside malware demonstrates operational maturity rarely seen in commodity cybercrime.
The Kamikaze wiping routine suggests the operators carefully evaluate environmental conditions before selecting payloads.
Organizations should also recognize that cloud-native infrastructure requires cloud-native defense strategies.
Traditional endpoint security cannot adequately protect Kubernetes clusters, containers, GitHub pipelines, and AI frameworks simultaneously.
Security teams should prioritize:
Continuous asset discovery.
Exposure management.
Runtime container monitoring.
GitHub token protection.
Multi-factor authentication.
Secrets management.
Dependency verification.
Software bill of materials (SBOM) validation.
Container image signing.
Behavioral threat detection.
Kubernetes audit logging.
Cloud workload protection platforms.
Automated patch management.
Least-privilege access controls.
Network segmentation.
Continuous vulnerability scanning.
Supply chain integrity verification.
Threat intelligence correlation.
Infrastructure-as-Code security reviews.
Regular incident response exercises.
The TeamPCP case reinforces a growing reality: attackers are no longer simply hacking servers. They are targeting the trust relationships that connect today’s software ecosystem, making prevention, visibility, and rapid response more important than ever.
Deep Analysis
TeamPCP’s operational model aligns closely with modern cloud-focused intrusion campaigns, where exposed services become the first step toward broader ecosystem compromise. Defenders should actively monitor cloud workloads, Kubernetes clusters, CI/CD pipelines, and authentication tokens for unusual behavior.
Useful Linux and Kubernetes commands for defenders include:
Check listening services
ss -tulpn
Review running Docker containers
docker ps -a
List Kubernetes pods
kubectl get pods -A
Inspect Kubernetes events
kubectl get events -A
View active DaemonSets
kubectl get daemonsets -A
Search for suspicious cron jobs
crontab -l ls -la /etc/cron
Monitor authentication logs
journalctl -u ssh
Find recently modified files
find / -type f -mtime -1 2>/dev/null
Review running processes
ps aux
Detect unusual outbound connections
netstat -antp
Check Redis exposure
redis-cli INFO
Scan for exposed services
nmap -sV <target-ip>
Verify file integrity
sha256sum <filename>
Review Git history for unauthorized changes
git log --stat
Combining these operational checks with continuous vulnerability management, secrets rotation, and supply chain monitoring can significantly reduce the risk posed by threat groups that rely on automation and cloud-native exploitation.
✅ Multiple independent investigations support that TeamPCP is linked to earlier campaigns targeting Redis, Docker, Ray, and cloud infrastructure, making the continuity assessment credible.
✅ Researchers confirmed strong technical overlaps, including infrastructure, malware deployment paths, GitHub and GitLab identities, and operational techniques. However, they also state that a complete rebranding cannot be proven with absolute certainty.
✅ Evidence supports
Prediction
(-1) TeamPCP and similar threat actors are likely to continue expanding their focus on software supply chains, AI infrastructure, and cloud-native environments. As organizations increasingly depend on interconnected development platforms, attacks against trusted open-source components, CI/CD pipelines, and Kubernetes ecosystems are expected to become more frequent, more automated, and more destructive unless defensive security practices evolve at the same pace.
▶️ Related Video (76% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: thehackernews.com
Extra Source Hub (Possible Sources for article):
https://www.reddit.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
