Inside the TeamPCP Supply Chain Attack: FBI Alert, Vect Ransomware, and What Defenders Must Do Now

The Attack Chain: How TeamPCP Compromised Developer Tools

TeamPCP (tracked as UNC6780 by Google's Threat Intelligence Group, also using aliases DeadCatx3, PCPcat, and ShellForce) started with a single incompletely rotated GitHub personal access token ^JG.

Credential-Harvesting Sequence

• March 19 — Aqua Security's Trivy: The initial compromise. TeamPCP gained access to Trivy's GitHub Actions and Docker Hub signing keys, then force-pushed malicious code to 75 of 76 trivy-action version tags and published poisoned binaries to GitHub Releases and Docker Hub ^ISG. This was assigned CVE-2026-33634 with a CVSS score of 9.4 ^G.

• March 20 — BerriAI's LiteLLM: Using credentials stolen from the Trivy pipeline, TeamPCP pushed malicious versions of LiteLLM, an AI gateway tool used to access more than 100 LLM APIs, to PyPI and NPM ^ISD.

• March 27 — Telnyx PyPI: TeamPCP published malicious versions (4.87.1 and 4.87.2) of the Telnyx Python SDK ^IL.

• April 22 — Checkmarx KICS and Bitwarden CLI: Later waves targeted Checkmarx's KICS security scanner and Bitwarden's CLI within hours of each other, sharing the same C2 infrastructure ^AS. TrendMicro confirmed these as part of the broader TeamPCP campaign ^T.

Ecosystem Cascade (6 Days)

Within six days, the attack spread across:

• GitHub Actions — poisoned CI/CD workflows stole tokens and signing keys
• Docker Hub — malicious container images pushed via compromised accounts
• PyPI — malicious LiteLLM and Telnyx packages
• NPM — infected packages
• OpenVSX (VS Code extension marketplace) — poisoned extensions

This was later characterized as the first documented self-propagating supply chain worm to autonomously cross ecosystem boundaries ^L.

Scale of Impact

• Over 1,000 enterprise cloud environments compromised, per Halcyon's reporting on the Vect extortion phase ^H. Mandiant estimates projected growth to 5,000–10,000 ^M.
• Approximately 340 GB of uncompressed data stolen from the Trivy/LiteLLM pipeline alone ^S.
• Roughly 500,000 credentials harvested across the campaign ^T.

FBI FLASH Alert (July 2, 2026)

On July 2, 2026, the FBI's Cyber Division issued a critical alert (reported in Spanish media on July 3) confirming that TeamPCP had infiltrated development environments and exfiltrated cloud access tokens, SSH keys, and Kubernetes secrets ^ISL.

FBI's Specific Mitigation Recommendations

Based on the alert coverage, the FBI advised organizations to:

• Audit build/deployment pipelines for compromised tool versions used between March 19–24; assume any credentials accessible in those environments were stolen ^S
• Rotate all credentials that could have been exposed ^S
• Pin GitHub Actions workflows to full commit SHAs (verified hashes) instead of tags or branches ^S
• Enforce least-privilege CI/CD permissions — restrict which tokens and secrets workflows can access ^S
• Implement phishing-resistant MFA (e.g., FIDO2/WebAuthn) ^S
• Rotate all cloud tokens, SSH keys, and Kubernetes secrets immediately ^S
• Search for suspicious repositories named "tpcp-docs" or "docs-tpcp" used by the attackers for staging ^S

The alert also noted that data and credentials already exfiltrated should be considered a persistent risk ^S.

Partnership with Vect Ransomware

Formal Operational Partnership (Late March 2026)

• March 26–27, 2026 — TeamPCP formally partnered with the Vect ransomware-as-a-service (RaaS) operation, which first appeared in December 2025 ^III.
• The partnership was announced on the dark web forum "Breached" ^S.
• Vect immediately began using TeamPCP's stolen credential access for double-extortion ransomware — encrypting victims and publishing stolen data ^FH.
• The first named victim data from the Trivy compromise was published by Vect in mid-April 2026 ^H.

Vect's Additional Partnership with BreachForums (April 16–18, 2026)

• On approximately April 16–18, 2026, Vect additionally partnered with the BreachForums cybercrime marketplace ^DH.
• Under this agreement, all ~300,000 registered BreachForums users were given access to Vect affiliate keys, massively expanding the ransomware operator base ^FD.
• The Dataminr Intel Brief described this convergence as "unprecedented affiliate mobilization" ^D.

Sophos Research (April 24, 2026)

Sophos X-Ops published research on April 24, 2026 documenting the Checkmarx KICS and Bitwarden CLI compromises as part of the TeamPCP campaign ^S. Key findings:

• Both tools were hijacked on April 22, 2026 within hours of each other
• They shared the same C2 domain, linking them to the same threat actor
• The attacks abused trusted CI/CD release workflows to steal credentials at scale ^S

TeamPCP's Links to The Com Collective

The search results did not surface direct evidence linking TeamPCP to The Com collective. TeamPCP has been associated with the LAPSUS$ data-sales pipeline and operates its own CipherForce ransomware track, but Com-specific links were not found in the available sources ^R.

Defender Takeaways

The TeamPCP campaign represents a turning point in cloud security: attackers are no longer bypassing defenses — they are weaponizing them. The key takeaways for defenders:

1. Treat CI/CD pipelines as critical attack surfaces — audit all workflow permissions and adopt commit-SHA pinning
2. Assume credential exposure if a compromised tool ran — rotate all secrets immediately
3. Invest in phishing-resistant MFA — FIDO2/WebAuthn can prevent follow-on access even if tokens are stolen
4. Monitor for staging repositories named tpcp-docs or docs-tpcp
5. Prepare for the operational partnership model — initial-access brokers are now formally teaming with ransomware affiliates