The Attack Chain: How TeamPCP Compromised Developer Tools

TeamPCP (tracked as UNC6780 by Google's Threat Intelligence Group, also using aliases DeadCatx3, PCPcat, and ShellForce) started with a single incompletely rotated GitHub personal access token .

Credential-Harvesting Sequence

• March 19 — Aqua Security's Trivy: The initial compromise. TeamPCP gained access to Trivy's GitHub Actions and Docker Hub signing keys, then force-pushed malicious code to 75 of 76 trivy-action version tags and published poisoned binaries to GitHub Releases and Docker Hub . This was assigned CVE-2026-33634 with a CVSS score of 9.4 .

• March 20 — BerriAI's LiteLLM: Using credentials stolen from the Trivy pipeline, TeamPCP pushed malicious versions of LiteLLM, an AI gateway tool used to access more than 100 LLM APIs, to PyPI and NPM .

• March 27 — Telnyx PyPI: TeamPCP published malicious versions (4.87.1 and 4.87.2) of the Telnyx Python SDK .

• April 22 — Checkmarx KICS and Bitwarden CLI: Later waves targeted Checkmarx's KICS security scanner and Bitwarden's CLI within hours of each other, sharing the same C2 infrastructure . TrendMicro confirmed these as part of the broader TeamPCP campaign .

Ecosystem Cascade (6 Days)

Within six days, the attack spread across:

• GitHub Actions — poisoned CI/CD workflows stole tokens and signing keys
• Docker Hub — malicious container images pushed via compromised accounts
• PyPI — malicious LiteLLM and Telnyx packages
• NPM — infected packages
• OpenVSX (VS Code extension marketplace) — poisoned extensions

This was later characterized as the first documented self-propagating supply chain worm to autonomously cross ecosystem boundaries .

Scale of Impact

• Over 1,000 enterprise cloud environments compromised, per Halcyon's reporting on the Vect extortion phase . Mandiant estimates projected growth to 5,000–10,000 .
• Approximately 340 GB of uncompressed data stolen from the Trivy/LiteLLM pipeline alone .
• Roughly 500,000 credentials harvested across the campaign .

FBI FLASH Alert (July 2, 2026)

On July 2, 2026, the FBI's Cyber Division issued a critical alert (reported in Spanish media on July 3) confirming that TeamPCP had infiltrated development environments and exfiltrated cloud access tokens, SSH keys, and Kubernetes secrets .

FBI's Specific Mitigation Recommendations

Based on the alert coverage, the FBI advised organizations to:

• Audit build/deployment pipelines for compromised tool versions used between March 19–24; assume any credentials accessible in those environments were stolen
• Rotate all credentials that could have been exposed
• Pin GitHub Actions workflows to full commit SHAs (verified hashes) instead of tags or branches
• Enforce least-privilege CI/CD permissions — restrict which tokens and secrets workflows can access
• Implement phishing-resistant MFA (e.g., FIDO2/WebAuthn)
• Rotate all cloud tokens, SSH keys, and Kubernetes secrets immediately
• Search for suspicious repositories named "tpcp-docs" or "docs-tpcp" used by the attackers for staging

The alert also noted that data and credentials already exfiltrated should be considered a persistent risk .

Partnership with Vect Ransomware

Formal Operational Partnership (Late March 2026)

• March 26–27, 2026 — TeamPCP formally partnered with the Vect ransomware-as-a-service (RaaS) operation, which first appeared in December 2025 .
• The partnership was announced on the dark web forum "Breached" .
• Vect immediately began using TeamPCP's stolen credential access for double-extortion ransomware — encrypting victims and publishing stolen data .
• The first named victim data from the Trivy compromise was published by Vect in mid-April 2026 .

Vect's Additional Partnership with BreachForums (April 16–18, 2026)

• On approximately April 16–18, 2026, Vect additionally partnered with the BreachForums cybercrime marketplace .
• Under this agreement, all ~300,000 registered BreachForums users were given access to Vect affiliate keys, massively expanding the ransomware operator base .
• The Dataminr Intel Brief described this convergence as "unprecedented affiliate mobilization" .

Sophos Research (April 24, 2026)

Sophos X-Ops published research on April 24, 2026 documenting the Checkmarx KICS and Bitwarden CLI compromises as part of the TeamPCP campaign . Key findings:

• Both tools were hijacked on April 22, 2026 within hours of each other
• They shared the same C2 domain, linking them to the same threat actor
• The attacks abused trusted CI/CD release workflows to steal credentials at scale

TeamPCP's Links to The Com Collective

The search results did not surface direct evidence linking TeamPCP to The Com collective. TeamPCP has been associated with the LAPSUS$ data-sales pipeline and operates its own CipherForce ransomware track, but Com-specific links were not found in the available sources .

Defender Takeaways

The TeamPCP campaign represents a turning point in cloud security: attackers are no longer bypassing defenses — they are weaponizing them. The key takeaways for defenders:

1. Treat CI/CD pipelines as critical attack surfaces — audit all workflow permissions and adopt commit-SHA pinning
2. Assume credential exposure if a compromised tool ran — rotate all secrets immediately
3. Invest in phishing-resistant MFA — FIDO2/WebAuthn can prevent follow-on access even if tokens are stolen
4. Monitor for staging repositories named tpcp-docs or docs-tpcp
5. Prepare for the operational partnership model — initial-access brokers are now formally teaming with ransomware affiliates

The Attack Chain: How TeamPCP Compromised Developer Tools

TeamPCP (tracked as UNC6780 by Google's Threat Intelligence Group, also using aliases DeadCatx3, PCPcat, and ShellForce) started with a single incompletely rotated GitHub personal access token .

Credential-Harvesting Sequence

• March 19 — Aqua Security's Trivy: The initial compromise. TeamPCP gained access to Trivy's GitHub Actions and Docker Hub signing keys, then force-pushed malicious code to 75 of 76 trivy-action version tags and published poisoned binaries to GitHub Releases and Docker Hub . This was assigned CVE-2026-33634 with a CVSS score of 9.4 .

• March 20 — BerriAI's LiteLLM: Using credentials stolen from the Trivy pipeline, TeamPCP pushed malicious versions of LiteLLM, an AI gateway tool used to access more than 100 LLM APIs, to PyPI and NPM .

• March 27 — Telnyx PyPI: TeamPCP published malicious versions (4.87.1 and 4.87.2) of the Telnyx Python SDK .

• April 22 — Checkmarx KICS and Bitwarden CLI: Later waves targeted Checkmarx's KICS security scanner and Bitwarden's CLI within hours of each other, sharing the same C2 infrastructure . TrendMicro confirmed these as part of the broader TeamPCP campaign .

Ecosystem Cascade (6 Days)

Within six days, the attack spread across:

• GitHub Actions — poisoned CI/CD workflows stole tokens and signing keys
• Docker Hub — malicious container images pushed via compromised accounts
• PyPI — malicious LiteLLM and Telnyx packages
• NPM — infected packages
• OpenVSX (VS Code extension marketplace) — poisoned extensions

This was later characterized as the first documented self-propagating supply chain worm to autonomously cross ecosystem boundaries .

Scale of Impact

• Over 1,000 enterprise cloud environments compromised, per Halcyon's reporting on the Vect extortion phase . Mandiant estimates projected growth to 5,000–10,000 .
• Approximately 340 GB of uncompressed data stolen from the Trivy/LiteLLM pipeline alone .
• Roughly 500,000 credentials harvested across the campaign .

FBI FLASH Alert (July 2, 2026)

On July 2, 2026, the FBI's Cyber Division issued a critical alert (reported in Spanish media on July 3) confirming that TeamPCP had infiltrated development environments and exfiltrated cloud access tokens, SSH keys, and Kubernetes secrets .

FBI's Specific Mitigation Recommendations

Based on the alert coverage, the FBI advised organizations to:

• Audit build/deployment pipelines for compromised tool versions used between March 19–24; assume any credentials accessible in those environments were stolen
• Rotate all credentials that could have been exposed
• Pin GitHub Actions workflows to full commit SHAs (verified hashes) instead of tags or branches
• Enforce least-privilege CI/CD permissions — restrict which tokens and secrets workflows can access
• Implement phishing-resistant MFA (e.g., FIDO2/WebAuthn)
• Rotate all cloud tokens, SSH keys, and Kubernetes secrets immediately
• Search for suspicious repositories named "tpcp-docs" or "docs-tpcp" used by the attackers for staging

The alert also noted that data and credentials already exfiltrated should be considered a persistent risk .

Partnership with Vect Ransomware

Formal Operational Partnership (Late March 2026)

• March 26–27, 2026 — TeamPCP formally partnered with the Vect ransomware-as-a-service (RaaS) operation, which first appeared in December 2025 .
• The partnership was announced on the dark web forum "Breached" .
• Vect immediately began using TeamPCP's stolen credential access for double-extortion ransomware — encrypting victims and publishing stolen data .
• The first named victim data from the Trivy compromise was published by Vect in mid-April 2026 .

Vect's Additional Partnership with BreachForums (April 16–18, 2026)

• On approximately April 16–18, 2026, Vect additionally partnered with the BreachForums cybercrime marketplace .
• Under this agreement, all ~300,000 registered BreachForums users were given access to Vect affiliate keys, massively expanding the ransomware operator base .
• The Dataminr Intel Brief described this convergence as "unprecedented affiliate mobilization" .

Sophos Research (April 24, 2026)

Sophos X-Ops published research on April 24, 2026 documenting the Checkmarx KICS and Bitwarden CLI compromises as part of the TeamPCP campaign . Key findings:

• Both tools were hijacked on April 22, 2026 within hours of each other
• They shared the same C2 domain, linking them to the same threat actor
• The attacks abused trusted CI/CD release workflows to steal credentials at scale

TeamPCP's Links to The Com Collective

The search results did not surface direct evidence linking TeamPCP to The Com collective. TeamPCP has been associated with the LAPSUS$ data-sales pipeline and operates its own CipherForce ransomware track, but Com-specific links were not found in the available sources .

Defender Takeaways

The TeamPCP campaign represents a turning point in cloud security: attackers are no longer bypassing defenses — they are weaponizing them. The key takeaways for defenders:

1. Treat CI/CD pipelines as critical attack surfaces — audit all workflow permissions and adopt commit-SHA pinning
2. Assume credential exposure if a compromised tool ran — rotate all secrets immediately
3. Invest in phishing-resistant MFA — FIDO2/WebAuthn can prevent follow-on access even if tokens are stolen
4. Monitor for staging repositories named tpcp-docs or docs-tpcp
5. Prepare for the operational partnership model — initial-access brokers are now formally teaming with ransomware affiliates