TeamPCP Threat Actor Profile Guide: Supply Chain Worms That Harvest Cloud Credentials

TeamPCP compromises the tools developers and pipelines trust, then uses the tokens those tools can reach to publish poisoned releases of other projects, turning each victim's credentials into the next victim's malware. This profile uses MITRE ATT&CK (G1056), the FBI FLASH on TeamPCP of 2 July 2026, Aqua Security's Trivy advisory, Palo Alto Networks Unit 42 and Trend Micro research. It covers who the group is, the credential types it hunts, the 2026 cascade of compromises, and the controls and detections that stop the chain. It is for platform, DevSecOps, cloud and security operations teams; attribution follows each source's wording, and several links are the group's own claims.

Key takeaways

• The product is credentials. The FBI says TeamPCP aims to extract cloud access tokens, SSH keys and Kubernetes secrets, and that stolen data may be weaponised long after the initial compromise.
• Each compromise funds the next. Unit 42 traces PyPI tokens taken in the Trivy compromise to the LiteLLM releases, and npm tokens to 47 more packages infected in under 60 seconds. Rotation speed decides the blast radius.
• Mutable references are the entry point. 76 of 77 trivy-action tags were force-pushed to malicious commits; workflows that referenced a tag ran the stealer, while pins to a safe commit SHA did not.
• Incomplete rotation kept the door open. Aqua's advisory says rotation after the 1 March disclosure was not atomic, so the attacker may have used a still-valid token to steal the new secrets.
• Monetisation is extortion. MITRE and Unit 42 report partnerships with the Vect and CipherForce ransomware groups and leak-site publication, so a pipeline leak can become a ransomware incident weeks later.

Who they are (names and aliases)

MITRE ATT&CK added TeamPCP as G1056 in 2026 and describes a financially motivated, cloud-native group active since at least September 2025. It began with ransomware and cryptocurrency theft and shifted in early 2026 to worm-driven credential theft and supply chain attacks on CI/CD workflows. The group names itself, posts on Telegram and X, and its payloads label themselves "TeamPCP Cloud stealer", so some links rest on self-identification; Socket noted that could be a false flag.

Malware associated by MITRE: TeamPCP Cloud Stealer (S9041), a filesystem stealer covering more than 50 sensitive paths; CanisterWorm (S9042), a self-propagating npm worm with a wiper and command and control through an Internet Computer Protocol canister; and Mini Shai-Hulud (S9043), derived from Shai-Hulud, which can use stolen npm and GitHub OIDC tokens to spread to other packages of a compromised maintainer. The FBI adds SANDCLOCK and a Mini Shai-Hulud variant called Miasma. See the Threat Actor Naming Conventions Guide.

Targeting and motivation

• Developer and security tooling: the FBI says the group targets widely used developer and security tools because they offer supply chain entry points. Security scanners are prized: they run in privileged pipelines with broad secret access.
• Cloud-exposed services: Unit 42 reports earlier mass exploitation of React2Shell (CVE-2025-55182, in the CISA KEV catalogue since 5 December 2025) and scanning for exposed Docker APIs on port 2375, plus cryptocurrency mining.
• AI tooling: LiteLLM, xinference and the Mistral SDK were affected, and Unit 42 lists LLM API keys such as OPENAI_API_KEY and ANTHROPIC_API_KEY among targets.
• Motivation: financial. MITRE records extortion, partnerships with ransomware actors, cryptocurrency theft and, in May 2026, a claim of co-ownership of the BreachForums criminal forum. Trend Micro reports the Vect group publishing victims with data attributed to TeamPCP-stolen credentials from 15 April 2026.

Tactics and techniques (MITRE ATT&CK)

All IDs are in MITRE's G1056 list (ATT&CK v20) and were checked against the official dataset.

How they abuse identities and credentials

This is a non-human identity campaign end to end. Almost every step uses a machine credential: a bot account's personal access token, a registry publishing token, an OIDC token minted in a workflow, a Kubernetes service account token or a cloud access key.

• Bot and service accounts: Unit 42 reports the aqua-bot service account was compromised for the Trivy release. Long-lived PATs on bot accounts with write access to release tags are the highest-value target in this playbook. See the GitHub Personal Access Tokens Security Guide.
• Runner memory: the Trivy advisory says the injected action dumped runner process memory to extract secrets, and Unit 42 notes this bypassed GitHub's log masking. Any secret exposed to a job is exposed to code running in it.
• Publishing tokens: npm and PyPI tokens let the worm publish to every package a maintainer controls. Trusted publishing narrows this but, as MITRE notes for Mini Shai-Hulud, an OIDC token obtained inside a compromised workflow can still publish. See the npm Tokens Security Guide and the PyPI API Tokens and Trusted Publishing Security Guide.
• Account recovery: the FBI says the group exploited stale or expired recovery email domains on npm maintainer accounts to take over publishing credentials.
• Cloud and cluster credentials: Unit 42 lists instance metadata (IMDS) access, Kubernetes configs and service account tokens; Trend Micro advises reviewing CloudTrail for secretsmanager:ListSecrets, secretsmanager:GetSecretValue and ssm:DescribeParameters calls from CI roles. See the Kubernetes Service Account Token Guide.
• Fallback exfiltration through the victim: if exfiltration failed and a GitHub PAT was available, the Trivy payload created a public tpcp-docs repository on the victim's account. The FBI lists tpcp-docs and docs-tpcp as repository names to search for.

Notable incidents

Exact dates vary by a day between sources because of time zones; the table follows the primary or most specific source. Trend Micro counts at least seven waves between 19 March and 24 April alone.

Detection and defence

Controls that break the cascade

• Pin everything immutable: the FBI and Aqua both recommend pinning GitHub Actions to full commit SHAs; Trend Micro adds pinning container images by digest. Aqua's advisory notes images referenced by digest were unaffected. See the GitHub and GitHub Actions Security Guide.
• Delay new versions: the FBI recommends a minimum package age, for example 7 days, in all installation environments. Most TeamPCP releases were pulled within hours.
• Rotate atomically, from a clean host: revoke every credential a compromised job could reach in one change window, not one at a time, and do it from a host outside the affected CI environment, as Trend Micro advises.
• Shrink what a job can steal: per-job, short-lived credentials (OIDC to cloud providers, scoped registry tokens), no long-lived PATs on bot accounts, and separate release jobs that never run third-party scanners. See the CI/CD Pipeline Identity Security Guide.
• Egress control on runners: allowlist HTTPS destinations; the FBI recommends runtime behavioural monitoring for unexpected outbound connections.
• Close workflow injection: Trend Micro points to untrusted event data such as ${{ github.event.comment.body }} interpolated into run: blocks as the flaw behind the elementary-data release.
• Protect maintainer accounts: phishing-resistant MFA for publishing access and audits of recovery email domains (FBI).

Detection signals

For the response sequence, use the Malicious Package Worm Response Playbook and the CI/CD Pipeline Compromise Playbook.

Rollout

1. Now: search for the affected versions and tpcp-docs repositories; if any pipeline ran an affected version, treat every secret it could reach as exposed and rotate them together.
2. Weeks 1 to 2: inventory third-party actions, extensions and scanners in pipelines (the FBI's first CI/CD recommendation) and pin them by SHA or digest; use automated tooling so updates still flow.
3. Weeks 2 to 6: replace bot-account PATs and long-lived registry tokens with OIDC and trusted publishing; enforce a minimum package age in a pilot repository first, with a documented override for urgent security fixes.
4. Weeks 6 to 10: runner egress allowlists in audit mode, then enforce; alerts on tag moves and out-of-workflow publishes.
5. Ongoing: tabletop a scanner compromise and measure how long full rotation takes.

Small vs large: a small team gets most value from SHA pinning, package age delay and trusted publishing. Large organisations with thousands of repositories need central policy (organisation-level allowed actions, registry proxies) and an automated rotation capability, because manual rotation is exactly where Aqua's incomplete rotation failed.

Metrics

• Percentage of workflow action references pinned to a full SHA.
• Long-lived publishing tokens and bot-account PATs remaining (target zero).
• Time to rotate every secret reachable from one pipeline, measured in exercises.
• Percentage of runners behind an egress allowlist.
• Installs blocked by the minimum package age policy, as evidence it is enforced.

Common failure patterns

• Trusting tags: a tag is a pointer the attacker can move.
• Rotating in stages: the Trivy sequel happened because one token survived the first rotation.
• Scanners in the release job: the LiteLLM token leaked because a scanner ran where publishing credentials lived.
• Assuming signatures mean safety: MITRE records malicious packages receiving legitimate signing from compromised release workflows.
• Missing one token: the GitHub breach page records Grafana Labs hit after one workflow token was missed during rotation.

Framework mapping

Practitioner checklist

• Search for tpcp-docs and docs-tpcp repositories and for the affected Trivy, KICS, LiteLLM and telnyx versions.
• Pin every GitHub Action to a full commit SHA and every container image to a digest.
• Enforce a minimum package age for npm and PyPI installs, with a documented override.
• Replace long-lived PATs and registry tokens with OIDC-based, short-lived, repository-scoped credentials.
• Keep scanners and third-party actions out of jobs that hold publishing or production credentials.
• Rehearse atomic rotation of every secret reachable from a pipeline, run from a clean host.
• Apply egress allowlists to CI runners and alert on new destinations.
• Require phishing-resistant MFA for maintainers and check recovery email domains.

Standards and references

• MITRE ATT&CK: TeamPCP (G1056)
• FBI: FLASH-20260702-01 TeamPCP
• Aqua Security: Trivy security advisory GHSA-69fq-xp46-6x23
• CISA: Known Exploited Vulnerabilities Catalog
• Palo Alto Networks Unit 42: TeamPCP supply chain attacks
• Trend Micro: Analyzing TeamPCP supply chain attacks
• MITRE ATT&CK: Compromise Software Dependencies and Development Tools (T1195.001)
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: Software Supply Chain Security Guide · Malicious Package and Dependency Confusion Guide · Git Secret Scanning Guide · Threat Actors Targeting SaaS and Cloud Identity Guide