TeamPCP

THREAT ACTOR PROFILE

TeamPCP

TeamPCP is a financially motivated cybercrime group that escalated from opportunistic cloud exploitation into some of the largest software supply-chain attacks on record. It compromises developer credentials, CI/CD pipelines and package registries to steal secrets and spread self-propagating malware, with campaigns tied to the Shai-Hulud worm family and CipherForce ransomware.

Country:

Not attributed

Supply chain / eCrime

First seen

2025

Latest IOC

IP indicators

Hosts

SHA256 hashes

Posts

IP indicators

Hosts

SHA256 hashes

Posts

TABLE OF CONTENTS

Names and aliases

Group profile

Attack lifecycle

Malware and tooling

IOCs

Notable campaigns

NAMES AND ALIASES

TeamPCP and its many handles

TeamPCP is tracked under its own name and a cluster of account identities. It maps to one entry among the supply-chain attackers we track, and its financially motivated operations overlap with the ransomware ecosystem we document, including RansomHub.

GROUP PROFILE

Industrial-scale supply-chain compromise

TeamPCP is a crew built around trust abuse in the software supply chain. It targets the credentials, tokens and automation that developers rely on, then uses that access to poison packages and updates that reach thousands of downstream organizations.

Our record ties it to large-scale software supply-chain attacks. Reporting describes campaigns that impacted over 1,000 organizations, and Australian police arrested two alleged members in 2026.

The group's tradecraft spans misconfigured GitHub Actions workflows, stolen OAuth tokens, poisoned npm and PyPI packages, and self-propagating worms like Mini Shai-Hulud and CanisterWorm that steal developer and cloud credentials.

Facts:

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Victims reported in our records and posts:

ATTACK LIFECYCLE

Credential theft into package poisoning

The stages below come from TeamPCP activity in posts we track on our IOC Hunter feed.

Initial Access

Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.

Initial Access

MALWARE AND TOOLING

Worm components and credential stealers

Initial Access

CVES EXPLOITED

Credential and pipeline abuse, not CVE exploitation

TeamPCP's campaigns rely on stolen credentials, misconfigured CI/CD workflows and poisoned packages rather than exploiting a consistent set of software vulnerabilities, so this profile does not list a confirmed exploited-CVE set. Detection should focus on anomalous package publishes, misused OAuth tokens and CI/CD workflows, and the worm components the group deploys.

RECENT {{name}} IOCS

Latest IOCs

We currently track - IP indicators, - hosts, and - SHA256 hashes for Akira across - intelligence posts, with the most recent indicator dated -. The sample below is limited to indicators from the latest posts. It is not the full set.

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

NOTABLE CAMPAIGNS

Poisoned updates and the arrests

Recent reporting tracks the group's supply-chain operations.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through