MITRE ATT&CKgroup
G1056 TeamPCP
- Domain
- enterprise
- Aliases
- PCPCat, ShellForce, DeadCatx3, SHADOW-WATER-058, UNC6780
- Version
- 1.0
- Created
- 2026-07-16
Description
TeamPCP is a financially-motivated, cloud-native threat group that has been active since at least September 2025. Initially focused on ransomware and cryptocurrency theft, TeamPCP shifted in early 2026 to systematic, worm-driven credential theft and software supply chain attacks targeting Continuous Integration and Continuous Delivery (CI/CD) workflows. TeamPCP has monetized access through extortion and through partnerships with ransomware actors including Vect and CipherForce.
Related
Uses · MITRE ATT&CK (40)
- S9043 Mini Shai-Hulud software (malware)
- S9042 CanisterWorm software (malware)
- S9041 TeamPCP Cloud Stealer software (malware)
- T1684.001 Impersonation sub-technique
- T1683.001 Written Content sub-technique
- T1059.013 Container CLI/API sub-technique
- T1677 Poisoned Pipeline Execution technique
- T1176.002 IDE Extensions sub-technique
- T1555.006 Cloud Secrets Management Stores sub-technique
- T1657 Financial Theft technique
- T1546.016 Installer Packages sub-technique
- T1610 Deploy Container technique
- T1608.001 Upload Malware sub-technique
- T1583.004 Server sub-technique
- T1583.006 Web Services sub-technique
- T1585.001 Social Media Accounts sub-technique
- T1587.001 Malware sub-technique
- T1583 Acquire Infrastructure technique
- T1583.001 Domains sub-technique
- T1059.007 JavaScript sub-technique
- T1078.004 Cloud Accounts sub-technique
- T1195.001 Compromise Software Dependencies and Development Tools sub-technique
- T1059.004 Unix Shell sub-technique
- T1059.006 Python sub-technique
- T1564.001 Hidden Files and Directories sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1027.003 Steganography sub-technique
- T1553.002 Code Signing sub-technique
- T1552.004 Private Keys sub-technique
- T1550.001 Application Access Token sub-technique
References
- https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23 Aqua Security Trivy Compromise MAR 2026
- https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know Aqua Security Blog Trivy Compromise APR 2026
- https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access Google AI Threat Tracker MAY 2026
- https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack Wiz Trivy Compromise MAR 2026
- https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html Trend Micro TeamPCP MAY 2026
- https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/ Palo Alto TeamPCP MAR 2026
- https://threats.wiz.io/all-actors/teampcp Wiz TeamPCP Profile MAY 2026