MITRE ATT&CKsoftware (malware)
S9041 TeamPCP Cloud Stealer
- Domain
- enterprise
- Platforms
- Containers, Linux, macOS, SaaS, Windows
- Aliases
- SANDCLOCK
- Version
- 1.0
- Created
- 2026-07-01
Description
The TeamPCP Cloud Stealer is a comprehensive filesystem credential stealer that can harvest, encrypt, and exfiltrate credentials from over 50 sensitive file paths across CI/CD, cloud, developer tooling, and container environments. The TeamPCP Cloud Stealer was the primary payload used by TeamPCP in March 2026 during early stages of a cascading supply chain campaign targeting CI/CD workflows.
Related
Uses · MITRE ATT&CK (48)
- T1678 Delay Execution technique
- T1213.006 Databases sub-technique
- T1546.018 Python Startup Hooks sub-technique
- T1027.013 Encrypted/Encoded File sub-technique
- T1555.006 Cloud Secrets Management Stores sub-technique
- T1657 Financial Theft technique
- T1546.016 Installer Packages sub-technique
- T1213.003 Code Repositories sub-technique
- T1552.007 Container API sub-technique
- T1613 Container and Resource Discovery technique
- T1609 Container Administration Command technique
- T1610 Deploy Container technique
- T1580 Cloud Infrastructure Discovery technique
- T1059.007 JavaScript sub-technique
- T1573.001 Symmetric Cryptography sub-technique
- T1573.002 Asymmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
- T1074.001 Local Data Staging sub-technique
- T1059.004 Unix Shell sub-technique
- T1059.006 Python sub-technique
- T1567.001 Exfiltration to Code Repository sub-technique
- T1564.001 Hidden Files and Directories sub-technique
- T1560.001 Archive via Utility sub-technique
- T1003.007 Proc Filesystem sub-technique
- T1555 Credentials from Password Stores technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1552.001 Credentials In Files sub-technique
- T1552.003 Shell History sub-technique
- T1552.004 Private Keys sub-technique
- T1070.004 File Deletion sub-technique
Referenced by MITRE ATT&CK · uses (1)
- G1056 TeamPCP group
References
- https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23 Aqua Security Trivy Compromise MAR 2026
- https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know Aqua Security Blog Trivy Compromise APR 2026
- https://www.ic3.gov/CSA/2026/260702.pdf FBI TeamPCP JUL 2026
- https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access Google AI Threat Tracker MAY 2026
- https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack Wiz Trivy Compromise MAR 2026
- https://www.wiz.io/blog/teampcp-attack-kics-github-action Wiz TeamPCP KICS MAR 2026
- https://www.sysdig.com/blog/teampcp-expands-supply-chain-compromise-spreads-from-trivy-to-checkmarx-github-actions Sysdig TeamPCP MAR 2026
- https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/ Palo Alto TeamPCP MAR 2026