TeamPCP

Also known as ResoluteXBF, Replicating Marauder, UNC6780, Shellforce, PersyPCP, pcpcats, SHADOW-WATER-058, @pcpcats, Mini Shai-Hulud, xploitrsturtle2, PCPCat

Reports

First seen

Mar 26

Last seen

Jun 18

Motivation

financial, financial extortion, notoriety, disruption, chaos

Targeting

Sectors

technology ×23other ×2financial services ×1

Victim regions

United States ×14Brazil ×1

Top ATT&CK techniques

T1195 Supply Chain Compromise ×28T1041 Exfiltration Over C2 Channel ×25T1555 Credentials from Password Stores ×23T1005 Data from Local System ×19T1078 Valid Accounts ×17T1003 OS Credential Dumping ×10T1204 User Execution ×9T1566 Phishing ×9T1190 Exploit Public-Facing Application ×8T1547 Boot or Logon Autostart Execution ×7T1486 Data Encrypted for Impact ×7T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage ×6

Indicators

cve ×128domain ×41filename ×36ip_v4 ×24hash_sha1 ×13url ×5hash_sha256 ×5email ×2

Indicator values are available on Pro and via the API.

Recent reports

High

TeamPCP

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

Intelligence Insights: June 2026 – ClearFake, Kali365, and TeamPCP Lead Threat Rankings

TeamPCP's supply-chain attack spree: 1,000+ compromised packages in four months

GitHub dismissed security reports on flaws exploited by Shai-Hulud supply-chain worm

Microsoft Restores GitHub Repos as Miasma Supply Chain Campaign Continues

Miasma Worm Compromises 73 Microsoft GitHub Repositories in Supply Chain Attack

IronWorm and Miasma Worm Variant Hit npm in Supply Chain Attacks

New IronWorm malware hits 36 packages in npm supply-chain attack

CERT-EU Cyber Brief May 2026 – Espionage, Supply-Chain Attacks, and Ransomware Infrastructure Disruption

Red Hat removes tainted packages after software pipeline compromise

Red Hat npm packages compromised in supply-chain attack distributing Miasma credential stealer

Container security: attack vectors from escapes to supply chain compromise

Malicious Sicoob NuGet and npm Packages Steal Banking Credentials and Cloud Secrets

TeamPCP stole GitHub's internal repos

Weekly Recap: Linux Flaws, Defender 0-Days, Router Botnets, and Supply Chain Chaos

Megalodon GitHub Attack Compromises 5,561 Repos with Malicious CI/CD Workflows

GitHub breach linked to malicious Nx Console VS Code extension in TanStack supply-chain attack

GitHub Internal Repositories Breached via Compromised Nx Console VS Code Extension

Grafana breach caused by missed token rotation after TanStack attack

GitHub internal repositories exfiltrated via poisoned VS Code extension

GitHub confirms breach by TeamPCP via poisoned VS Code extension

GitHub Breached via Poisoned VS Code Extension; TeamPCP Exfiltrates 3,800+ Internal Repos

GitHub confirms breach of 3,800 repos via malicious VSCode extension

Grafana GitHub Breach Exposes Source Code via TanStack npm Supply Chain Attack

GitHub investigates internal repositories breach claimed by TeamPCP

GitHub internal repositories breached via malicious VS Code extension

Mini Shai-Hulud malware resurgence compromises hundreds of npm packages

Mini Shai-Hulud Supply Chain Attack Compromises 323 npm Packages via TeamPCP

Weekly Threat Recap: Exchange 0-Day, npm Supply Chain Attacks, Cisco Exploits

TanStack Supply Chain Attack Impacts OpenAI Employee Devices; TeamPCP Campaign Expands

ThreatsDay Bulletin: PAN-OS RCE, Mythos cURL Bug, AI Tokenizer Attacks, and 10+ Stories