TeamPCP

☆ pin

Also known as PCPCat, Cybercats, Express, BulkDMT, EllisD25, Deadcatx3, ShadowRay 2.0, IronErn, TA-NATALSTATUS, xploitrsturtle2, CipherForce, Mini Shai-Hulud

Reports

First seen

Mar 26, 2026

Last seen

Oct 2, 2026

Motivation

Financial, Espionage, Notoriety

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors

Technology ×26 Other ×6 Financial Services ×1

Victim regions

×1

×14

United States×14

Brazil×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1195 Supply Chain Compromise ×39T1041 Exfiltration Over C2 Channel ×35T1555 Credentials from Password Stores ×31T1005 Data from Local System ×27T1078 Valid Accounts ×23T1190 Exploit Public-Facing Application ×18T1486 Data Encrypted for Impact ×14T1566 Phishing ×14T1003 OS Credential Dumping ×14T1204 User Execution ×11T1059 Command and Scripting Interpreter ×10T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools ×9

Indicators

cve ×186domain ×60filename ×46ip_v4 ×27hash_sha1 ×13email ×12url ×6hash_sha256 ×5

Indicator values are available on Pro and via the API.

Recent reports

High

TeamPCP

Relationships

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

Cyber Brief 26-10 – September 2026

Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours

CERT-EU Cyber Brief August 2026: Espionage, Ransomware, and Supply-Chain Compromises

H1 2026 Malware and Vulnerability Trends Report

Two TeamPCP members arrested for software supply-chain attacks affecting 1,000+ organizations

Australia arrests two alleged TeamPCP members behind supply-chain attacks

Australia charges two men for TeamPCP supply-chain hacking spree

Two Australian men charged in TeamPCP supply chain attack affecting 1,000+ organizations

Two Alleged TeamPCP Hackers Arrested in Australia; Cybercrime Ring Blamed for Largest Supply Chain Attack Spree

Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More

TeamPCP Linked To Redis Attacks Dating Back To 2020 And Later Supply Chain Campaign

TeamPCP threat actor's history extends to 2020, linked to ShadowRay botnet campaign

Massive supply-chain attack compromises 440+ npm packages in four hours

CrowdStrike: AI Now Both Weapon and Target in Cyberattacks

Python Supply Chain Attack Techniques: Build Hooks and Package Content Abuses

Weekly Threat Intelligence Report – July 6: Ransomware Attacks, AI Threats, and Critical Vulnerabilities

Ransomware Groups Exploit Citrix Bleed 2, BYOVD Techniques, and Supply Chain Credentials

Vect and TeamPCP partner for ransomware campaigns targeting supply chain

Intelligence Insights: June 2026 – ClearFake, Kali365, and TeamPCP Lead Threat Rankings

TeamPCP's supply-chain attack spree: 1,000+ compromised packages in four months

GitHub dismissed security reports on flaws exploited by Shai-Hulud supply-chain worm

Microsoft Restores GitHub Repos as Miasma Supply Chain Campaign Continues

Miasma Worm Compromises 73 Microsoft GitHub Repositories in Supply Chain Attack

IronWorm and Miasma Worm Variant Hit npm in Supply Chain Attacks

New IronWorm malware hits 36 packages in npm supply-chain attack

CERT-EU Cyber Brief May 2026 – Espionage, Supply-Chain Attacks, and Ransomware Infrastructure Disruption

Red Hat removes tainted packages after software pipeline compromise

Red Hat npm packages compromised in supply-chain attack distributing Miasma credential stealer

Container security: attack vectors from escapes to supply chain compromise

Malicious Sicoob NuGet and npm Packages Steal Banking Credentials and Cloud Secrets