TeamPCPThreat actor
- altered spider
- deadcatx3
- pcpcat
- shadow-water-058
- shellforce
- UNC6780
TeamPCP is a threat actor that has executed a coordinated series of supply chain attacks, compromising widely-used open source tools such as Trivy, KICS, and LiteLLM to deploy credential-stealing malware. They employed techniques like credential harvesting, lateral movement within Kubernetes environments, and audio steganography to evade detection.From MISP Galaxy
Last reported 2 days ago, by The Hacker News43 reports
ATT&CK techniques
6 of 71 · each with the sentence it comes from- T1195Supply Chain Compromise
“SOCRadar helps teams catch supply chain compromises like this one early and limit the damage from stolen secrets:”
- T1684Social Engineering
“Iranian-linked social-engineering campaign targeted dissidents, activists and journalists”
- T1552.004Private Keys
“Analysis of the malicious version shows that it's equipped to collect cloud credentials, private keys, browser data, and authentication files for AI development tools.”
- T1078Valid Accounts
“FortiCNAPP mapped CreateUser, AttachUserPolicy, and CreateAccessKey to Privilege Escalation (TA0004) with T1078 and T1098.”
- T1195.002Compromise Software Supply Chain
“… high confidence that traditional software supply chain compromise, the manipulation of source code or update/distribution mechanisms (T1195.002), remains rare.”
- T1213.003Code Repositories
“…t impactful and far-reaching supply chain compromise incidents that GTIG tracked in 2025 and early 2026 involved the compromise of code repositories, software dependencies and developer tools (T1195.001).”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
43 reports · the newest 20, newest first · the exact sentence from each-
LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release“…a ".pth" file to launch the stealer program is notable as it mirrors the modus operandi observed in the March 2026 attack attributed to TeamPCP.”
-
New LiteLLM Supply Chain Attack Hits PyPI and Docker“Second incident in 2026: This is a separate campaign from the March 2026 TeamPCP compromise of versions 1.82.7 and 1.82.8.”
-
LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor“It's worth noting that the same behavior was observed in the LiteLLM compromise that took place as part of the TeamPCP supply chain attacks earlier this March.”
-
LiteLLM supply chain compromise: What you need to know“…the second supply chain compromise of LiteLLM in 2026, with the earlier incident (affecting versions 1.82.7 and 1.82.8) being linked to TeamPCP activity by Datadog Security Research.”
-
Cyber Brief 26-10 - September 2026“On September 18, WIRED reported that Google infiltrated TeamPCP, a cybercrime group responsible for widespread open-source supply-chain attacks affecting over 1.000 companies.”
-
Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation“…th, ShinyHunters and SLSH members briefly partnered earlier this year to help better monetize important stolen credentials collected by TeamPCP, an upstart group that was having great success compromising global code supply chains with malicious software but hadn’t been able to p…”
-
The Developer is the New Perimeter: How Supply Chain Attacks Are Becoming Cloud Breaches“TeamPCP: From Trusted Tooling to Cloud Account Takeover”
-
What We Missed: Google Gemini Joins the AI Escape Party“…s discuss some of the news they didn't get a chance to cover, from Google Gemini models breaking containment to ShinyHunters ratting on TeamPCP hackers.”
-
Happy Birthday, Shai-Hulud“In May, TeamPCP published the worm's source code on GitHub, which removed the last barrier to entry, and ran a contest offering $1,000 in Monero to whoever compromised the most-downloaded packages, scored by weekly and monthly download counts.”
-
Risky Bulletin: Ukraine's top prosecutor resigns amid scam call center scandal“APTs from China, Russia, Iran, and North Korea, as well as groups like TeamPCP and ShinyHunters have regularly used Gemini.”
-
Srsly Risky Biz: China's Private Sector Botnets Are Worth Disrupting“Two TeamPCP members arrested in Australia: The Australian Federal Police has arrested on Wednesday two suspects believed to be part of the TeamPCP hacking group.”
-
Risky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates“TeamPCP unmasking: Threat intel firm Flare has published its own investigation on how its researchers tracked down the real identities of TeamPCP members, who were arrested by Australian police last week.”
-
Risky Bulletin: Dutch intel services to get extensive new powers“…ts with Brian Krebs about the investigation that led him from recycled cybercrime handles and old forum records to the true identity of TeamPCP’s alleged leader in Perth.”
-
Risky Bulletin: Two TeamPCP members arrested in Australia“Risky Bulletin: Two TeamPCP members arrested in Australia”
-
From CI Pipeline to Ransomware & Breaches: 6 High-Profile Breaches in the LiteLLM/Trivy Attack“…mpaign and detail the exact secrets, tokens, and configurations that likely fueled downstream extortion by groups like Vect ransomware (TeamPCP).”
-
Batten Down Your Packages: Mitigation Guidance for Supply Chain Compromise“For example from February to May 2026, UNC6780 (aka "TeamPCP") conducted extensive open source supply chain compromises targeting ecosystems like PyPI, npm, and Docker Hub.”
-
The case for GitHub Actions security after recent supply chain attacks“TeamPCP used compromised credentials to publish malicious versions of Trivy and KICS on GitHub, along with two compromised versions of LiteLLM on PyPI (Python Package Index), as part of a broader supply chain campaign.”
-
Backdoored Cemu release linked to TanStack and Mistral supply chain campaign“TeamPCP claims responsibility”
-
Shai-Hulud Goes Open Source“…rs (github search) appeared containing what appears to be the complete source code for the Shai-Hulud offensive framework attributed to TeamPCP.”
-
Supply Chain Attacks Surge in March 2026“In addition, a hacking group known as TeamPCP was able to compromise Trivy (a vulnerability scanner), KICS (a static analysis tool), LiteLLM (an interface for AI models), and Telnyx (a library for real-time communication features).In this blog, we cover two of these supply chain…”
Indicators in its reports
named in the reports above- litellm[.]devin 3 reports
- infosec[.]exchangein 2 reports
- 83.142.209[.]194in 2 reports
- www.litellm[.]devin 2 reports
- 1bbcb1443bc962e4…d3ac126c339ein 2 reports
- 168.100.8[.]57in 2 reports
- 165.227.201[.]8in 2 reports
Copy these 7 indicators · defanged
Thanks — we review every report.