TeamPCP Supply Chain Campaign
A multi-week, multi-ecosystem attack chain spanning GitHub Actions, Docker Hub, npm, PyPI, and OpenVSX. Impacted so far: Aqua's Trivy, Checkmarx KICS, and LiteLLM.
HackingLZ/litellm_1.82.8_payload ↗
Full defanged 3-stage payload from LiteLLM 1.82.8. Includes orchestrator, collector, and persistence components with shared RSA 4096-bit public key (strongest attribution link across all TeamPCP payloads).
nxb1t/litellm-1.82.7_sample ↗
Three payload variants from LiteLLM 1.82.7 with RC4 obfuscation. Demonstrates evolution of obfuscation techniques across versions.
HackingLZ/telnyx_4.87.1_payload ↗
Defanged payload from Telnyx PyPI 4.87.1/4.87.2. WAV steganography delivery with platform-specific payloads for Windows and Linux/macOS.
MalwareBazaar: teampcp samples ↗
Community-submitted malware samples tagged with TeamPCP. Includes binaries, scripts, and payloads with downloadable samples and YARA rules.
TeamPCP
Also known as PCPcat, Persy_PCP, ShellForce, CipherForce, and DeadCatx3. Emerged as a significant threat to cloud-native infrastructure in late 2025.
Self-attribution string "TeamPCP Cloud stealer" found in the trivy-action payload links this incident to the group.
Telegram: @Persy_PCP, @teampcp
View on Wiz Threat Center ↗Cloud-Native Infrastructure
Common Techniques
Flare.io Analysis
"TeamPCP Cloud-Native Ransomware" — detailed analysis of the December 2025 worm-driven campaign targeting cloud infrastructure.
Beelzebub Analysis
Next.js exploit campaign analysis — 59K compromises in 33 hours. Reveals Telegram handles and Singapore C2 infrastructure.
The Official Soundtrack of the Trivy Supply Chain Attack
Every threat actor leaves fingerprints. TeamPCP left a playlist. Songs embedded in payloads, C2 infrastructure, and attack tooling.
"hackerbot-claw compromised Trivy"
Reality: hackerbot-claw is an automated penetration testing bot that scans GitHub for vulnerable projects—its user agent and behavioral patterns differ from the main attacker. MegaGame10418 is the actor who exploited the February 27 PwnRequest, exfiltrating the aqua-bot PAT. Aqua's official post-mortem confirms: "The user agent and behavioral patterns of hackerbot-claw are different than the other events inspected."
"Malicious commits landed in Trivy's main branch"
Reality: The imposter commits (1885610c, 70379aad) never merged into main. They exist in GitHub's object store due to cross-fork object sharing. The attack worked because a malicious tag (v0.69.4) was pushed that referenced these orphan commits—triggering CI/CD builds without any merge or review.
"GhostClaw is related to TeamPCP"
Reality: GhostClaw is a separate campaign with different TTPs and IOCs. TeamPCP uses tag hijacking and CI/CD exploitation; GhostClaw uses npm typosquatting and AI workflow hooks. Different infrastructure (registrars, C2 patterns), more social engineering-focused payloads (fake CLI installers with progress bars), and different persistence mechanisms (shell hooks, cron jobs vs. GitHub Actions). No shared IOCs or attribution overlap identified.