TeamPCP

TeamPCP, also tracked as UNC6780, is a financially motivated cybercriminal threat actor active since late 2025 that became prominent for large-scale software supply-chain intrusions in 2026. Known aliases include DeadCatx3, PCPcat, Persy_PCP, ShellForce, Team_PCP, and related tracking names such as UNC6780. The actor has also been associated in reporting with the CipherForce name and with malware and campaign labels including SANDCLOCK, CanisterWorm, CanisterSprawl, Mini Shai-Hulud, Miasma, and Hades. TeamPCP initially focused on opportunistic cloud-native exploitation, including exposed Docker APIs, Kubernetes clusters, Redis services, Ray dashboards, and vulnerable public-facing applications. Its activity later evolved into coordinated supply-chain operations targeting trusted developer and security tooling across GitHub Actions, container registries, npm, PyPI, OpenVSX, and Visual Studio Code extension ecosystems. High-confidence reporting links the actor to compromises affecting Trivy, Checkmarx KICS and AST GitHub Actions and related artifacts, LiteLLM, the Telnyx Python SDK, Bitwarden CLI, xinference, SAP CAP packages, Nx Console, and other open-source or developer-facing components. A defining characteristic of TeamPCP is cascading credential theft: the actor compromises one project’s CI/CD or release pipeline, steals secrets and publishing credentials from downstream users, and then reuses those credentials to compromise additional projects and ecosystems. The group has repeatedly abused insecure GitHub Actions patterns, especially pull_request_target-style workflow misconfigurations, mutable version tags, exposed CI/CD secrets, package publishing tokens, and signing or release credentials. It has also leveraged trusted publishing workflows by extracting short-lived credentials from runner memory. Its malware consistently targets build and developer environments for high-value secrets, including GitHub tokens, npm and PyPI publishing credentials, cloud provider credentials, Kubernetes configurations and service-account material, SSH keys, database credentials, Terraform state, environment files, API keys, and cryptocurrency wallet data. Observed collection methods include scraping CI runner memory, reading process environments, harvesting files from common credential locations, querying cloud metadata services, enumerating IAM and storage resources, and collecting Kubernetes secrets. Exfiltration has used encrypted archives and multiple fallback channels, including victim-controlled repositories or release assets when primary infrastructure was unavailable. TeamPCP has demonstrated post-compromise tradecraft beyond initial credential theft. Reporting describes rapid validation of stolen credentials, cloud reconnaissance within hours of access, enumeration of IAM roles, compute resources, storage, databases, and container infrastructure, and in some cases persistence through user-level services or Kubernetes DaemonSets. Some payloads used Internet Computer Protocol canisters as decentralized command-and-control infrastructure, an unusual technique in software supply-chain operations. Variants also showed worm-like propagation across package ecosystems by identifying publishable packages and republishing trojanized updates under legitimate namespaces. The actor’s 2026 campaign had substantial downstream impact. Trivy-related compromises alone reportedly exposed thousands of CI/CD workflows and more than 1,000 SaaS environments. Stolen credentials were subsequently used in intrusions affecting major organizations, including the European Commission and Cisco development environments. TeamPCP activity has also been linked to theft of large volumes of source code and cloud data, and to follow-on exploitation by other criminal actors using credentials harvested during the campaign. TeamPCP is assessed as financially motivated rather than state-sponsored. Google formally designated the cluster as UNC6780, and available reporting does not place it within a known nation-state intrusion set. The actor has been linked to extortion and ransomware-adjacent activity, including operational overlap or partnership claims involving Vect and use of the CipherForce name. Public reporting also describes TeamPCP as a loose-knit criminal group rather than a formal hierarchical organization, though that characterization is less firmly corroborated than its operational behavior. From a tactics-and-techniques perspective, TeamPCP is notable for supply-chain compromise, abuse of CI/CD pipelines, credential access from memory and files, trusted relationship abuse, package and container poisoning, cloud and Kubernetes discovery, persistence via services and cluster workloads, and rapid lateral pivoting through stolen secrets. Its operations illustrate a mature criminal model that treats developer tooling and release infrastructure as scalable access brokers for downstream enterprise compromise.