Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Back to malware
MalwareRansomwareUsed by 1 actorExploits 1 CVE

TeamPCP infostealer

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial
EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES
CVE-2026-33634Trivy supply chain compromise via malicious release and retagged GitHub ActionsExploited in the wild

The attack is now being tracked under the CVE identifier CVE-2026-33634 (CVSS score: 9.4). "The mechanics here weren't novel. The attacker, with write access to the repository, force-pushed tags to a new commit containing a modified entry point and relied on the fact that most workflows reference actions by tag," CrowdStrike said.

via the hacker newsthehackernews.com
THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
TeamPCP

The project has also recently been targeted in a supply-chain attack, where TeamPCP hackers released malicious PyPI packages that deployed an infostealer to harvest credentials, tokens, and secrets from infected systems.

via bleeping computerbleepingcomputer.com
MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques
T1195Supply Chain CompromiseEvidence5

On March 19, 2026, threat actors compromised Aqua Security's Trivy vulnerability scanner version 0.69.4, injecting credential-stealing malware into official releases and GitHub Actions.

T1195.001Compromise Software Dependencies and Development ToolsEvidence2

A new set of compromised Docker images linked to the Trivy supply chain attack has been identified... additional malicious artifacts were distributed through Docker Hub after attackers gained access through a GitHub Actions compromise.

Execution

1 technique
T1574Hijack Execution FlowEvidence1

Aqua Security... confirmed the team identified additional suspicious activity on Sunday, March 22, involving unauthorized changes and repository tampering.

Stealth

2 techniques
T1036MasqueradingEvidence1

Aqua Security... confirmed the team identified additional suspicious activity on Sunday, March 22, involving unauthorized changes and repository tampering.

T1574Hijack Execution FlowEvidence1

Aqua Security... confirmed the team identified additional suspicious activity on Sunday, March 22, involving unauthorized changes and repository tampering.

Command and Control

1 technique
T1071Application Layer ProtocolEvidence2

The malicious binaries contained typosquatted command-and-control (C2) domains, exfiltration files and references to attacker-controlled repositories used during the campaign.

Exfiltration

1 technique
T1041Exfiltration Over C2 ChannelEvidence2

The malicious binaries contained typosquatted command-and-control (C2) domains, exfiltration files and references to attacker-controlled repositories used during the campaign.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting
domain●●●●●●●●●●●●View more in app12 days ago
ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
Start free trial
IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.