Tactics, Techniques & Procedures (TTPs): Specializes in supply chain subversion, specifically targeting developer tools (Jenkins, KICS, Checkmarx). Utilizes 'parasitic' malware that removes competing infections to ensure exclusive control over high-value cloud credentials.

TeamPCP has emerged as a premier threat to the CI/CD pipeline. Their recent compromise of the Checkmarx Jenkins AST plugin demonstrates a sophisticated understanding of the developer ecosystem. By poisoning a trusted security tool, they effectively bypass the very defenses meant to stop them. This 'meta-exploitation'—using security software to deliver malware—is a hallmark of their 2026 operations.