Tactics, Techniques & Procedures (TTPs): Specializes in 'Trust Anchor' subversion. Tactics include malicious IDE extensions, CI/CD pipeline poisoning, and now domain-fronting (Underminr). Known for high-fidelity social engineering targeting DevOps engineers.

TeamPCP has transitioned from a simple repository thief to a sophisticated supply-chain architect. Their recent focus on GitHub internal repositories suggests they are building a comprehensive map of enterprise API vulnerabilities. The integration of the Underminr protocol into their toolkit indicates a shift toward stealthy, long-term persistence. They are no longer just stealing code; they are using that code to find the 'keys to the kingdom' in enterprise workload management systems like Cisco Secure Workload.