Tactics, Techniques & Procedures (TTPs): TeamPCP employs sophisticated supply chain attacks, leveraging compromised maintainer accounts to inject malicious code into widely used software packages. Their tactics include self-replicating malware and credential theft, targeting npm packages and cloud environments.
Actor Profile & Objectives: TeamPCP is a notorious threat actor known for its aggressive supply chain attacks, particularly targeting open-source software repositories. Their primary objective is to compromise software packages to distribute malware, steal sensitive data, and exploit cloud environments. Their operations have shown a significant evolution in tactics, focusing on high-impact targets with a vast user base.
Recent Campaign Tactics: In a recent operation, TeamPCP compromised a GitHub maintainer account, unleashing a self-replicating malware that injected malicious code into over 440 npm packages within hours. This attack exemplifies their ability to rapidly expand their reach and impact, affecting millions of users and critical infrastructure.