TeamPCP Partners With Vect Ransomware Group to Escalate Cross-Ecosystem Open Source Supply Chain Attacks
TeamPCP Partners With Vect Ransomware Group to Escalate (TL-2026-0288), also tracked as CanisterWorm Campaign, is a critical-severity supply-chain compromise, first published 2026-03-26 and last reviewed 2026-07-27. It is attributed to TeamPCP (Russia) with high confidence, affects BerriAI LiteLLM, references 1 CVE (CVE-2025-55182), maps to 33 MITRE ATT&CK techniques (T1005, T1021, T1027), and is covered by 9 detection rules and 53 indicators of compromise.
Key facts for TL-2026-0288
- Threat ID
- TL-2026-0288
- Also known as
- CanisterWorm Campaign, Trivy Supply Chain Compromise, Operation TeamPCP-Vect
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-03-26
- Last reviewed
- 2026-07-27
- Attribution
- TeamPCP
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, cloud-infrastructure, government, financial, healthcare, education, manufacturing, critical-infrastructure
- Target regions
- Global, North America, Europe, South America, Africa, Middle East
- Detection rules
- 9
- Indicators of compromise
- 53
- Updates
- 2026-07-27 · revalidated 1× · latest source
Malware and tooling in TeamPCP Partners With Vect Ransomware Group to Escalate
Malware and tooling: CanisterWorm, Vect Ransomware, ICP Canister C2 (Internet Computer Protocol)
Threat actor TeamPCP (a.k.a. PCPcat, ShellForce, DeadCatx3) has partnered with emerging ransomware-as-a-service operation Vect to chain open source supply chain compromises into ransomware campaigns. TeamPCP has compromised packages across npm, PyPI, Docker Hub, GitHub Actions, and OpenVSX, exfiltrating approximately 300GB of compressed credentials. The Vect partnership, announced on BreachForums on March 26 2026, extends automatic affiliation to TeamPCP operators with 80-88% revenue share for follow-on ransomware deployment.
How TeamPCP Partners With Vect Ransomware Group to Escalate works
TeamPCP (also tracked as PCPcat, ShellForce, DeadCatx3, PersyPCP, CipherForce) is a cloud-native cybercrime threat cluster that has executed one of the most consequential supply chain campaigns of 2026. Active since at least July 2025 via their Telegram channel, the group compromised over 60,000 servers globally before pivoting to targeted supply chain attacks against open source security tooling.
The campaign began on February 28, 2026 when TeamPCP exploited a misconfigured pull_request_target workflow in Aqua Security's Trivy repository to steal a privileged Personal Access Token (PAT). After an incomplete credential rotation on March 1, the attacker retained residual access through the compromised aqua-bot and Argon-DevOps-Mgt service accounts.
On March 19, TeamPCP leveraged this access to publish a malicious Trivy binary v0.69.4 and force-push malicious commits to 75 of 76 trivy-action tags and all 7 setup-trivy tags, transforming pinned CI/CD tags into payload delivery channels. The embedded infostealer harvested credentials from Runner.Worker process memory, including GitHub PATs, AWS IMDS credentials, SSH keys, cloud tokens, Kubernetes secrets, and CI/CD environment variables. Exfiltration used a hybrid AES-256-CBC + RSA-4096 encryption scheme, with data sent as tpcp.tar.gz to typosquatted domain scan.aquasecurtiy[.]org (45.148.10.212).
By March 20, stolen npm tokens fueled a self-propagating worm (CanisterWorm) that autonomously enumerated packages owned by compromised token holders and republished malicious versions. Over 50 packages were infected across @EmilGroup (28 packages), @opengov (16 packages), @teale.io/eslint-config, @airtm/uuid-base32, and @pypestream/floating-ui-dom. The worm used ICP (Internet Computer Protocol) canister tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io as a decentralized, censorship-resistant C2 dead-drop, and installed pgmon.service persistence.
On March 22, TeamPCP deployed a geopolitically-targeted Kubernetes wiper payload. Iranian systems (detected via Asia/Tehran timezone and fa_IR locale) received the destructive host-provisioner-iran DaemonSet that recursively deleted host filesystems and forced reboots. Non-Iranian systems received the CanisterWorm backdoor instead. The same day, all 44 Aqua Security internal repositories were defaced, and malicious Docker Hub images (trivy:0.69.5, 0.69.6) were published using stolen Aqua credentials.
On March 23, the campaign expanded to Checkmarx: 35 KICS GitHub Action tags were hijacked via compromised cx-plugins-releases service account, ast-github-action v2.3.28 was backdoored, and malicious OpenVSX extensions checkmarx.ast-results v2.53.0 and cx-dev-assist v1.7.0 were published. Exfiltration shifted to checkmarx[.]zone (83.142.209.11).
On March 24, TeamPCP compromised LiteLLM on PyPI, a package with 95 million monthly downloads present in 36% of cloud environments. Malicious versions 1.82.7 and 1.82.8 were published using credentials stolen in the Trivy incident. Version 1.82.7 injected a base64-encoded payload into litellm/proxy/proxy_server.py; version 1.82.8 added litellm_init.pth, a Python startup hook that executes malware on any Python invocation system-wide. The three-stage payload includes a credential harvester (332 lines targeting 50+ sensitive paths), a Kubernetes lateral movement toolkit deploying privileged node-setup-* pods, and a persistent systemd backdoor (sysmon.service) polling checkmarx.zone/raw every 50 minutes. Data was exfiltrated to models.litellm[.]cloud. PyPI quarantined both versions by 11:25 UTC.
On March 26, Vect ransomware group announced on BreachForums a formal partnership with TeamPCP, stating they would chain supply chain compromises into devastating follow-on ransomware campaigns. Vect is an emerging RaaS operation launched in December 2025, written in C++ using ChaCha20-Poly1305 AEAD encryption with intermittent encryption for speed. It targets Windows, Linux, and VMware ESXi, uses Monero for payments, TOX protocol for communications, and exclusively TOR hidden services. The affiliate model offers 80-88% revenue share for affiliates generating over $75 million, with a $250 entry fee waived for CIS applicants. Known victims include organizations in Brazil and South Africa spanning education and manufacturing sectors.
The combined threat represents a significant escalation: TeamPCP's broad supply chain access providing initial footholds, with Vect's ransomware capabilities enabling monetization through double extortion. Approximately 300GB of compressed stolen credentials are being actively worked through, with collaboration with LAPSUS$ extortion group to target multi-billion-dollar companies also reported.
MITRE ATT&CK techniques used in TL-2026-0288
collection
T1005 Data from Local System; T1560 Archive Collected Data
lateral-movement
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1078 Valid Accounts
exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
execution
T1059 Command and Scripting Interpreter; T1204 User Execution; T1610 Deploy Container
command-and-control
T1071 Application Layer Protocol; T1102 Web Service; T1573 Encrypted Channel
discovery
T1083 File and Directory Discovery
initial-access
Initial Access
impact
T1485 Data Destruction; T1486 Data Encrypted for Impact; T1491 Defacement
credential-access
T1528 Steal Application Access Token; T1552 Unsecured Credentials
persistence
T1543 Create or Modify System Process; T1554 Compromise Host Software Binary
Persistence
T1546 Event Triggered Execution
defense-impairment
Command and Control
stealth
resource-development
T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1608 Stage Capabilities
reconnaissance
T1593 Search Open Websites/Domains
privilege-escalation
Affected products and versions in TeamPCP Partners With Vect Ransomware Group to Escalate
- BerriAI — LiteLLM
Vulnerable versions: 1.82.7; 1.82.8
Fixed in: 1.82.6 (last clean) - Aqua Security — Trivy
Vulnerable versions: 0.69.4; 0.69.5; 0.69.6 - Aqua Security — trivy-action (GitHub Action)
Vulnerable versions: 75 of 76 tags compromised
Fixed in: Tag 77 (uncompromised) - Aqua Security — setup-trivy (GitHub Action)
Vulnerable versions: All 7 tags - Checkmarx — KICS GitHub Action
Vulnerable versions: 35 tags hijacked - Checkmarx — ast-github-action
Vulnerable versions: 2.3.28+ - Checkmarx — ast-results (OpenVSX)
Vulnerable versions: 2.53.0 - Checkmarx — cx-dev-assist (OpenVSX)
Vulnerable versions: 1.7.0 - npm — @EmilGroup packages
Vulnerable versions: 28 packages compromised - npm — @opengov packages
Vulnerable versions: 16 packages compromised
Remediation for TeamPCP Partners With Vect Ransomware Group to Escalate
Patches
- Downgrade LiteLLM to 1.82.6 (last known clean version)
- Verify Trivy installations against official checksums; use only trivy-action tag 77 (uncompromised)
- Remove compromised OpenVSX extensions: ast-results v2.53.0, cx-dev-assist v1.7.0
- Audit and remove any @EmilGroup or @opengov npm packages installed after March 20
Immediate actions
- Audit all CI/CD pipelines for use of compromised Trivy, KICS, or LiteLLM versions
- Pin GitHub Actions to full commit SHAs, not tags
- Block C2 domains: models.litellm.cloud, checkmarx.zone, scan.aquasecurtiy.org, tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io
- Block C2 IPs: 45.148.10.212, 83.142.209.11, 67.217.57.240, 44.252.85.168
- Search for persistence artifacts: sysmon.service, pgmon.service, litellm_init.pth, /tmp/pglog, /tmp/.pg_state
- Hunt for Kubernetes pods matching node-setup-* in kube-system namespace
- Quarantine any system that ran litellm 1.82.7 or 1.82.8
Workarounds
- Use vendored or locally built copies of security scanning tools
- Implement allow-listing for GitHub Actions rather than trusting third-party actions
- Use read-only tokens in CI/CD pipelines where possible
- Enable GitHub Actions workflow approval for pull_request_target events
Longer-term hardening
- Assume full credential exposure for any affected environment and rotate all secrets
- Rotate GitHub PATs, npm tokens, PyPI tokens, SSH keys, cloud credentials, Kubernetes service accounts
- Implement software composition analysis (SCA) with real-time package integrity monitoring
- Deploy EDR with behavioral detection for systemd service creation and /proc/mem access
- Implement network segmentation to limit blast radius of CI/CD compromises
- Monitor for tpcp.tar.gz filename in HTTP headers (X-Filename: tpcp.tar.gz)
- Rebuild affected systems from known-good images; do not treat package rollback as complete remediation
CVEs associated with TeamPCP Partners With Vect Ransomware Group to Escalate
Weaknesses (CWE) in TeamPCP Partners With Vect Ransomware Group to Escalate
CWE-506, CWE-829, CWE-494, CWE-502
Timeline of TeamPCP Partners With Vect Ransomware Group to Escalate
- TeamPCP Telegram channel becomes active under aliases DeadCatx3, PCPcat, PersyPCP, and ShellForce
- TeamPCP gains notoriety via the React2Shell RCE campaign, exploiting CVE-2025-55182 and frequently using port 666, predating and preceding the group's pivot into supply-chain compromise.
- TeamPCP launches mass campaign targeting exposed Docker APIs, Kubernetes clusters, Redis servers; compromises 60,000+ servers globally
- Vect ransomware group posts affiliate recruitment advertisement on Russian-language cybercrime forum with ChaCha20-Poly1305 encryption and 80-88% affiliate payouts
- TeamPCP exploits misconfigured pull_request_target workflow in Aqua Security Trivy repository to steal privileged PAT via hackerbot-claw bot
- Initial Trivy compromise disclosed via GitHub discussion; credential rotation attempted but incomplete, leaving residual access paths open
- TeamPCP publishes malicious Trivy v0.69.4 binary and force-pushes malicious commits to 75/76 trivy-action tags and all 7 setup-trivy tags
- Self-propagating CanisterWorm npm worm deploys using stolen tokens; 50+ packages infected across @EmilGroup (28), @opengov (16), and other scopes
- Geopolitically-targeted Kubernetes wiper deployed against Iranian systems via host-provisioner-iran DaemonSet; 44 Aqua Security internal repos defaced; malicious Docker Hub images published
- Checkmarx KICS GitHub Action compromised (35 tags hijacked); ast-github-action v2.3.28 backdoored; malicious OpenVSX extensions published; exfiltration via checkmarx.zone
- PyPI quarantines malicious LiteLLM versions at 11:25 UTC; advisory PYSEC-2026-2 issued
- LiteLLM PyPI versions 1.82.7 and 1.82.8 published with three-stage payload: credential harvester, Kubernetes lateral movement toolkit, and sysmon.service persistence backdoor
- Vect ransomware group announces formal partnership with TeamPCP on BreachForums to chain supply chain compromises into ransomware campaigns with automatic affiliation
- TeamPCP compromises the Telnyx Python SDK (v4.87.1, v4.87.2) via stolen PyPI publishing credentials, a previously untracked 4th wave delivering payloads hidden via WAV steganography.
- Palo Alto Networks Unit 42 publishes a technical breakdown of the three-wave (now four-wave) campaign, quantifying scope at 500,000+ infected machines across 16+ identified victim organizations, including theft of LLM API keys (OPENAI_API_KEY, ANTHROPIC_API_KEY).
- As of 2026-05-29, TeamPCP (UNC6780) + Vect remain highly active and escalating: Vect began publishing TeamPCP-sourced victims Apr 15, and new waves hit TanStack/Mistral (Mini Shai-Hulud, CVE-2026-45321) and GitHub itself (3,800 internal repos, May 19-20). No arrests or takedowns reported; record's CONTAINED status is outdated.
Update history for TL-2026-0288
- 2026-07-27 — NCC Group: Ransomware Attacks Rise 3% in Q2 2026 as Software Supply Chain Compromises Escalate: What changed No escalation: this record's CRITICAL severity, ACTIVE exploitability/status, and HIGH attribution confidence stand. The new report's own HIGH severity and MEDIUM attribution reflect its broader Q2-landscape framing (which also
Sources cited for TeamPCP Partners With Vect Ransomware Group to Escalate
- TeamPCP Partners With Vect Targeting OSS Supply Chains
- LiteLLM Compromised on PyPI: Tracing the March 2026 TeamPCP Campaign
- TeamPCP Supply Chain Attack Spreads to LiteLLM
- Three's a Crowd: TeamPCP Trojanizes LiteLLM
- TeamPCP Expands: Supply Chain Compromise Spreads from Trivy to Checkmarx GitHub Actions
- KICS GitHub Action Compromised: TeamPCP Supply Chain Attack
- Threat Assessment: TeamPCP - CanisterWorm and Kubernetes Wiper Campaign
- TeamPCP Isn't Done: Threat Actor Hits LiteLLM 95M Monthly Downloads on PyPI
- Guidance for Detecting and Defending Against Trivy Supply Chain Compromise
- Trivy March Supply Chain Attack Shows Where Secret Exposure Hurts Most
- When the Security Scanner Became the Weapon: Inside the TeamPCP Campaign
- TeamPCP Supply Chain Attack Campaign Targets Trivy, Checkmarx, and LiteLLM
- Researchers Warn of New Vect RaaS Variant
- Vect: A New RaaS Operation Targeting ESXi and Enterprise Environments
- TeamPCP Threat Actor Profile
Threats related to TeamPCP Partners With Vect Ransomware Group to Escalate
- TeamPCP LiteLLM Supply Chain Attack — Trojaned PyPI Packages (v1.82.7/1.82.8) with Multi-Stage C2 Payload
- LiteLLM Supply Chain Compromise — TeamPCP Multi-Ecosystem Campaign via Trojanized PyPI Packages
- TeamPCP Supply Chain Campaign: LiteLLM PyPI Compromise, CanisterWorm npm Propagation, and Multi-Ecosystem Attack (CVE-2026-33634)
- TeamPCP Cascading Supply Chain Campaign: Telnyx PyPI Compromise with WAV Steganography
- Trivy Supply Chain Compromise — TeamPCP Credential-Stealing Malware Injected into CI/CD Pipelines (CVE-2026-33634)
- TeamPCP Supply Chain Attack via Backdoored Telnyx PyPI Package with Steganographic WAV Payloads
Detection coverage for TL-2026-0288
As of 2026-07-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0288 across Splunk SPL, Microsoft KQL and Sigma, covering 53 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.