# TeamPCP Partners With Vect Ransomware Group to Escalate Cross-Ecosystem Open Source Supply Chain Attacks

> Threat actor TeamPCP (a.k.a. PCPcat, ShellForce, DeadCatx3) has partnered with emerging ransomware-as-a-service operation Vect to chain open source supply chain compromises into ransomware campaigns. TeamPCP has compromised packages across npm, PyPI, Docker Hub, GitHub Actions, and OpenVSX, exfiltrating approximately 300GB of compressed credentials. The Vect partnership, announced on BreachForums on March 26 2026, extends automatic affiliation to TeamPCP operators with 80-88% revenue share for follow-on ransomware deployment.

- **Published:** 2026-03-26T12:00:00Z
- **Last reviewed:** 2026-07-27T07:16:36.257Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0288
- **ID:** TL-2026-0288
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** TeamPCP (Russia)
- **Detections:** 9 · **IOCs:** 53 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-55182

## Description

TeamPCP (also tracked as PCPcat, ShellForce, DeadCatx3, PersyPCP, CipherForce) is a cloud-native cybercrime threat cluster that has executed one of the most consequential supply chain campaigns of 2026. Active since at least July 2025 via their Telegram channel, the group compromised over 60,000 servers globally before pivoting to targeted supply chain attacks against open source security tooling.

The campaign began on February 28, 2026 when TeamPCP exploited a misconfigured pull_request_target workflow in Aqua Security's Trivy repository to steal a privileged Personal Access Token (PAT). After an incomplete credential rotation on March 1, the attacker retained residual access through the compromised aqua-bot and Argon-DevOps-Mgt service accounts.

On March 19, TeamPCP leveraged this access to publish a malicious Trivy binary v0.69.4 and force-push malicious commits to 75 of 76 trivy-action tags and all 7 setup-trivy tags, transforming pinned CI/CD tags into payload delivery channels. The embedded infostealer harvested credentials from Runner.Worker process memory, including GitHub PATs, AWS IMDS credentials, SSH keys, cloud tokens, Kubernetes secrets, and CI/CD environment variables. Exfiltration used a hybrid AES-256-CBC + RSA-4096 encryption scheme, with data sent as tpcp.tar.gz to typosquatted domain scan.aquasecurtiy[.]org (45.148.10.212).

By March 20, stolen npm tokens fueled a self-propagating worm (CanisterWorm) that autonomously enumerated packages owned by compromised token holders and republished malicious versions. Over 50 packages were infected across @EmilGroup (28 packages), @opengov (16 packages), @teale.io/eslint-config, @airtm/uuid-base32, and @pypestream/floating-ui-dom. The worm used ICP (Internet Computer Protocol) canister tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io as a decentralized, censorship-resistant C2 dead-drop, and installed pgmon.service persistence.

On March 22, TeamPCP deployed a geopolitically-targeted Kubernetes wiper payload. Iranian systems (detected via Asia/Tehran timezone and fa_IR locale) received the destructive host-provisioner-iran DaemonSet that recursively deleted host filesystems and forced reboots. Non-Iranian systems received the CanisterWorm backdoor instead. The same day, all 44 Aqua Security internal repositories were defaced, and malicious Docker Hub images (trivy:0.69.5, 0.69.6) were published using stolen Aqua credentials.

On March 23, the campaign expanded to Checkmarx: 35 KICS GitHub Action tags were hijacked via compromised cx-plugins-releases service account, ast-github-action v2.3.28 was backdoored, and malicious OpenVSX extensions checkmarx.ast-results v2.53.0 and cx-dev-assist v1.7.0 were published. Exfiltration shifted to checkmarx[.]zone (83.142.209.11).

On March 24, TeamPCP compromised LiteLLM on PyPI, a package with 95 million monthly downloads present in 36% of cloud environments. Malicious versions 1.82.7 and 1.82.8 were published using credentials stolen in the Trivy incident. Version 1.82.7 injected a base64-encoded payload into litellm/proxy/proxy_server.py; version 1.82.8 added litellm_init.pth, a Python startup hook that executes malware on any Python invocation system-wide. The three-stage payload includes a credential harvester (332 lines targeting 50+ sensitive paths), a Kubernetes lateral movement toolkit deploying privileged node-setup-* pods, and a persistent systemd backdoor (sysmon.service) polling checkmarx.zone/raw every 50 minutes. Data was exfiltrated to models.litellm[.]cloud. PyPI quarantined both versions by 11:25 UTC.

On March 26, Vect ransomware group announced on BreachForums a formal partnership with TeamPCP, stating they would chain supply chain compromises into devastating follow-on ransomware campaigns. Vect is an emerging RaaS operation launched in December 2025, written in C++ using ChaCha20-Poly1305 AEAD encryption with intermittent encryption for speed. It targets Windows, Linux, and VMware ESXi, uses Monero for payments, TOX protocol for communications, and exclusively TOR hidden services. The affiliate model offers 80-88% revenue share for affiliates generating over $75 million, with a $250 entry fee waived for CIS applicants. Known victims include organizations in Brazil and South Africa spanning education and manufacturing sectors.

The combined threat represents a significant escalation: TeamPCP's broad supply chain access providing initial footholds, with Vect's ransomware capabilities enabling monetization through double extortion. Approximately 300GB of compressed stolen credentials are being actively worked through, with collaboration with LAPSUS$ extortion group to target multi-billion-dollar companies also reported.

## MITRE ATT&CK

- T1593 Search Open Websites/Domains
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1608 Stage Capabilities
- T1195 Supply Chain Compromise
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1543 Create or Modify System Process
- T1574 Hijack Execution Flow
- T1611 Escape to Host
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1083 File and Directory Discovery
- T1021 Remote Services
- T1610 Deploy Container
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1102 Web Service
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1485 Data Destruction
- T1491 Defacement
- T1486 Data Encrypted for Impact
- T1571 Non-Standard Port
- T1554 Compromise Host Software Binary
- T1553 Subvert Trust Controls
- T1546 Event Triggered Execution
- T1199 Trusted Relationship

## Sources

- [TeamPCP Partners With Vect Targeting OSS Supply Chains](https://socket.dev/blog/teampcp-partners-with-vect-targeting-oss-supply-chains)
- [LiteLLM Compromised on PyPI: Tracing the March 2026 TeamPCP Campaign](https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-teampcp-supply-chain-campaign/)
- [TeamPCP Supply Chain Attack Spreads to LiteLLM](https://www.reversinglabs.com/blog/teampcp-supply-chain-attack-spreads)
- [Three's a Crowd: TeamPCP Trojanizes LiteLLM](https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign)
- [TeamPCP Expands: Supply Chain Compromise Spreads from Trivy to Checkmarx GitHub Actions](https://www.sysdig.com/blog/teampcp-expands-supply-chain-compromise-spreads-from-trivy-to-checkmarx-github-actions)
- [KICS GitHub Action Compromised: TeamPCP Supply Chain Attack](https://www.wiz.io/blog/teampcp-attack-kics-github-action)
- [Threat Assessment: TeamPCP - CanisterWorm and Kubernetes Wiper Campaign](https://cstromblad.com/posts/threat-actor-profile-teampcp/)
- [TeamPCP Isn't Done: Threat Actor Hits LiteLLM 95M Monthly Downloads on PyPI](https://www.endorlabs.com/learn/teampcp-isnt-done)
- [Guidance for Detecting and Defending Against Trivy Supply Chain Compromise](https://www.microsoft.com/en-us/security/blog/2026/03/24/detecting-investigating-defending-against-trivy-supply-chain-compromise/)
- [Trivy March Supply Chain Attack Shows Where Secret Exposure Hurts Most](https://blog.gitguardian.com/trivys-march-supply-chain-attack-shows-where-secret-exposure-hurts-most/)
- [When the Security Scanner Became the Weapon: Inside the TeamPCP Campaign](https://www.sans.org/blog/when-security-scanner-became-weapon-inside-teampcp-supply-chain-campaign)
- [TeamPCP Supply Chain Attack Campaign Targets Trivy, Checkmarx, and LiteLLM](https://arcticwolf.com/resources/blog/teampcp-supply-chain-attack-campaign-targets-trivy-checkmarx-kics-and-litellm-potential-downstream-impact-to-additional-projects/)
- [Researchers Warn of New Vect RaaS Variant](https://www.infosecurity-magazine.com/news/researchers-warn-new-vect-raas/)
- [Vect: A New RaaS Operation Targeting ESXi and Enterprise Environments](https://flare.io/learn/resources/blog/vect-raas-ransomware-esxi-vmware-enterprise)
- [TeamPCP Threat Actor Profile](https://cyble.com/threat-actor-profiles/teampcp/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0288