TeamPCP Supply Chain Attack via Backdoored Telnyx PyPI Package with Steganographic WAV Payloads — Threadlinqs Intelligence
As of 2026-05-30, TeamPCP Supply Chain Attack via Backdoored Telnyx PyPI Package with Steganographic WAV Payloads is a critical-severity supply chain threat attributed to TeamPCP (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 28 indicators of compromise.
Threat ID: TL-2026-0298 · Severity: CRITICAL · Status: MONITORING · Category: SUPPLY_CHAIN
Attribution: TeamPCP · Russia · FINANCIAL
Threat actor TeamPCP compromised the Telnyx Python SDK on PyPI (742K+ monthly downloads), publishing malicious versions 4.87.1 and 4.87.2 on March 27, 2026 that execute credential-stealing malware on
TeamPCP, a prolific supply chain threat actor, compromised the official Telnyx Python SDK on PyPI by publishing two malicious versions (4.87.1 and 4.87.2) on March 27, 2026. The Telnyx SDK is widely used for VoIP, messaging, fax, and IoT connectivity, averaging over 742,000 downloads per month.
The sole modified file was telnyx/_client.py, with exactly 74 lines of malicious code injected at three locations: malicious imports at lines 4-16 (subprocess, tempfile, wave, urllib.request, base64), a 4,436-character base64-encoded payload variable '_p' at line 459, and attack functions setup() and FetchAudio() appended after legitimate class definitions at lines 7761-7817. The malicious code executes at module scope during import — no explicit function calls or installation hooks are required.
The initial version 4.87.1 (published at 03:51 UTC) contained a casing bug (Setup() vs setup()) causing a NameError that prevented execution. TeamPCP corrected this within 16 minutes, releasing version 4.87.2 at 04:07 UTC with a single-line fix making both attack paths functional. PyPI quarantined both versions at 10:13 UTC, creating an approximately 6-hour window of active exploitation.
The attack employs a novel steganographic delivery mechanism using WAV audio files. On Linux/macOS, the malware spawns a detached subprocess that downloads ringtone.wav from the C2 server at 83.142.209.203:8080. The WAV file is a valid audio container where frame data contains base64-encoded payloads instead of actual audio. Extraction follows a three-step process: base64-decode the WAV frame data, extract the first 8 bytes as the XOR key, then XOR-decrypt the remaining bytes using repeating-key XOR to recover the executable payload.
On Linux/macOS, the decoded payload is a comprehensive credential harvester that targets SSH keys, cloud credentials (AWS, GCP, Azure), Docker and npm authentication tokens, Git credentials, Vault secrets, database credentials, environment variables, .env files, shell histories, and cryptocurrency wallet data. Stolen data is encrypted using a multi-layer scheme: a random AES-256-CBC session key generated via openssl rand, data encrypted with AES-256-CBC using PBKDF2 key derivation, and the session key wrapped with an attacker-controlled RSA-4096 public key using OAEP padding. The encrypted archive is exfiltrated as tpcp.tar.gz via HTTP POST to the C2 server. The harvester operates within a self-destructing temporary directory, leaving near-zero forensic artifacts. Linux persistence is established via ~/.config/audiomon/audiomon.py with a systemd user service at ~/.config/systemd/user/audiomon.service.
If Kubernetes is detected on the infected system, the malware enumerates cluster secrets using compromised service account tokens and deploys privileged pods to every node in the kube-system namespace. These pods mount the host root filesystem at /host with hostPID, hostNetwork, and privileged: True, then perform a chroot operation into the host filesystem to install persistence mechanisms directly on nodes. Pod names follow the pattern node-setup-*, with containers named kamikaze, provisioner, host-provisioner-iran, and host-provisioner-std.
On Windows, the malware downloads hangup.wav from the same C2 server, extracts an XOR-obfuscated executable from the audio frames, and drops it as msbuild.exe in the Windows Startup folder (%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\) — masquerading as the legitimate Microsoft Build Engine. A hidden .lock file prevents re-execution within a 12-hour window. The executable is launched with the CREATE_NO_WINDOW flag for silent operation.
Attribution to TeamPCP is confirmed with high confidence through three overlapping indicators: an identical RSA-4096 public key shared byte-for-byte with the LiteLLM PyPI compromise (March 24, 2026), the tpcp.tar.gz archive naming convention and X-Filename header (TeamPCP signature), and an identical AES-256-CBC + RSA OAEP encryption pipeline. Th
Weaknesses (CWE)
CWE-506, CWE-494, CWE-327
Target sectors: technology, telecommunications, financial, cloud-services, saas, devops
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 28 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1195, T1059, T1204, T1547, T1543, T1027, T1036, T1070, T1552, T1552