TeamPCP Cascading Supply Chain Campaign: Telnyx PyPI Compromise with WAV Steganography — Threadlinqs Intelligence
As of 2026-05-30, TeamPCP Cascading Supply Chain Campaign: Telnyx PyPI Compromise with WAV Steganography is a critical-severity supply chain threat attributed to TeamPCP (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.
Threat ID: TL-2026-0299 · Severity: CRITICAL · CVSS: 9.8 · Status: MONITORING · Category: SUPPLY_CHAIN
Attribution: TeamPCP · Russia · FINANCIAL
TeamPCP threat actor compromised the Telnyx Python SDK on PyPI (versions 4.87.1, 4.87.2) on March 27, 2026, injecting credential-stealing malware that uses WAV file steganography for payload delivery.
TeamPCP conducted a sophisticated cascading supply chain attack across multiple software ecosystems between March 19-27, 2026, culminating in the compromise of the Telnyx Python SDK on PyPI. The campaign demonstrates an advanced multi-stage attack chain where each compromised package provided credentials to compromise the next target.
The attack began on March 19 when Trivy v0.69.4 was compromised via stolen credentials, with 76 of 77 trivy-action GitHub Action tags force-pushed to inject malicious workflows. Because LiteLLM's CI pipeline used Trivy without version pinning, TeamPCP leveraged this to compromise the LiteLLM maintainer's GitHub account (krrishdholakia), leading to LiteLLM versions 1.82.7 and 1.82.8 being published with credential-stealing payloads on March 24.
The Telnyx compromise on March 27 represents a tactical evolution. Malicious code was injected into telnyx/_client.py, triggering on package import. The payload employs WAV file steganography — a novel evasion technique where executable payloads are embedded within audio files. On Windows, the malware downloads hangup.wav containing an embedded executable; on Linux/macOS, it fetches ringtone.wav containing a collector script. The WAV files use XOR obfuscation where each 16-byte frame contains 8 bytes of encrypted data followed by an 8-byte decryption key.
Credential harvesting targets environment variables, .env files, SSH keys, cloud credentials (AWS, GCP, Azure), Kubernetes service account tokens, Docker configurations, shell history, database credentials, wallet files, and CI/CD secrets. Collected data is encrypted using a hybrid scheme: AES-256 session key for data encryption, RSA-4096 for key wrapping, then exfiltrated via HTTP POST to 83.142.209.203:8080 with the header X-Filename: tpcp.tar.gz. A fallback mechanism attempts to create public GitHub repositories named tpcp-docs for data staging.
Persistence varies by platform: on Windows, a binary masquerading as msbuild.exe is dropped in the Startup folder; on Linux, a systemd user service (sysmon.service) executes a Python backdoor at ~/.config/sysmon/sysmon.py. On Linux/macOS for Telnyx specifically, the malware operates from a self-destructing temporary directory for near-zero forensic artifacts.
The Kubernetes component is particularly destructive. When a service account token is detected, the malware creates privileged pods mounting the host root filesystem. Geographic targeting determines payload: Iranian systems receive a destructive DaemonSet (host-provisioner-iran) with a kamikaze container that wipes the filesystem, while non-Iranian systems receive a persistent backdoor (host-provisioner-std).
The broader campaign also included a self-propagating npm worm affecting 45+ packages across @EmilGroup, @opengov, @teale.io, @airtm, and @pypestream scopes, and the defacement of Aqua Security's GitHub organization with 44 repositories renamed with tpcp-docs- prefix. TeamPCP has announced partnerships with LAPSUS$ and emerging ransomware group Vect, indicating the harvested credentials may feed downstream ransomware and extortion operations.
Weaknesses (CWE)
CWE-506, CWE-494, CWE-829
Target sectors: technology, cloud-infrastructure, devops, telecommunications, financial, government, healthcare, software-development
Target regions: Global, North America, Europe, Middle East
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1195, T1199, T1059, T1547, T1547, T1053, T1548, T1027, T1140, T1036