TeamPCP Cascading Supply Chain Campaign: Telnyx PyPI Compromise with WAV Steganography

TeamPCP Cascading Supply Chain Campaign (TL-2026-0299), also tracked as TeamPCP Supply Chain Campaign, is a critical-severity supply-chain compromise scored CVSS 9.8, first published 2026-03-30. It is attributed to TeamPCP (Russia) with high confidence, affects Telnyx Telnyx Python SDK, maps to 23 MITRE ATT&CK techniques (T1005, T1020, T1027), and is covered by 9 detection rules and 30 indicators of compromise.

Key facts for TL-2026-0299

Threat ID
TL-2026-0299
Also known as
TeamPCP Supply Chain Campaign, Telnyx PyPI Compromise, Operation TeamPCP
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Status
MONITORING
Category
SUPPLY_CHAIN
First published
2026-03-30
Last reviewed
2026-03-30
Attribution
TeamPCP
Attribution confidence
HIGH
Nation-state nexus
Russia
Motivation
FINANCIAL
Target sectors
technology, cloud-infrastructure, devops, telecommunications, financial, government, healthcare, software-development
Target regions
Global, North America, Europe, Middle East
Detection rules
9
Indicators of compromise
30

Malware and tooling in TeamPCP Cascading Supply Chain Campaign

Malware and tooling: HTTP POST exfiltration with AES-256/RSA-4096 hybrid encryption

TeamPCP threat actor compromised the Telnyx Python SDK on PyPI (versions 4.87.1, 4.87.2) on March 27, 2026, injecting credential-stealing malware that uses WAV file steganography for payload delivery. This is part of a cascading supply chain campaign that previously compromised LiteLLM, Trivy, Checkmarx KICS/AST, and 45+ npm packages, targeting CI/CD secrets, cloud credentials, SSH keys, and Kubernetes service account tokens across Windows, Linux, and macOS.

How TeamPCP Cascading Supply Chain Campaign works

TeamPCP conducted a sophisticated cascading supply chain attack across multiple software ecosystems between March 19-27, 2026, culminating in the compromise of the Telnyx Python SDK on PyPI. The campaign demonstrates an advanced multi-stage attack chain where each compromised package provided credentials to compromise the next target.

The attack began on March 19 when Trivy v0.69.4 was compromised via stolen credentials, with 76 of 77 trivy-action GitHub Action tags force-pushed to inject malicious workflows. Because LiteLLM's CI pipeline used Trivy without version pinning, TeamPCP leveraged this to compromise the LiteLLM maintainer's GitHub account (krrishdholakia), leading to LiteLLM versions 1.82.7 and 1.82.8 being published with credential-stealing payloads on March 24.

The Telnyx compromise on March 27 represents a tactical evolution. Malicious code was injected into telnyx/_client.py, triggering on package import. The payload employs WAV file steganography — a novel evasion technique where executable payloads are embedded within audio files. On Windows, the malware downloads hangup.wav containing an embedded executable; on Linux/macOS, it fetches ringtone.wav containing a collector script. The WAV files use XOR obfuscation where each 16-byte frame contains 8 bytes of encrypted data followed by an 8-byte decryption key.

Credential harvesting targets environment variables, .env files, SSH keys, cloud credentials (AWS, GCP, Azure), Kubernetes service account tokens, Docker configurations, shell history, database credentials, wallet files, and CI/CD secrets. Collected data is encrypted using a hybrid scheme: AES-256 session key for data encryption, RSA-4096 for key wrapping, then exfiltrated via HTTP POST to 83.142.209.203:8080 with the header X-Filename: tpcp.tar.gz. A fallback mechanism attempts to create public GitHub repositories named tpcp-docs for data staging.

Persistence varies by platform: on Windows, a binary masquerading as msbuild.exe is dropped in the Startup folder; on Linux, a systemd user service (sysmon.service) executes a Python backdoor at ~/.config/sysmon/sysmon.py. On Linux/macOS for Telnyx specifically, the malware operates from a self-destructing temporary directory for near-zero forensic artifacts.

The Kubernetes component is particularly destructive. When a service account token is detected, the malware creates privileged pods mounting the host root filesystem. Geographic targeting determines payload: Iranian systems receive a destructive DaemonSet (host-provisioner-iran) with a kamikaze container that wipes the filesystem, while non-Iranian systems receive a persistent backdoor (host-provisioner-std).

The broader campaign also included a self-propagating npm worm affecting 45+ packages across @EmilGroup, @opengov, @teale.io, @airtm, and @pypestream scopes, and the defacement of Aqua Security's GitHub organization with 44 repositories renamed with tpcp-docs- prefix. TeamPCP has announced partnerships with LAPSUS$ and emerging ransomware group Vect, indicating the harvested credentials may feed downstream ransomware and extortion operations.

MITRE ATT&CK techniques used in TL-2026-0299

collection

T1005 Data from Local System; T1119 Automated Collection; T1560 Archive Collected Data

exfiltration

T1020 Automated Exfiltration; T1041 Exfiltration Over C2 Channel

defense-evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information

execution

T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter

command-and-control

T1071 Application Layer Protocol; T1573 Encrypted Channel

discovery

T1082 System Information Discovery

initial-access

T1195 Supply Chain Compromise; T1199 Trusted Relationship

persistence

T1547 Boot or Logon Autostart Execution

privilege-escalation

T1548 Abuse Elevation Control Mechanism

credential-access

T1552 Unsecured Credentials; T1555 Credentials from Password Stores

impact

T1561 Disk Wipe

lateral-movement

T1570 Lateral Tool Transfer

resource-development

T1586 Compromise Accounts

Affected products and versions in TeamPCP Cascading Supply Chain Campaign

  • Telnyx — Telnyx Python SDK
    Vulnerable versions: 4.87.1; 4.87.2
    Fixed in: 4.87.0
  • BerriAI — LiteLLM
    Vulnerable versions: 1.82.7; 1.82.8
    Fixed in: 1.82.6
  • Aqua Security — Trivy
    Vulnerable versions: 0.69.4; 0.69.5; 0.69.6
    Fixed in: 0.69.3
  • Checkmarx — KICS GitHub Action
    Vulnerable versions: compromised tags
    Fixed in: verify latest
  • Checkmarx — AST GitHub Action
    Vulnerable versions: compromised tags
    Fixed in: verify latest
  • Checkmarx — ast-results VS Code Extension
    Vulnerable versions: 2.53
    Fixed in: verify latest
  • Multiple (npm) — @EmilGroup, @opengov, @teale.io, @airtm, @pypestream packages
    Vulnerable versions: 45+ packages with bumped patch versions
    Fixed in: rollback to pre-March-20 versions

Remediation for TeamPCP Cascading Supply Chain Campaign

Patches

  • Downgrade Telnyx to version 4.87.0 or await verified clean release
  • Downgrade LiteLLM to version prior to 1.82.7
  • Update Trivy to verified clean version after 0.69.6
  • Verify integrity of Checkmarx KICS and AST GitHub Actions

Immediate actions

  • Identify and remove Telnyx versions 4.87.1 and 4.87.2 from all environments
  • Identify and remove LiteLLM versions 1.82.7 and 1.82.8 from all environments
  • Block C2 IP 83.142.209.203 at network perimeter
  • Block all identified malicious domains at DNS level
  • Search for persistence artifacts: msbuild.exe in Windows Startup, sysmon.service on Linux
  • Inspect Kubernetes clusters for rogue pods matching node-setup-*, host-provisioner-iran, host-provisioner-std
  • Review network logs for HTTP POST requests with X-Filename: tpcp.tar.gz header
  • Rotate all credentials present on potentially compromised systems including SSH keys, cloud tokens, API keys, and CI/CD secrets

Workarounds

  • Temporarily remove affected packages until verified clean versions are available
  • Use virtual environments to isolate Python dependencies
  • Audit all .pth files in Python site-packages directories
  • Monitor for tpcp-docs GitHub repositories being created from your CI/CD systems

Longer-term hardening

  • Pin all dependency versions in CI/CD pipelines — never use unpinned or latest tags
  • Implement package integrity verification using hash pinning or lockfiles
  • Deploy software composition analysis (SCA) tools to detect compromised packages
  • Enable two-factor authentication on all package registry accounts
  • Implement network segmentation to limit blast radius of supply chain compromises
  • Deploy EDR with behavioral detection for credential harvesting patterns
  • Monitor for anomalous PyPI/npm package version publications
  • Implement least-privilege for CI/CD service accounts and Kubernetes tokens

Weaknesses (CWE) in TeamPCP Cascading Supply Chain Campaign

CWE-506, CWE-494, CWE-829

Timeline of TeamPCP Cascading Supply Chain Campaign

  • Additional malicious workflow injections detected in tfsec and traceeshark GitHub repositories
  • Trivy v0.69.4 compromised via stolen credentials; 76 of 77 trivy-action GitHub Action tags force-pushed with malicious workflows; all setup-trivy tags replaced
  • Self-propagating npm worm deployed across 45+ packages in @EmilGroup, @opengov, @teale.io, @airtm, @pypestream scopes; worm steals npm tokens and republishes with malicious payload
  • Kubernetes-focused payload activated with geographic targeting; Iranian systems receive destructive kamikaze DaemonSet, others receive persistent backdoor
  • Aqua Security internal GitHub organization defaced via compromised account Argon-DevOps-Mgt; 44 repositories renamed with tpcp-docs- prefix
  • Checkmarx KICS and AST GitHub Actions compromised; OpenVSX extensions ast-results v2.53 and cx-dev-assist v1.7.0 backdoored
  • LiteLLM maintainer account (krrishdholakia) compromised; automated repository defacement at approximately 14:00 UTC
  • LiteLLM 1.82.7 published on PyPI with credential-stealing payload injected in proxy_server.py; version 1.82.8 follows with litellm_init.pth for automatic execution at Python startup
  • Multiple security vendors (Akamai, Datadog, ReversingLabs, Trend Micro) publish coordinated analysis of the full TeamPCP campaign
  • Malicious Telnyx versions identified and removed from PyPI; project quarantined by PyPI security team
  • Telnyx 4.87.1 published on PyPI at 03:51 UTC with malicious code in _client.py; version 4.87.2 follows at 10:13 UTC; both use WAV steganography for payload delivery
  • As of 2026-05-29, the specific Telnyx PyPI packages (4.87.1/4.87.2) were quarantined and removed within hours, but TeamPCP (UNC6780) remains highly active with no arrest or takedown, launching new supply chain waves through May 18-24 (Nx Console, durabletask PyPI, ~3,800 GitHub repos, Megalodon). The actor, tooling, and Vect ransomware partnership persist, so the campaign is contained at the Telnyx artifact level but live overall.

Sources cited for TeamPCP Cascading Supply Chain Campaign

Threats related to TeamPCP Cascading Supply Chain Campaign

Detection coverage for TL-2026-0299

As of 2026-03-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0299 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats