# TeamPCP Cascading Supply Chain Campaign: Telnyx PyPI Compromise with WAV Steganography

> TeamPCP threat actor compromised the Telnyx Python SDK on PyPI (versions 4.87.1, 4.87.2) on March 27, 2026, injecting credential-stealing malware that uses WAV file steganography for payload delivery. This is part of a cascading supply chain campaign that previously compromised LiteLLM, Trivy, Checkmarx KICS/AST, and 45+ npm packages, targeting CI/CD secrets, cloud credentials, SSH keys, and Kubernetes service account tokens across Windows, Linux, and macOS.

- **Published:** 2026-03-30T12:00:00Z
- **Last reviewed:** 2026-03-30T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0299
- **ID:** TL-2026-0299
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Actor:** TeamPCP (Russia)
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

TeamPCP conducted a sophisticated cascading supply chain attack across multiple software ecosystems between March 19-27, 2026, culminating in the compromise of the Telnyx Python SDK on PyPI. The campaign demonstrates an advanced multi-stage attack chain where each compromised package provided credentials to compromise the next target.

The attack began on March 19 when Trivy v0.69.4 was compromised via stolen credentials, with 76 of 77 trivy-action GitHub Action tags force-pushed to inject malicious workflows. Because LiteLLM's CI pipeline used Trivy without version pinning, TeamPCP leveraged this to compromise the LiteLLM maintainer's GitHub account (krrishdholakia), leading to LiteLLM versions 1.82.7 and 1.82.8 being published with credential-stealing payloads on March 24.

The Telnyx compromise on March 27 represents a tactical evolution. Malicious code was injected into telnyx/_client.py, triggering on package import. The payload employs WAV file steganography — a novel evasion technique where executable payloads are embedded within audio files. On Windows, the malware downloads hangup.wav containing an embedded executable; on Linux/macOS, it fetches ringtone.wav containing a collector script. The WAV files use XOR obfuscation where each 16-byte frame contains 8 bytes of encrypted data followed by an 8-byte decryption key.

Credential harvesting targets environment variables, .env files, SSH keys, cloud credentials (AWS, GCP, Azure), Kubernetes service account tokens, Docker configurations, shell history, database credentials, wallet files, and CI/CD secrets. Collected data is encrypted using a hybrid scheme: AES-256 session key for data encryption, RSA-4096 for key wrapping, then exfiltrated via HTTP POST to 83.142.209.203:8080 with the header X-Filename: tpcp.tar.gz. A fallback mechanism attempts to create public GitHub repositories named tpcp-docs for data staging.

Persistence varies by platform: on Windows, a binary masquerading as msbuild.exe is dropped in the Startup folder; on Linux, a systemd user service (sysmon.service) executes a Python backdoor at ~/.config/sysmon/sysmon.py. On Linux/macOS for Telnyx specifically, the malware operates from a self-destructing temporary directory for near-zero forensic artifacts.

The Kubernetes component is particularly destructive. When a service account token is detected, the malware creates privileged pods mounting the host root filesystem. Geographic targeting determines payload: Iranian systems receive a destructive DaemonSet (host-provisioner-iran) with a kamikaze container that wipes the filesystem, while non-Iranian systems receive a persistent backdoor (host-provisioner-std).

The broader campaign also included a self-propagating npm worm affecting 45+ packages across @EmilGroup, @opengov, @teale.io, @airtm, and @pypestream scopes, and the defacement of Aqua Security's GitHub organization with 44 repositories renamed with tpcp-docs- prefix. TeamPCP has announced partnerships with LAPSUS$ and emerging ransomware group Vect, indicating the harvested credentials may feed downstream ransomware and extortion operations.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1548 Abuse Elevation Control Mechanism
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1070 Indicator Removal
- T1552 Unsecured Credentials
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1570 Lateral Tool Transfer
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1119 Automated Collection
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel
- T1020 Automated Exfiltration
- T1561 Disk Wipe
- T1586 Compromise Accounts

## Sources

- [Akamai: The Telnyx PyPI Compromise and the 2026 TeamPCP Supply Chain Attacks](https://www.akamai.com/blog/security-research/2026/mar/telnyx-pypi-2026-teampcp-supply-chain-attacks)
- [The Hacker News: TeamPCP Pushes Malicious Telnyx Versions to PyPI](https://thehackernews.com/2026/03/teampcp-pushes-malicious-telnyx.html)
- [Datadog Security Labs: LiteLLM and Telnyx Compromised on PyPI by TeamPCP](https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-teampcp-supply-chain-campaign/)
- [ReversingLabs: Inside the TeamPCP Cascading Supply Chain Attack](https://www.reversinglabs.com/blog/teampcp-supply-chain-attack-spreads)
- [Trend Micro: TeamPCP's Telnyx Attack Marks a Shift in Tactics](https://www.trendmicro.com/en_us/research/26/c/teampcp-telnyx-attack-marks-a-shift-in-tactics.html)
- [SecurityWeek: Telnyx Targeted in Growing TeamPCP Supply Chain Attack](https://www.securityweek.com/telnyx-targeted-in-growing-teampcp-supply-chain-attack/)
- [PyPI Advisory: Telnyx Package Quarantined](https://pypi.org/project/telnyx/)
- [Aqua Security Trivy GitHub Incident Response](https://github.com/aquasecurity/trivy/security/advisories)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0299