Latest Threats

PCPJack Worm — Cloud Credential Theft Framework Evicting TeamPCP Infections (CVE-2025-29927, CVE-2025-55182, CVE-2026-1357, CVE-2025-9501, CVE-2025-48703) — Threadlinqs Intelligence

As of 2026-05-30, PCPJack Worm — Cloud Credential Theft Framework Evicting TeamPCP Infections (CVE-2025-29927, CVE-2025-55182, CVE-2026-1357, CVE-2025-9501, CVE-2025-48703) is a critical-severity malware threat attributed to PCPJack operators, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 47 indicators of compromise.

Threat ID: TL-2026-0478 · Severity: CRITICAL · CVSS: 9.8 · Status: ACTIVE · Category: MALWARE

Attribution: PCPJack operators · FINANCIAL

PCPJack is a Linux-targeting cloud worm publicly disclosed by SentinelLabs on 2026-05-07 that exploits five CVEs to gain initial access against exposed Docker, Kubernetes, Redis, MongoDB, RayML, and

OVERVIEW PCPJack is a self-propagating, Linux-focused credential-theft framework first publicly attributed by SentinelLabs (Alex Delamotte) on May 7, 2026. The toolkit is implemented primarily in Python, dropped to /var/lib/.spm/ on compromised hosts, and persisted through a systemd service named spm-worker.service. PCPJack chains five publicly disclosed CVEs against widely-deployed application stacks and complements that exploitation with mass scanning of exposed cloud infrastructure (Docker daemon ports 2375/2376, Kubernetes API, Redis, MongoDB, and RayML on port 8265). Once a host is compromised, the worm enumerates and exfiltrates secrets from more than two dozen cloud, developer, payment, and cryptocurrency services, and deploys an architecture-specific Sliver C2 beacon for hands-on operator control. INITIAL ACCESS PCPJack's exploitation library targets five disclosed vulnerabilities: - CVE-2025-29927 — Next.js middleware authorization bypass via the x-middleware-subrequest header, allowing route-level access controls to be skipped. - CVE-2025-55182 — React/Next.js related vulnerability used to gain code execution on misconfigured server-side render targets. - CVE-2026-1357 — WPVivid Backup WordPress plugin authenticated arbitrary file upload leading to PHP code execution (disclosed February 2026). - CVE-2025-9501 — W3 Total Cache WordPress plugin remote code execution flaw enabling unauthenticated command execution under web-server context. - CVE-2025-48703 — CentOS Web Panel (CWP) command injection in the file management API, abused for unauthenticated RCE on Linux servers. In parallel, the worm scans the public internet for exposed Docker REST APIs (2375/2376), unauthenticated Kubernetes APIs, AUTH-disabled Redis, accessible MongoDB instances, and Ray AI cluster dashboards (RayML, 8265). Infrastructure hosting the scanning fleet has been observed in 38.242.0.0/16, 161.97.0.0/16, 193.187.129.0/24, and 213.136.80.0/24 ranges (largely European bulletproof / VPS providers). EXECUTION AND PERSISTENCE On successful exploitation, a bootstrap.sh stager pulls the main Python toolkit (worm.py, monitor.py, utils.py, lateral.py, crypto_util.py, cloud_ranges.py, cloud_scan.py, extractor.py) into /var/lib/.spm/ along with helper binaries (update.bin, update-386.bin, update-arm.bin) for the architecture-specific Sliver beacon. A systemd unit at /etc/systemd/system/spm-worker.service is registered to maintain persistence; the file /tmp/.origin records the entry vector for telemetry and rival-tracking. CREDENTIAL ACCESS PCPJack's extractor.py harvests credentials from a wide and growing set of sources: AWS IMDS (both v1 and v2), Kubernetes service account tokens (/var/run/secrets/kubernetes.io/serviceaccount/token), Docker secrets and ~/.docker/config.json, SSH private keys and known_hosts, Slack/Discord/GitHub tokens, HashiCorp Vault tokens, 1Password configs, OpenAI and Anthropic API keys, DigitalOcean PATs, Stripe and Twilio API keys, SendGrid/Mailchimp credentials, Gmail OAuth tokens, browser cookie stores, WordPress wp-config.php files, and crypto-wallet artifacts (Binance, Coinbase, Kraken, Gemini API keys; Solana keypairs; Bitcoin wallet.dat; Ethereum keystore JSON). Recovered credentials are immediately validated and packaged for exfiltration. LATERAL MOVEMENT lateral.py uses recovered SSH keys, kubeconfig files, AWS keys, and cloud metadata tokens to pivot. From AWS-attached identities the operators enumerate IAM, S3, EC2 metadata, Lambda functions, and Secrets Manager. From Kubernetes service accounts they enumerate pods, secrets, and config maps and attempt to schedule worker pods. The framework specifically uses recovered credentials to seed cloud_ranges.json (cached at /var/lib/.spm/_cr/ranges.json), which expands the next scanning round. DEFENSE EVASION AND TEAMPCP EVICTION A distinguishing behavior is the active eviction of the rival TeamPCP cryptojacking actor: PCPJack searches for and removes TeamPCP proce

MITRE ATT&CK Techniques

T1595 Active Scanning; T1595.002 Active Scanning: Vulnerability Scanning; T1583.003 Acquire Infrastructure: Virtual Private Server; T1588.002 Obtain Capabilities: Tool; T1190 Exploit Public-Facing Application; T1133 External Remote Services; T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.006 Command and Scripting Interpreter: Python; T1610 Deploy Container; T1543.002 Create or Modify System Process: Systemd Service; T1053.003 Scheduled Task/Job: Cron; T1068 Exploitation for Privilege Escalation; T1070.004 Indicator Removal: File Deletion; T1564.001 Hide Artifacts: Hidden Files and Directories; T1562.001 Impair Defenses: Disable or Modify Tools; T1552.001 Unsecured Credentials: Credentials In Files; T1552.005 Unsecured Credentials: Cloud Instance Metadata API; T1552.007 Unsecured Credentials: Container API; T1528 Steal Application Access Token; T1555 Credentials from Password Stores; T1539 Steal Web Session Cookie; T1046 Network Service Discovery; T1526 Cloud Service Discovery; T1613 Container and Resource Discovery; T1021.004 Remote Services: SSH; T1210 Exploitation of Remote Services; T1119 Automated Collection; T1005 Data from Local System; T1071.001 Application Layer Protocol: Web Protocols; T1102.002 Web Service: Bidirectional Communication; T1573.001 Encrypted Channel: Symmetric Cryptography; T1573.002 Encrypted Channel: Asymmetric Cryptography; T1105 Ingress Tool Transfer; T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service; T1030 Data Transfer Size Limits; T1496 Resource Hijacking; T1489 Service Stop

Associated CVEs

CVE-2025-29927, CVE-2025-55182, CVE-2026-1357, CVE-2025-9501, CVE-2025-48703

Weaknesses (CWE)

CWE-285, CWE-77, CWE-78, CWE-434, CWE-94, CWE-306, CWE-522, CWE-552

Target sectors: technology, financial, cryptocurrency, saas, web-hosting, ai-ml, developer-tools, media

Target regions: Global, North America, Europe, Asia-Pacific

References

Related threats

Detections & IOCs

As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 47 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.

MALWARE, CRITICAL, threat intelligence, cybersecurity, CVE-2025-29927, CVE-2025-55182, CVE-2026-1357, CVE-2025-9501, CVE-2025-48703, T1595, T1595.002, T1583.003, T1588.002, T1190, T1133, T1059.004, T1059.006, T1610, T1543.002

Threadlinqs Intelligence — Real-Time Threat Detection Platform

Latest Threats

🔄 Threat Comparison