Backdoored Cemu v2.6 GitHub Release — TeamPCP Supply Chain Campaign Extends to Cemu Nintendo Wii U Emulator (cemu-project/Cemu)
Backdoored Cemu v2.6 GitHub Release (TL-2026-0515), also tracked as TeamPCP Cemu Backdoor, is a high-severity supply-chain compromise, first published 2026-05-14. It is attributed to TeamPCP with high confidence, affects cemu-project Cemu (Nintendo Wii U Emulator), maps to 32 MITRE ATT&CK techniques (T1005, T1027.004, T1036.005), and is covered by 9 detection rules and 24 indicators of compromise.
Key facts for TL-2026-0515
- Threat ID
- TL-2026-0515
- Also known as
- TeamPCP Cemu Backdoor, MangelSpec Compromise, transformers.pyz Cemu Variant, Mini Shai-Hulud v3 Cemu Pivot
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-05-14
- Last reviewed
- 2026-05-14
- Attribution
- TeamPCP
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- gaming, developers, consumer, cloud-users, enterprise-IT, DevOps
- Target regions
- Global (Linux end-users), North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in Backdoored Cemu v2.6 GitHub Release
Malware and tooling: transformers.pyz / pgmonitor.py credential stealer, Custom Python — POST /v1/weights + GitHub dead-drop resolver + victim-account exfil-repo
On 7-8 May 2026, threat actor TeamPCP re-uploaded backdoored Linux assets (Cemu-2.6-x86_64.AppImage and Cemu-2.6-ubuntu-22.04-x64.zip) to the official cemu-project/Cemu v2.6 GitHub release page using the compromised account of long-term Cemu co-author 'MangelSpec' — bypassing CI/CD entirely with no GitHub Actions workflow execution. The backdoored AppImage embeds a Python zipapp payload (transformers.pyz / startup.pyz, SHA256 0f35abda19fb69430c32228465396094b866d887427bf551e353ab31256a9dd6) at SquashFS path /usr/share/Cemu/scripts/startup.pyz — a path absent from upstream Cemu. The zipapp is byte-for-byte identical to the payload shipped in the malicious PyPI wheel mistralai==2.4.6 from the 11 May 2026 TanStack/Mistral 170-package supply chain campaign (TL-2026-0499), linking the two operations under the same TeamPCP actor and shared C2 (83.142.209.194/v1/weights). The Linux AppImage reached 19,897 downloads and the Ubuntu zip 1,957 downloads before discovery and removal by Datadog Security Labs on 14 May 2026.
How Backdoored Cemu v2.6 GitHub Release works
ATTACK OVERVIEW
On 7-8 May 2026, threat actor TeamPCP gained access to the GitHub account of 'MangelSpec' — a long-term co-author of the Cemu Nintendo Wii U emulator project (cemu-project/Cemu) — and used direct UI-level release-asset re-upload to replace the legitimate Linux builds of the Cemu v2.6 release (originally published February 2026) with backdoored variants. The attack bypassed Cemu's CI/CD pipelines entirely: no GitHub Actions workflow ran, ruling out stolen GITHUB_TOKEN or workflow_run/pull_request_target compromise and indicating direct human-credential compromise (likely device-flow phishing or session-cookie theft). The attack vector is therefore distinct from the GitHub Actions OIDC token theft used in the parallel npm/PyPI compromises (TL-2026-0499) — but the payload is identical, definitively tying both operations to the same TeamPCP infrastructure.
BACKDOORED ARTIFACTS
Two Linux release assets were swapped on the cemu-project/Cemu v2.6 GitHub release page: - Cemu-2.6-x86_64.AppImage (SHA256 d07a29c4458d00e42d5d9e6345932592e91644d6b821bacdb7a543c628e0b41a) — 19,897 downloads - Cemu-2.6-ubuntu-22.04-x64.zip (SHA256 f140e76236b96adf7cdc796227af9808665143bc674debb77729fa3e4b8327cc) — 1,957 downloads
The macOS and Windows assets on the same release page were NOT modified.
EMBEDDED ZIPAPP PAYLOAD
The AppImage is a SquashFS bundle. Mounting squashfs-root reveals an extra path absent from upstream Cemu: /usr/share/Cemu/scripts/startup.pyz (transformers.pyz, SHA256 0f35abda19fb69430c32228465396094b866d887427bf551e353ab31256a9dd6). This file is byte-identical to the zipapp shipped inside the malicious PyPI wheel mistralai==2.4.6 (published 11 May 2026 in the TanStack/Mistral campaign — TL-2026-0499). The Ubuntu .zip ships a separate startup.pyz variant (SHA256 1bf72f05191d849049d4a38fced2277ac5cfc54b7ae591f564e7a14add7c886d) with enhanced sandbox-evasion logic.
The zipapp internally is named python_mistral_cemu_files/ and contains: - entrypoint.py — main execution handler that applies guardrails, installs cryptography, and dispatches collectors - aggregate.py — bundles harvested credentials into a single JSON document - roulette.py — implements 1-in-6 probability gating for the destructive payload - utilities/aws_signer.py — SigV4 request signing for AWS Secrets Manager, SSM Parameter Store, STS:GetCallerIdentity - utilities/crypto.py — RSA verification of dead-drop C2 addresses and AES envelope encryption of exfil payloads - collectors/ — modular harvesters for AWS, Azure, GCP, Kubernetes, filesystem credentials, password managers
EXECUTION GUARDRAILS
The AppImage variant applies three execution guardrails (MITRE T1480.001) before running: 1. platform.system() == 'Linux' 2. locale.getdefaultlocale() is NOT a Russian locale (CIS country exclusion — typical Russian-aligned actor signature) 3. multiprocessing.cpu_count() > 4 (avoids low-spec analyst VMs)
The Ubuntu .zip variant adds a sentinel-file sandbox evasion: on first execution it creates /tmp/.transformers, calls sys.exit(1) (appears to be a crash), and only runs the payload on the second invocation when the marker file already exists. This defeats single-shot detonation in automated sandboxes.
CREDENTIAL HARVESTING
The collectors/ modules harvest: - Cloud: AWS Secrets Manager + SSM Parameter Store (via the embedded SigV4 signer), Azure Key Vault, GCP Secret Manager - Kubernetes: secrets across all namespaces (kubectl + in-cluster service-account tokens) - Filesystem: ~/.ssh/* private keys, ~/.aws/credentials, ~/.kube/config, browser-stored cookies and tokens - Password managers: 1Password (op CLI), Bitwarden (bw CLI), gopass, pass - Developer tokens: GitHub PATs from ~/.config/gh/, ~/.npmrc, ~/.pypirc
PERSISTENCE
A base64-encoded blob inside entrypoint.py is decoded to pgmonitor.py (PostgreSQL-monitor masquerade, MITRE T1036.005) and installed as systemd unit /etc/systemd/system/pgsql-monitor.service (root) or ~/.config/systemd/user/pgsql-monitor.service (user fallback). Service starts on next boot and re-harvests every 6 hours.
EXFILTRATION (TIERED C2)
1. Primary: HTTPS POST to 83.142.209.194/v1/weights with AES-encrypted-and-RSA-signed JSON payload (MITRE T1041, T1071.001) 2. Dead-drop resolver: polls a hard-coded list of GitHub repos for commits whose messages match the pattern 'FIRESCALE <base64url>.<base64sig>' — base64url decodes to a fresh C2 IP/host signed with the operator's RSA-4096 public key embedded in utilities/crypto.py 3. Last-resort: creates a NEW PUBLIC GitHub repository under the victim's own credentials with a randomized Slavic-mythology name (e.g. 'leshy-archive-9314', 'rusalka-blob-2261') and uploads results.json there
DESTRUCTIVE COMPONENT
roulette.py geo-fences on public-IP geolocation: if the host resolves to Israel (IL) or Iran (IR), with 1-in-6 (~16.7%) random probability, the payload plays a loud audio file via paplay/aplay and executes 'rm -rf /' (the original Cemu variant — ineffective on modern Linux due to the default --preserve-root). Updated mistralai variants observed in the wild use 'rm -rf /*' which IS effective.
ATTRIBUTION
TeamPCP publicly claimed the operation via the C2 server at 83.142.209.194 itself (a banner response). Datadog Security Labs states it is 'not in a position to assess the credibility of that claim.' Confidence in shared-actor attribution between the Cemu compromise and TL-2026-0499 (TanStack/Mistral) is HIGH based on byte-identical payload SHA256, shared C2 IP, identical dead-drop algorithm, and identical Slavic-mythology repo-naming convention.
IMPACT
Approximately 21,854 confirmed downloads of backdoored Cemu Linux assets (19,897 AppImage + 1,957 Ubuntu zip) before takedown. Cemu's user base skews toward end-user gamers rather than developers, expanding the campaign's blast radius beyond the typical npm/PyPI developer audience: any Linux user who ran the AppImage in a non-Russian locale on a >4-core CPU is potentially compromised across cloud, SSH, password-manager, and Kubernetes credential stores.
MITRE ATT&CK techniques used in TL-2026-0515
Collection
T1005 Data from Local System; T1530 Data from Cloud Storage
Defense Evasion
T1027.004 Obfuscated Files or Information: Compile After Delivery; T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1480.001 Execution Guardrails: Environmental Keying; T1497.003 Time Based Checks
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository
Execution
T1059.006 Command and Scripting Interpreter: Python; T1204.002 User Execution: Malicious File
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1102.001 Web Service: Dead Drop Resolver; T1573.002 Encrypted Channel: Asymmetric Cryptography
Initial Access
T1078.004 Valid Accounts: Cloud Accounts; T1195 Supply Chain Compromise; T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship
Discovery
T1082 System Information Discovery; T1526 Cloud Service Discovery; T1613 Container and Resource Discovery
Impact
T1485 Data Destruction; T1561.001 Disk Wipe: Disk Content Wipe
Credential Access
T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files; T1552.005 Unsecured Credentials: Cloud Instance Metadata API; T1552.007 Unsecured Credentials: Container API; T1555.005 Credentials from Password Stores: Password Managers
Persistence
T1543.002 Create or Modify System Process: Systemd Service
Resource Development
T1583.004 Acquire Infrastructure: Server; T1586.001 Compromise Accounts: Social Media Accounts; T1608.001 Stage Capabilities: Upload Malware
Affected products and versions in Backdoored Cemu v2.6 GitHub Release
- cemu-project — Cemu (Nintendo Wii U Emulator)
Vulnerable versions: 2.6 Linux AppImage (release asset re-uploaded 7-8 May 2026); 2.6 Ubuntu 22.04 x64 zip (release asset re-uploaded 7-8 May 2026)
Fixed in: 2.6 with vendor-rebuilt Linux assets (post-takedown, verify vendor-published SHA256)
Remediation for Backdoored Cemu v2.6 GitHub Release
Patches
- Cemu project: rebuild and re-sign Cemu v2.6 Linux assets from CI; publish vendor SHA256SUMS in the release notes; revoke MangelSpec's release-asset write access pending forensic review
- GitHub: report compromised MangelSpec account to GitHub Trust & Safety for forensic timeline (sessions, IPs, OAuth grants)
Immediate actions
- Re-download Cemu v2.6 ONLY from the post-takedown clean release (verify with vendor-published SHA256 — do NOT trust d07a29c4458d00e42d5d9e6345932592e91644d6b821bacdb7a543c628e0b41a or f140e76236b96adf7cdc796227af9808665143bc674debb77729fa3e4b8327cc)
- Hunt for /usr/share/Cemu/scripts/startup.pyz inside any mounted Cemu AppImage and on disk under /opt, /usr/local, $HOME — its presence in upstream-style paths is a high-confidence IOC
- Block egress to 83.142.209.194 at perimeter and EDR — endpoint, gateway, and DNS sinkhole
- Hunt /tmp/.transformers sentinel file on all Linux workstations as a sandbox-evasion marker
- Hunt systemd units named pgsql-monitor.service in /etc/systemd/system/ and ~/.config/systemd/user/ — disable, capture, and forensically image
- Search for newly-created public GitHub repositories under engineering-team accounts with Slavic-mythology naming patterns (leshy-*, rusalka-*, kikimora-*, domovoi-*, baba-yaga-*) — these are exfil dead-drops
- Rotate ALL AWS access keys, IAM roles, SSM parameters, Secrets Manager secrets accessible to any host that ran Cemu v2.6 Linux assets
- Rotate Azure Key Vault secrets, GCP Secret Manager entries, and Kubernetes secrets in clusters reachable from affected workstations
- Force re-authentication and rotate session tokens for 1Password, Bitwarden, gopass, pass on affected hosts
- Revoke and re-issue all SSH keys present in ~/.ssh/ on affected hosts; rotate authorized_keys on downstream servers
Workarounds
- If Cemu v2.6 was already executed: physically isolate the host, image the disk, and rebuild from known-good media — credentials harvested cannot be recalled
- Pin Cemu installations to upstream-built Flatpak or Snap packages until clean GitHub releases are re-published and verified
Longer-term hardening
- Deploy EDR with AppImage SquashFS introspection (or pre-execution SquashFS unpack and YARA scan) — most EDRs treat AppImages as opaque blobs
- Treat GitHub release-page binaries as untrusted by default; require detached signature verification (cosign, minisign) or vendor-published checksums
- Require hardware-key (FIDO2) MFA for all maintainers of widely-distributed open-source repositories — passkeys defeat the device-flow/session-cookie compromise vector used against MangelSpec
- Network-egress baselining for developer workstations: alert on first-seen Linode/Hetzner ranges (83.142.0.0/16 family) and on systemd-spawned curl/python POST to unsanctioned hosts
- GitHub Audit Log monitoring for release-asset PATCH/DELETE events on production repositories outside of CI pipelines (human-triggered asset uploads to long-published releases are high-signal)
- Cloud detective controls: CloudTrail/GuardDuty rules for SigV4 calls to Secrets Manager / SSM from unfamiliar IPs, especially from AWS-external Linode/Hetzner ranges
Weaknesses (CWE) in Backdoored Cemu v2.6 GitHub Release
CWE-506, CWE-829, CWE-494, CWE-1357
Timeline of Backdoored Cemu v2.6 GitHub Release
- cemu-project/Cemu publishes legitimate v2.6 release on GitHub with macOS, Windows, and Linux (AppImage + Ubuntu zip) assets built from CI.
- Backdoored Cemu-2.6-x86_64.AppImage and Cemu-2.6-ubuntu-22.04-x64.zip uploaded to the v2.6 release page via direct GitHub UI release-asset re-upload, replacing the legitimate Linux builds while leaving macOS and Windows assets untouched.
- TeamPCP gains access to long-term Cemu co-author MangelSpec's GitHub account credentials (no GitHub Actions workflow ran — confirming human-credential compromise, not GITHUB_TOKEN theft).
- Cemu users worldwide downloading v2.6 from the official release page receive the trojanized AppImage / Ubuntu zip carrying transformers.pyz at /usr/share/Cemu/scripts/startup.pyz.
- TeamPCP executes the parallel 170-package npm/PyPI compromise (TL-2026-0499) including @tanstack/react-router and mistralai==2.4.6 — the mistralai PyPI wheel ships the byte-identical transformers.pyz payload (SHA256 0f35abda19fb69430c32228465396094b866d887427bf551e353ab31256a9dd6) confirming shared infrastructure.
- Datadog Security Labs, while triaging the mistralai==2.4.6 payload, pivots on the SHA256 hash and discovers the identical zipapp embedded in the Cemu v2.6 GitHub release Linux assets.
- Datadog Security Labs notifies cemu-project maintainers and GitHub Trust & Safety; backdoored release assets are taken down, MangelSpec's release write permissions revoked pending forensic review.
- TeamPCP publicly claims responsibility via banner response on the C2 server at 83.142.209.194. Datadog notes claim is unverified.
- Datadog Security Labs publishes public advisory documenting the Cemu compromise, MangelSpec account compromise, payload analysis, and 21,854-download impact (19,897 AppImage + 1,957 Ubuntu zip).
- As of 2026-05-29, the backdoored Cemu v2.6 assets were pulled and MangelSpec's access revoked by 14 May, but the parent TeamPCP/Mini Shai-Hulud campaign is escalating (Wave 4 GitHub-internal breach, durabletask PyPI worm, @antv, worm open-sourced 12 May). The actor (UNC6780), shared transformers.pyz payload and takedown-resistant C2 (83.142.209.194, FIRESCALE dead-drop) remain unindicted and live.
Sources cited for Backdoored Cemu v2.6 GitHub Release
- Backdoored Cemu release linked to TanStack and Mistral supply chain campaign
- TL-2026-0499 — Mini Shai-Hulud v3 TanStack/UiPath/Mistral npm & PyPI Supply Chain Compromise
- cemu-project/Cemu v2.6 release page (GitHub)
- Datadog Security Labs threat intelligence index
- AppImage format documentation — SquashFS payload structure
- MITRE ATT&CK T1195.002 Compromise Software Supply Chain
- GitHub Security Lab — guidance on release-asset integrity
Threats related to Backdoored Cemu v2.6 GitHub Release
- Nx Console VS Code Extension Backdoored (v18.95.0) — TeamPCP Mini Shai-Hulud Pivot from TanStack npm Worm to GitHub Internal Repository Breach (CVE-2026-48027)
- Mini Shai-Hulud v3 — TanStack/UiPath/Mistral AI npm & PyPI Supply Chain Compromise (TeamPCP)
- GitHub Internal Breach — TeamPCP Exfiltrates 3,800+ Repos via Poisoned VS Code Extension Tied to Mini Shai-Hulud Worm
- Xinference PyPI Supply Chain Compromise — TeamPCP-Marked Credential Harvester (v2.6.0–2.6.2)
- Mini Shai-Hulud Resurfaces — intercom-client@7.0.4 npm Worm Harvesting GitHub & Cloud Credentials (TeamPCP)
- durabletask PyPI Supply Chain Compromise (v1.4.1–1.4.3) — Microsoft-Published Azure Durable Functions SDK Trojanized w/ Cross-Cloud Credential Stealer + Linux Disk Wiper (TeamPCP / Mini Shai-Hulud)
Detection coverage for TL-2026-0515
As of 2026-05-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0515 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.