Threat reportSupply ChainTL-2026-0515
Backdoored Cemu v2.6 GitHub Release — TeamPCP Supply Chain Campaign Extends to Cemu Nintendo Wii U Emulator (cemu-project/Cemu)
Backdoored Cemu v2.6 GitHub Release (TL-2026-0515), also tracked as TeamPCP Cemu Backdoor, is a high-severity supply-chain compromise, first published 2026-05-14. It is attributed to TeamPCP with high confidence, affects cemu-project Cemu (Nintendo Wii U Emulator), maps to 32 MITRE ATT&CK techniques (T1005, T1027.004, T1036.005), and is covered by 9 detection rules and 24 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 32MITRE ATT&CK
- Actors
- 1TeamPCP
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 24Indicators of compromise
Key facts for TL-2026-0515
- Threat ID
- TL-2026-0515
- Also known as
- TeamPCP Cemu Backdoor, MangelSpec Compromise, transformers.pyz Cemu Variant, Mini Shai-Hulud v3 Cemu Pivot
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution
- TeamPCP
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- gaming, developers, consumer, cloud-users, enterprise-IT, DevOps
- Target regions
- Global (Linux end-users), North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in Backdoored Cemu v2.6 GitHub Release
Malware and tooling: transformers.pyz / pgmonitor.py credential stealer, Custom Python — POST /v1/weights + GitHub dead-drop resolver + victim-account exfil-repo
How Backdoored Cemu v2.6 GitHub Release works
On 7-8 May 2026, threat actor TeamPCP re-uploaded backdoored Linux assets (Cemu-2.6-x86_64.AppImage and Cemu-2.6-ubuntu-22.04-x64.zip) to the official cemu-project/Cemu v2.6 GitHub release page using the compromised account of long-term Cemu co-author 'MangelSpec' — bypassing CI/CD entirely with no GitHub Actions workflow execution. The backdoored AppImage embeds a Python zipapp payload (transformers.pyz / startup.pyz, SHA256 0f35abda19fb69430c32228465396094b866d887427bf551e353ab31256a9dd6) at SquashFS path /usr/share/Cemu/scripts/startup.pyz — a path absent from upstream Cemu. The zipapp is byte-for-byte identical to the payload shipped in the malicious PyPI wheel mistralai==2.4.6 from the 11 May 2026 TanStack/Mistral 170-package supply chain campaign (TL-2026-0499), linking the two operations under the same TeamPCP actor and shared C2 (83.142.209.194/v1/weights). The Linux AppImage reached 19,897 downloads and the Ubuntu zip 1,957 downloads before discovery and removal by Datadog Security Labs on 14 May 2026.
ATTACK OVERVIEW
On 7-8 May 2026, threat actor TeamPCP gained access to the GitHub account of 'MangelSpec' — a long-term co-author of the Cemu Nintendo Wii U emulator project (cemu-project/Cemu) — and used direct UI-level release-asset re-upload to replace the legitimate Linux builds of the Cemu v2.6 release (originally published February 2026) with backdoored variants. The attack bypassed Cemu's CI/CD pipelines entirely: no GitHub Actions workflow ran, ruling out stolen GITHUB_TOKEN or workflow_run/pull_request_target compromise and indicating direct human-credential compromise (likely device-flow phishing or session-cookie theft). The attack vector is therefore distinct from the GitHub Actions OIDC token theft used in the parallel npm/PyPI compromises (TL-2026-0499) — but the payload is identical, definitively tying both operations to the same TeamPCP infrastructure.
BACKDOORED ARTIFACTS
Two Linux release assets were swapped on the cemu-project/Cemu v2.6 GitHub release page: - Cemu-2.6-x86_64.AppImage (SHA256 d07a29c4458d00e42d5d9e6345932592e91644d6b821bacdb7a543c628e0b41a) — 19,897 downloads - Cemu-2.6-ubuntu-22.04-x64.zip (SHA256 f140e76236b96adf7cdc796227af9808665143bc674debb77729fa3e4b8327cc) — 1,957 downloads
The macOS and Windows assets on the same release page were NOT modified.
EMBEDDED ZIPAPP PAYLOAD
The AppImage is a SquashFS bundle. Mounting squashfs-root reveals an extra path absent from upstream Cemu: /usr/share/Cemu/scripts/startup.pyz (transformers.pyz, SHA256 0f35abda19fb69430c32228465396094b866d887427bf551e353ab31256a9dd6). This file is byte-identical to the zipapp shipped inside the malicious PyPI wheel mistralai==2.4.6 (published 11 May 2026 in the TanStack/Mistral campaign — TL-2026-0499). The Ubuntu .zip ships a separate startup.pyz variant (SHA256 1bf72f05191d849049d4a38fced2277ac5cfc54b7ae591f564e7a14add7c886d) with enhanced sandbox-evasion logic.
The zipapp internally is named python_mistral_cemu_files/ and contains: - entrypoint.py — main execution handler that applies guardrails, installs cryptography, and dispatches collectors - aggregate.py — bundles harvested credentials into a single JSON document - roulette.py — implements 1-in-6 probability gating for the destructive payload - utilities/aws_signer.py — SigV4 request signing for AWS Secrets Manager, SSM Parameter Store, STS:GetCallerIdentity - utilities/crypto.py — RSA verification of dead-drop C2 addresses and AES envelope encryption of exfil payloads - collectors/ — modular harvesters for AWS, Azure, GCP, Kubernetes, filesystem credentials, password managers
EXECUTION GUARDRAILS
The AppImage variant applies three execution guardrails (MITRE T1480.001) before running: 1. platform.system() == 'Linux' 2. locale.getdefaultlocale() is NOT a Russian locale (CIS country exclusion — typical Russian-aligned actor signature) 3. multiprocessing.cpu_count() > 4 (avoids low-spec analyst VMs)
The Ubuntu .zip variant adds a sentinel-file sandbox evasion: on first execution it creates /tmp/.transformers, calls sys.exit(1) (appears to be a crash), and only runs the payload on the second invocation when the marker file already exists. This defeats single-shot detonation in automated sandboxes.
CREDENTIAL HARVESTING
The collectors/ modules harvest: - Cloud: AWS Secrets Manager + SSM Parameter Store (via the embedded SigV4 signer), Azure Key Vault, GCP Secret Manager - Kubernetes: secrets across all namespaces (kubectl + in-cluster service-account tokens) - Filesystem: ~/.ssh/* private keys, ~/.aws/credentials, ~/.kube/config, browser-stored cookies and tokens - Password managers: 1Password (op CLI), Bitwarden (bw CLI), gopass, pass - Developer tokens: GitHub PATs from ~/.config/gh/, ~/.npmrc, ~/.pypirc
PERSISTENCE
A base64-encoded blob inside entrypoint.py is decoded to pgmonitor.py (PostgreSQL-monitor masquerade, MITRE T1036.005) and installed as systemd unit /etc/systemd/system/pgsql-monitor.service (root) or ~/.config/systemd/user/pgsql-monitor.service (user fallback). Service starts on next boot and re-harvests every 6 hours.
EXFILTRATION (TIERED C2)
1. Primary: HTTPS POST to 83.142.209.194/v1/weights with AES-encrypted-and-RSA-signed JSON payload (MITRE T1041, T1071.001) 2. Dead-drop resolver: polls a hard-coded list of GitHub repos for commits whose messages match the pattern 'FIRESCALE <base64url>.<base64sig>' — base64url decodes to a fresh C2 IP/host signed with the operator's RSA-4096 public key embedded in utilities/crypto.py 3. Last-resort: creates a NEW PUBLIC GitHub repository under the victim's own credentials with a randomized Slavic-mythology name (e.g. 'leshy-archive-9314', 'rusalka-blob-2261') and uploads results.json there
DESTRUCTIVE COMPONENT
roulette.py geo-fences on public-IP geolocation: if the host resolves to Israel (IL) or Iran (IR), with 1-in-6 (~16.7%) random probability, the payload plays a loud audio file via paplay/aplay and executes 'rm -rf /' (the original Cemu variant — ineffective on modern Linux due to the default --preserve-root). Updated mistralai variants observed in the wild use 'rm -rf /*' which IS effective.
ATTRIBUTION
TeamPCP publicly claimed the operation via the C2 server at 83.142.209.194 itself (a banner response). Datadog Security Labs states it is 'not in a position to assess the credibility of that claim.' Confidence in shared-actor attribution between the Cemu compromise and TL-2026-0499 (TanStack/Mistral) is HIGH based on byte-identical payload SHA256, shared C2 IP, identical dead-drop algorithm, and identical Slavic-mythology repo-naming convention.
IMPACT
Approximately 21,854 confirmed downloads of backdoored Cemu Linux assets (19,897 AppImage + 1,957 Ubuntu zip) before takedown. Cemu's user base skews toward end-user gamers rather than developers, expanding the campaign's blast radius beyond the typical npm/PyPI developer audience: any Linux user who ran the AppImage in a non-Russian locale on a >4-core CPU is potentially compromised across cloud, SSH, password-manager, and Kubernetes credential stores.
MITRE ATT&CK techniques used in TL-2026-0515
Collection
T1005 Data from Local System; T1530 Data from Cloud Storage
Defense Evasion
T1027.004 Obfuscated Files or Information: Compile After Delivery; T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1480.001 Execution Guardrails: Environmental Keying; T1497.003 Time Based Checks
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository
Execution
T1059.006 Command and Scripting Interpreter: Python; T1204.002 User Execution: Malicious File
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1102.001 Web Service: Dead Drop Resolver; T1573.002 Encrypted Channel: Asymmetric Cryptography
Initial Access
T1078.004 Valid Accounts: Cloud Accounts; T1195 Supply Chain Compromise; T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship
Discovery
T1082 System Information Discovery; T1526 Cloud Service Discovery; T1613 Container and Resource Discovery
Impact
T1485 Data Destruction; T1561.001 Disk Wipe: Disk Content Wipe
Credential Access
T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files; T1552.005 Unsecured Credentials: Cloud Instance Metadata API; T1552.007 Unsecured Credentials: Container API; T1555.005 Credentials from Password Stores: Password Managers
Persistence
T1543.002 Create or Modify System Process: Systemd Service
Resource Development
T1583.004 Acquire Infrastructure: Server; T1586.001 Compromise Accounts: Social Media Accounts; T1608.001 Stage Capabilities: Upload Malware
Affected products and versions in Backdoored Cemu v2.6 GitHub Release
- cemu-project — Cemu (Nintendo Wii U Emulator)
Vulnerable versions: 2.6 Linux AppImage (release asset re-uploaded 7-8 May 2026); 2.6 Ubuntu 22.04 x64 zip (release asset re-uploaded 7-8 May 2026)
Fixed in: 2.6 with vendor-rebuilt Linux assets (post-takedown, verify vendor-published SHA256)
Remediation for Backdoored Cemu v2.6 GitHub Release
Patches
- Cemu project: rebuild and re-sign Cemu v2.6 Linux assets from CI; publish vendor SHA256SUMS in the release notes; revoke MangelSpec's release-asset write access pending forensic review
- GitHub: report compromised MangelSpec account to GitHub Trust & Safety for forensic timeline (sessions, IPs, OAuth grants)
Immediate actions
- Re-download Cemu v2.6 ONLY from the post-takedown clean release (verify with vendor-published SHA256 — do NOT trust d07a29c4458d00e42d5d9e6345932592e91644d6b821bacdb7a543c628e0b41a or f140e76236b96adf7cdc796227af9808665143bc674debb77729fa3e4b8327cc)
- Hunt for /usr/share/Cemu/scripts/startup.pyz inside any mounted Cemu AppImage and on disk under /opt, /usr/local, $HOME — its presence in upstream-style paths is a high-confidence IOC
- Block egress to 83.142.209.194 at perimeter and EDR — endpoint, gateway, and DNS sinkhole
- Hunt /tmp/.transformers sentinel file on all Linux workstations as a sandbox-evasion marker
- Hunt systemd units named pgsql-monitor.service in /etc/systemd/system/ and ~/.config/systemd/user/ — disable, capture, and forensically image
- Search for newly-created public GitHub repositories under engineering-team accounts with Slavic-mythology naming patterns (leshy-*, rusalka-*, kikimora-*, domovoi-*, baba-yaga-*) — these are exfil dead-drops
- Rotate ALL AWS access keys, IAM roles, SSM parameters, Secrets Manager secrets accessible to any host that ran Cemu v2.6 Linux assets
- Rotate Azure Key Vault secrets, GCP Secret Manager entries, and Kubernetes secrets in clusters reachable from affected workstations
- Force re-authentication and rotate session tokens for 1Password, Bitwarden, gopass, pass on affected hosts
- Revoke and re-issue all SSH keys present in ~/.ssh/ on affected hosts; rotate authorized_keys on downstream servers
Workarounds
- If Cemu v2.6 was already executed: physically isolate the host, image the disk, and rebuild from known-good media — credentials harvested cannot be recalled
- Pin Cemu installations to upstream-built Flatpak or Snap packages until clean GitHub releases are re-published and verified
Longer-term hardening
- Deploy EDR with AppImage SquashFS introspection (or pre-execution SquashFS unpack and YARA scan) — most EDRs treat AppImages as opaque blobs
- Treat GitHub release-page binaries as untrusted by default; require detached signature verification (cosign, minisign) or vendor-published checksums
- Require hardware-key (FIDO2) MFA for all maintainers of widely-distributed open-source repositories — passkeys defeat the device-flow/session-cookie compromise vector used against MangelSpec
- Network-egress baselining for developer workstations: alert on first-seen Linode/Hetzner ranges (83.142.0.0/16 family) and on systemd-spawned curl/python POST to unsanctioned hosts
- GitHub Audit Log monitoring for release-asset PATCH/DELETE events on production repositories outside of CI pipelines (human-triggered asset uploads to long-published releases are high-signal)
- Cloud detective controls: CloudTrail/GuardDuty rules for SigV4 calls to Secrets Manager / SSM from unfamiliar IPs, especially from AWS-external Linode/Hetzner ranges
Weaknesses (CWE) in Backdoored Cemu v2.6 GitHub Release
Timeline of Backdoored Cemu v2.6 GitHub Release
- cemu-project/Cemu publishes legitimate v2.6 release on GitHub with macOS, Windows, and Linux (AppImage + Ubuntu zip) assets built from CI.
- Backdoored Cemu-2.6-x86_64.AppImage and Cemu-2.6-ubuntu-22.04-x64.zip uploaded to the v2.6 release page via direct GitHub UI release-asset re-upload, replacing the legitimate Linux builds while leaving macOS and Windows assets untouched.
- TeamPCP gains access to long-term Cemu co-author MangelSpec's GitHub account credentials (no GitHub Actions workflow ran — confirming human-credential compromise, not GITHUB_TOKEN theft).
- Cemu users worldwide downloading v2.6 from the official release page receive the trojanized AppImage / Ubuntu zip carrying transformers.pyz at /usr/share/Cemu/scripts/startup.pyz.
- TeamPCP executes the parallel 170-package npm/PyPI compromise (TL-2026-0499) including @tanstack/react-router and mistralai==2.4.6 — the mistralai PyPI wheel ships the byte-identical transformers.pyz payload (SHA256 0f35abda19fb69430c32228465396094b866d887427bf551e353ab31256a9dd6) confirming shared infrastructure.
- Datadog Security Labs, while triaging the mistralai==2.4.6 payload, pivots on the SHA256 hash and discovers the identical zipapp embedded in the Cemu v2.6 GitHub release Linux assets.
- Datadog Security Labs notifies cemu-project maintainers and GitHub Trust & Safety; backdoored release assets are taken down, MangelSpec's release write permissions revoked pending forensic review.
- TeamPCP publicly claims responsibility via banner response on the C2 server at 83.142.209.194. Datadog notes claim is unverified.
- Datadog Security Labs publishes public advisory documenting the Cemu compromise, MangelSpec account compromise, payload analysis, and 21,854-download impact (19,897 AppImage + 1,957 Ubuntu zip).
- As of 2026-05-29, the backdoored Cemu v2.6 assets were pulled and MangelSpec's access revoked by 14 May, but the parent TeamPCP/Mini Shai-Hulud campaign is escalating (Wave 4 GitHub-internal breach, durabletask PyPI worm, @antv, worm open-sourced 12 May). The actor (UNC6780), shared transformers.pyz payload and takedown-resistant C2 (83.142.209.194, FIRESCALE dead-drop) remain unindicted and live.
Sources cited for Backdoored Cemu v2.6 GitHub Release
- Backdoored Cemu release linked to TanStack and Mistral supply chain campaign
- TL-2026-0499 — Mini Shai-Hulud v3 TanStack/UiPath/Mistral npm & PyPI Supply Chain Compromise
- cemu-project/Cemu v2.6 release page (GitHub)
- Datadog Security Labs threat intelligence index
- AppImage format documentation — SquashFS payload structure
- MITRE ATT&CK T1195.002 Compromise Software Supply Chain
- GitHub Security Lab — guidance on release-asset integrity
Detection coverage for TL-2026-0515
As of 2026-05-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0515 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.