# Backdoored Cemu v2.6 GitHub Release — TeamPCP Supply Chain Campaign Extends to Cemu Nintendo Wii U Emulator (cemu-project/Cemu)

> On 7-8 May 2026, threat actor TeamPCP re-uploaded backdoored Linux assets (Cemu-2.6-x86_64.AppImage and Cemu-2.6-ubuntu-22.04-x64.zip) to the official cemu-project/Cemu v2.6 GitHub release page using the compromised account of long-term Cemu co-author 'MangelSpec' — bypassing CI/CD entirely with no GitHub Actions workflow execution. The backdoored AppImage embeds a Python zipapp payload (transformers.pyz / startup.pyz, SHA256 0f35abda19fb69430c32228465396094b866d887427bf551e353ab31256a9dd6) at SquashFS path /usr/share/Cemu/scripts/startup.pyz — a path absent from upstream Cemu. The zipapp is byte-for-byte identical to the payload shipped in the malicious PyPI wheel mistralai==2.4.6 from the 11 May 2026 TanStack/Mistral 170-package supply chain campaign (TL-2026-0499), linking the two operations under the same TeamPCP actor and shared C2 (83.142.209.194/v1/weights). The Linux AppImage reached 19,897 downloads and the Ubuntu zip 1,957 downloads before discovery and removal by Datadog Security Labs on 14 May 2026.

- **Published:** 2026-05-14T12:00:00Z
- **Last reviewed:** 2026-05-14T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0515
- **ID:** TL-2026-0515
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** TeamPCP
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ATTACK OVERVIEW

On 7-8 May 2026, threat actor TeamPCP gained access to the GitHub account of 'MangelSpec' — a long-term co-author of the Cemu Nintendo Wii U emulator project (cemu-project/Cemu) — and used direct UI-level release-asset re-upload to replace the legitimate Linux builds of the Cemu v2.6 release (originally published February 2026) with backdoored variants. The attack bypassed Cemu's CI/CD pipelines entirely: no GitHub Actions workflow ran, ruling out stolen GITHUB_TOKEN or workflow_run/pull_request_target compromise and indicating direct human-credential compromise (likely device-flow phishing or session-cookie theft). The attack vector is therefore distinct from the GitHub Actions OIDC token theft used in the parallel npm/PyPI compromises (TL-2026-0499) — but the payload is identical, definitively tying both operations to the same TeamPCP infrastructure.

BACKDOORED ARTIFACTS

Two Linux release assets were swapped on the cemu-project/Cemu v2.6 GitHub release page:
- Cemu-2.6-x86_64.AppImage (SHA256 d07a29c4458d00e42d5d9e6345932592e91644d6b821bacdb7a543c628e0b41a) — 19,897 downloads
- Cemu-2.6-ubuntu-22.04-x64.zip (SHA256 f140e76236b96adf7cdc796227af9808665143bc674debb77729fa3e4b8327cc) — 1,957 downloads

The macOS and Windows assets on the same release page were NOT modified.

EMBEDDED ZIPAPP PAYLOAD

The AppImage is a SquashFS bundle. Mounting squashfs-root reveals an extra path absent from upstream Cemu: /usr/share/Cemu/scripts/startup.pyz (transformers.pyz, SHA256 0f35abda19fb69430c32228465396094b866d887427bf551e353ab31256a9dd6). This file is byte-identical to the zipapp shipped inside the malicious PyPI wheel mistralai==2.4.6 (published 11 May 2026 in the TanStack/Mistral campaign — TL-2026-0499). The Ubuntu .zip ships a separate startup.pyz variant (SHA256 1bf72f05191d849049d4a38fced2277ac5cfc54b7ae591f564e7a14add7c886d) with enhanced sandbox-evasion logic.

The zipapp internally is named python_mistral_cemu_files/ and contains:
- entrypoint.py — main execution handler that applies guardrails, installs cryptography, and dispatches collectors
- aggregate.py — bundles harvested credentials into a single JSON document
- roulette.py — implements 1-in-6 probability gating for the destructive payload
- utilities/aws_signer.py — SigV4 request signing for AWS Secrets Manager, SSM Parameter Store, STS:GetCallerIdentity
- utilities/crypto.py — RSA verification of dead-drop C2 addresses and AES envelope encryption of exfil payloads
- collectors/ — modular harvesters for AWS, Azure, GCP, Kubernetes, filesystem credentials, password managers

EXECUTION GUARDRAILS

The AppImage variant applies three execution guardrails (MITRE T1480.001) before running:
1. platform.system() == 'Linux'
2. locale.getdefaultlocale() is NOT a Russian locale (CIS country exclusion — typical Russian-aligned actor signature)
3. multiprocessing.cpu_count() > 4 (avoids low-spec analyst VMs)

The Ubuntu .zip variant adds a sentinel-file sandbox evasion: on first execution it creates /tmp/.transformers, calls sys.exit(1) (appears to be a crash), and only runs the payload on the second invocation when the marker file already exists. This defeats single-shot detonation in automated sandboxes.

CREDENTIAL HARVESTING

The collectors/ modules harvest:
- Cloud: AWS Secrets Manager + SSM Parameter Store (via the embedded SigV4 signer), Azure Key Vault, GCP Secret Manager
- Kubernetes: secrets across all namespaces (kubectl + in-cluster service-account tokens)
- Filesystem: ~/.ssh/* private keys, ~/.aws/credentials, ~/.kube/config, browser-stored cookies and tokens
- Password managers: 1Password (op CLI), Bitwarden (bw CLI), gopass, pass
- Developer tokens: GitHub PATs from ~/.config/gh/, ~/.npmrc, ~/.pypirc

PERSISTENCE

A base64-encoded blob inside entrypoint.py is decoded to pgmonitor.py (PostgreSQL-monitor masquerade, MITRE T1036.005) and installed as systemd unit /etc/systemd/system/pgsql-monitor.service (root) or ~/.config/systemd/user/pgsql-monitor.service (user fallback). Service starts on next boot and re-harvests every 6 hours.

EXFILTRATION (TIERED C2)

1. Primary: HTTPS POST to 83.142.209.194/v1/weights with AES-encrypted-and-RSA-signed JSON payload (MITRE T1041, T1071.001)
2. Dead-drop resolver: polls a hard-coded list of GitHub repos for commits whose messages match the pattern 'FIRESCALE <base64url>.<base64sig>' — base64url decodes to a fresh C2 IP/host signed with the operator's RSA-4096 public key embedded in utilities/crypto.py
3. Last-resort: creates a NEW PUBLIC GitHub repository under the victim's own credentials with a randomized Slavic-mythology name (e.g. 'leshy-archive-9314', 'rusalka-blob-2261') and uploads results.json there

DESTRUCTIVE COMPONENT

roulette.py geo-fences on public-IP geolocation: if the host resolves to Israel (IL) or Iran (IR), with 1-in-6 (~16.7%) random probability, the payload plays a loud audio file via paplay/aplay and executes 'rm -rf /' (the original Cemu variant — ineffective on modern Linux due to the default --preserve-root). Updated mistralai variants observed in the wild use 'rm -rf /*' which IS effective.

ATTRIBUTION

TeamPCP publicly claimed the operation via the C2 server at 83.142.209.194 itself (a banner response). Datadog Security Labs states it is 'not in a position to assess the credibility of that claim.' Confidence in shared-actor attribution between the Cemu compromise and TL-2026-0499 (TanStack/Mistral) is HIGH based on byte-identical payload SHA256, shared C2 IP, identical dead-drop algorithm, and identical Slavic-mythology repo-naming convention.

IMPACT

Approximately 21,854 confirmed downloads of backdoored Cemu Linux assets (19,897 AppImage + 1,957 Ubuntu zip) before takedown. Cemu's user base skews toward end-user gamers rather than developers, expanding the campaign's blast radius beyond the typical npm/PyPI developer audience: any Linux user who ran the AppImage in a non-Russian locale on a >4-core CPU is potentially compromised across cloud, SSH, password-manager, and Kubernetes credential stores.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1195.002 Compromise Software Supply Chain
- T1199 Trusted Relationship
- T1078.004 Valid Accounts: Cloud Accounts
- T1586.001 Compromise Accounts: Social Media Accounts
- T1583.004 Acquire Infrastructure: Server
- T1608.001 Stage Capabilities: Upload Malware
- T1059.006 Command and Scripting Interpreter: Python
- T1204.002 User Execution: Malicious File
- T1543.002 Create or Modify System Process: Systemd Service
- T1480.001 Execution Guardrails: Environmental Keying
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1497.003 Time Based Checks
- T1027.004 Obfuscated Files or Information: Compile After Delivery
- T1140 Deobfuscate/Decode Files or Information
- T1555.005 Credentials from Password Stores: Password Managers
- T1552.001 Unsecured Credentials: Credentials In Files
- T1552.005 Unsecured Credentials: Cloud Instance Metadata API
- T1552.007 Unsecured Credentials: Container API
- T1528 Steal Application Access Token
- T1526 Cloud Service Discovery
- T1613 Container and Resource Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1530 Data from Cloud Storage
- T1071.001 Application Layer Protocol: Web Protocols
- T1102.001 Web Service: Dead Drop Resolver
- T1573.002 Encrypted Channel: Asymmetric Cryptography
- T1041 Exfiltration Over C2 Channel
- T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository
- T1485 Data Destruction
- T1561.001 Disk Wipe: Disk Content Wipe

## Sources

- [Backdoored Cemu release linked to TanStack and Mistral supply chain campaign](https://securitylabs.datadoghq.com/articles/backdoored-cemu-release-teampcp-supply-chain-campaign/)
- [TL-2026-0499 — Mini Shai-Hulud v3 TanStack/UiPath/Mistral npm & PyPI Supply Chain Compromise](https://intel.threadlinqs.com/threat/TL-2026-0499)
- [cemu-project/Cemu v2.6 release page (GitHub)](https://github.com/cemu-project/Cemu/releases/tag/v2.6)
- [Datadog Security Labs threat intelligence index](https://securitylabs.datadoghq.com/threat-intelligence/)
- [AppImage format documentation — SquashFS payload structure](https://docs.appimage.org/packaging-guide/manual.html)
- [MITRE ATT&CK T1195.002 Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)
- [GitHub Security Lab — guidance on release-asset integrity](https://securitylab.github.com/research/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0515