Threat video1:00
TeamPCP Backdoors Cemu v2.6 GitHub Release Assets
Backdoored Cemu v2.6 Linux assets carried TeamPCP's Python payload. 9 detection rules, 24 IOCs, 32 ATT&CK techniques and a free Splunk SPL rule.
Read the full threat intel for TeamPCP Backdoors Cemu v2.6 GitHub Release Assets →
Chapters
- 0:00The hookBackdoored Cemu reached ~22,000 downloads.
- 0:04The storyGitHub credentials compromised, Linux replaced.
- 0:10Attack pathCompromised account, direct asset swap.
- 0:26AttributionAttributed to TeamPCP.
- 0:30Indicators of compromise16 indicators to hunt: 1 IP, 1 URL and 4 SHA-256 hashes, and more.
- 0:39MITRE ATT&CK techniques32 ATT&CK techniques, from resource development to impact.
- 0:43Remediation11 steps now: Re-download Cemu v2.6 ONLY from the post-takedown clean release.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Backdoored Cemu reached ~22,000 downloads.
0:05GitHub credentials compromised, Linux replaced.
0:08Mistral PyPI also backdoored
0:11Compromised account, direct asset swap.
0:14Twenty-two-thousand users downloaded backdoored binary.
0:17Harvested cloud, Kubernetes, SSH keys.
0:21Exfiltrated encrypted to TeamPCP C-two.
0:26Attributed to TeamPCP. Confidence: high.
0:3016 indicators to hunt: 1 IP, 1 URL and 4 SHA-256 hashes, and more.
0:3932 ATT&CK techniques, from resource development to impact.
0:4411 steps now: Re-download Cemu v2.6 ONLY from the post-takedown clean release.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.