VECT and TeamPCP: The Ransomware Kill Chain, Reversed by Lucie Cardiet

Check Point and FBI reporting describe a large-scale supply-chain campaign (TeamPCP / Shai-Hulud) that backdoored popular open-source packages (including LiteLLM v1.82.8, Trivy, Checkmarx KICS, Telnyx SDK) in Feb–Mar 2026 to harvest CI/CD and cloud credentials; those credentials were then used by VECT ransomware affiliates in April–May 2026. VECT 2.0 contains a broken encryption implementation that permanently destroys files larger than 128 KB even if victims pay ransom. Organizations should assume pipeline/cloud tokens issued before April 2026 may be compromised, search for artifacts like litellm_init.pth and docs-tpcp repos, and rotate service account and registry credentials immediately.