TeamPCP’s attack spree slows, but threat escalates with ransomware pivot

TeamPCP conducted a rapid, automated supply-chain campaign in March 2026 that compromised multiple vendor ecosystems (security scanners, AI tooling, and telecommunications SDKs), deployed novel malware (including a self-propagating CanisterWorm and destructive, geo‑targeted payloads), and harvested an estimated 300 GB of credentials; the actor has shifted to monetization via a partnership with the Vect RaaS group, which has already executed at least one confirmed ransomware deployment using TeamPCP-sourced credentials. The campaign affected hundreds of public CI/CD repositories and thousands of PyPI packages, used advanced TTPs (WAV steganography, .pth auto-execution, GitHub Releases API exfiltration), and prompted package registries to quarantine malicious releases.