TeamPCP Threat Actor Report

TeamPCP is a financially motivated cybercrime group that emerged in late 2025 and evolved from exploiting exposed cloud infrastructure to executing large-scale software supply-chain compromises in 2026. The campaign compromised trusted developer and security tools (including Trivy, Checkmarx KICS, LiteLLM gateway, Telnyx SDK) and delivery ecosystems (GitHub Actions, Docker Hub, npm, PyPI, OpenVSX), resulting in over 1,000 affected SaaS environments, approximately 500,000 compromised credentials, and more than 300 GB of exfiltrated data; the group used a chained compromise model to cascade access and has ties to multiple ransomware operations including a partnership with Vect and its own CipherForce brand.