The Vect and TeamPCP Alliance: Industrialized Supply Chain and Cloud-Native Ransomware Orchestration
The convergence of the Vect Ransomware-as-a-Service (RaaS) operation and the TeamPCP threat actor marks a strategic shift toward a vertically integrated cybercrime model. Vect provides high-volume initial access and credential harvesting, while TeamPCP specializes in ransomware orchestration and the development of cloud-native worms. This alliance targets the software development lifecycle through industrialized supply chain compromises of CI/CD pipelines and developer tools. By leveraging stolen OAuth tokens and API keys, the actors facilitate lateral movement across AWS, Azure, and GCP environments. The campaign focuses on cloud-native extortion, utilizing exfiltration of S3 buckets and database snapshots to maximize leverage against enterprise targets.