What other aliases and vendor names is TeamPCP known by?

TeamPCP is tracked across the cybersecurity industry by multiple aliases, including: Altered Spider, CanisterWorm, CipherForce, DeadCatx3, G1056, PCPcat, Persy_PCP, SHADOW-WATER-058.

TeamPCP

Q: What are the primary motivations and sponsors of TeamPCP?

TeamPCP operates from Russia/CIS with primary motivation categorized as financial (extortion, ransomware, and sale of exfiltrated intellectual property), sponsored or affiliated with criminal organization.

ACTIVE CAMPAIGN TRACKED ⚠ Critical Threat Russia/CIS

Primary Aliases: Altered Spider UNC6780 CanisterWorm CipherForce

Sponsor / State Affiliation criminal organization

Primary Motivation financial (extortion, ransomware, and sale of exfiltrated intellectual property)

Active Timeline Unknown – Present

Confidence Rating 95% (Grounded)

Shai-Hulud / Mini Shai-Hulud, Trivy/LiteLLM Cascade, Grafana Labs GitHub Breach

⚔️ Weaponized CVE Matrix (0)

No specific weaponized CVEs currently mapped in the public baseline.

🎯 Target Sectors & Focus

Software Development Ecosystems (npm, PyPI, Docker Hub, Packagist) AI/ML Tooling (e.g., LiteLLM, Mistral AI, Guardrails AI) Cybersecurity Tooling (e.g., Trivy, Checkmarx) Cloud-Native Infrastructure (Kubernetes, Docker APIs, Ray dashboards, Redis) CI/CD Pipelines and GitHub Repositories