TeamPCP

ACTIVE CAMPAIGN TRACKED ▲ High Threat Russia/CIS

Primary Aliases: Altered Spider UNC6780 CanisterWorm CipherForce

Sponsor / State Affiliation criminal organization

Primary Motivation financial gain through ransomware extortion and sale of exfiltrated intellectual property

Confidence Rating 75% (Grounded)

Operation PCPcat 2024, Altered Spider Ransomware Wave Q3 2024

🎯 Target Sectors & Focus

Healthcare Education Manufacturing Financial Services Government

🛡️ MITRE ATT&CK® Attack Lifecycle (6 TTPs)

📥 Download Navigator JSON

Initial Access 1

T1566 Spearphishing with malicious attachments

Execution 1

T1059 Living‑off‑the‑land binaries (LOLBins) for lateral movement

Command & Control 2

T1071 Deployment of Cobalt Strike beacons

T1071 Data exfiltration via Rclone and MegaSync

Exfiltration & Impact 1

T1485 Double‑extortion ransomware (encrypt + threaten to leak)

Operational Techniques 1

T1000 Exploitation of ProxyShell (CVE‑2021‑31207, CVE‑2021‑34473, CVE‑2021‑34523)

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

[DEEP DIVE] TeamPCP: Open-Source Software Supply Chain Campaign

Attacks and Vulnerabilities 2026-08-29

[DEEP DIVE] The Vect and TeamPCP Alliance: Industrialized Supply Chain and Cloud-Native Ransomware Orchestration

Strategies and Tactics 2026-07-04

[DEEP DIVE] LiteLLM and PyTorch Lightning Supply Chain Attack

Attacks and Vulnerabilities 2026-08-13

[DEEP DIVE] Npm, Microsoft, and AI Coding Agents: Shai Hulud and Miasma Worm Supply Chain Campaigns

New Products/Tools 2026-07-07

[DEEP DIVE] Multi-Vector Supply Chain Campaign: Mastra AI, GitHub Actions, and Arch Linux AUR Compromise

Attacks and Vulnerabilities 2026-07-02

[DEEP DIVE] GitHub Investigating TeamPCP Claimed Breach of ~4,000 Internal Repositories

Attacks and Vulnerabilities

Copied to clipboard

LINK COPIED TO CLIPBOARD