Attack Chain

1. Initial Access & Vulnerability Exploitation: TeamPCP gains initial access by exploiting critical public-facing application vulnerabilities (e.g., React2Shell, CVE-2025-55182) or compromising developer credentials through social engineering or other means, targeting supply chain components like development systems (e.g., Trivy's infrastructure) or CI/CD pipelines (e.g., LiteLLM, Telnyx).
2. Supply Chain Poisoning & Malicious Delivery: Attackers inject malicious code into legitimate software updates (e.g., poisoned Trivy scanner, Checkmarx GitHub Actions, malicious PyPI packages for LiteLLM and Telnyx Python SDK) and publish them to official channels (e.g., GitHub, OpenVSX marketplace, PyPI).
3. Credential Harvesting & Data Collection: When victims install the poisoned software, embedded payloads silently execute, harvesting sensitive information including passwords, cloud credentials, and other secrets from the compromised systems. Some payloads use novel techniques like WAV audio steganography.
4. Lateral Movement & Persistence: Stolen credentials are used to spread self-propagating worms (e.g., CanisterWorm) across interconnected software packages or leverage Kubernetes-oriented lateral movement logic. Malicious packages may also establish persistence by triggering automatically on Python interpreter startup.
5. Command and Control (C2) & Exfiltration: Harvested data is transmitted to attacker-controlled servers, often leveraging unusual outbound network activity (e.g., via port 666), or exfiltrated to hidden repositories within the victim's compromised cloud accounts (e.g., private GitHub repositories).
6. Ransomware Deployment & Extortion: The access facilitated by TeamPCP's operations is then utilized by Vect's ransomware-as-a-service infrastructure to deploy the Vect 2.0 ransomware payload. Victims face data encryption, and stolen data (source code, API keys, employee details) is used on data leak sites (e.g., Vect's, Lapsus$ group's) for extortion.

Impact

The partnership between Vect and TeamPCP has led to a significant increase in ransomware deployments and data theft incidents. Organizations in Canada, Serbia, South Korea, the UAE, and the United States, spanning technology, finance, healthcare, and government sectors, have been impacted. Successful attacks result in the encryption of critical systems, leading to operational disruption, and the exfiltration of highly sensitive data such as source code, API keys, database credentials, and employee details, which are subsequently used for extortion. The scale of the supply chain compromises means a single poisoned update can affect thousands of organizations, dramatically increasing the potential for widespread damage and financial loss.

Recommendation

• Patch CVE-2025-55182 immediately on all instances of React Server Components to prevent initial access.
• Deploy the Sigma rule Detect TeamPCP Outbound Port 666 to identify suspicious network connections indicative of TeamPCP C2 activity.
• Monitor outbound network connections for unusual ports like 666, especially from development or build environments, using network_connection logs.
• Implement software supply chain security practices to validate the integrity of third-party software updates and dependencies, especially from PyPI and GitHub.
• Review and audit permissions for GitHub Actions workflows and OpenVSX plugins, ensuring least privilege and monitoring for unauthorized modifications.
• Enable comprehensive logging for process creation and network activity to support the detection of malicious payloads harvesting credentials.