{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata — refreshed continuously.","feed_url":"https://feed.craftedsignal.io/tags/teampcp/","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":["TeamPCP"],"_cs_cves":[],"_cs_exploited":false,"_cs_products":[],"_cs_severities":["critical"],"_cs_tags":["supply-chain","pypi","credential-theft","teampcp"],"_cs_type":"threat","_cs_vendors":[],"content_html":"\u003cp\u003eOn March 27, 2026, the \u003ccode\u003etelnyx\u003c/code\u003e Python package on PyPI was compromised by TeamPCP, resulting in the distribution of malicious versions 4.87.1 and 4.87.2. The attacker, having gained unauthorized access to PyPI credentials, bypassed the legitimate GitHub release pipeline to upload these compromised packages directly. These versions contain malware designed to harvest sensitive credentials from infected systems and exfiltrate them to a command-and-control (C2) server. The malicious packages were available for approximately 6 hours before being quarantined by PyPI. Version 4.87.1 contained a typo preventing execution, making 4.87.2 the fully functional malicious version. This incident highlights the risk of supply chain attacks targeting open-source package repositories, potentially affecting any system that installed the \u003ccode\u003etelnyx\u003c/code\u003e package during the exposure window.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker gains unauthorized access to PyPI credentials for the \u003ccode\u003etelnyx\u003c/code\u003e package.\u003c/li\u003e\n\u003cli\u003eThe attacker uploads malicious versions 4.87.1 and 4.87.2 of the \u003ccode\u003etelnyx\u003c/code\u003e package to PyPI, bypassing the legitimate GitHub repository.\u003c/li\u003e\n\u003cli\u003eWhen a user installs or upgrades to the malicious \u003ccode\u003etelnyx\u003c/code\u003e package, the injected malware within \u003ccode\u003etelnyx/_client.py\u003c/code\u003e executes upon importing the library (\u003ccode\u003eimport telnyx\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eOn Linux/macOS systems, the malware spawns a detached subprocess to ensure persistence and downloads a payload hidden inside a WAV audio file (\u003ccode\u003eringtone.wav\u003c/code\u003e) from the C2 server at \u003ccode\u003ehttp://83.142.209.203:8080/\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe downloaded payload harvests sensitive credentials, including SSH keys, AWS/GCP/Azure credentials, Kubernetes tokens, Docker configurations, .env files, database credentials, and crypto wallets.\u003c/li\u003e\n\u003cli\u003eIf Kubernetes access is detected, the malware deploys privileged pods to all nodes for lateral movement within the Kubernetes cluster.\u003c/li\u003e\n\u003cli\u003eThe collected data is encrypted using AES-256-CBC and RSA-4096, then exfiltrated to the C2 server, identified by the header \u003ccode\u003eX-Filename: tpcp.tar.gz\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eOn Windows, a binary payload hidden in \u003ccode\u003ehangup.wav\u003c/code\u003e is downloaded from \u003ccode\u003ehttp://83.142.209.203:8080/\u003c/code\u003e, dropped as \u003ccode\u003emsbuild.exe\u003c/code\u003e in the Startup folder for persistence, and executed with a hidden window, polling the endpoint \u003ccode\u003ehttp://83.142.209.203:8080/raw\u003c/code\u003e.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe compromise of the \u003ccode\u003etelnyx\u003c/code\u003e PyPI package poses a significant risk to developers and organizations that use the library.  Successful exploitation leads to the theft of sensitive credentials, potentially granting the attacker unauthorized access to critical infrastructure, cloud resources, and sensitive data. TeamPCP\u0026rsquo;s previous campaign against LiteLLM and the similarities in this attack suggest a pattern of targeting open-source projects to infiltrate developer environments and steal secrets.  The impact includes potential data breaches, financial losses, and reputational damage. The exposure window was approximately 6 hours during which vulnerable versions were available.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately check for the presence of malicious \u003ccode\u003etelnyx\u003c/code\u003e package versions (4.87.1 or 4.87.2) in your environment using the provided commands and uninstall them (\u003ccode\u003epip uninstall telnyx\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eDue to the credential-stealing nature of the malware, rotate all potentially exposed secrets, including SSH keys, cloud provider credentials (AWS, GCP, Azure), Kubernetes tokens, Docker registry credentials, database passwords, API keys in .env files, and Telnyx API keys.\u003c/li\u003e\n\u003cli\u003eCheck for persistence mechanisms used by the malware, specifically the \u003ccode\u003eaudiomon\u003c/code\u003e service and associated files on Linux/macOS, and the \u003ccode\u003emsbuild.exe\u003c/code\u003e executable in the Startup folder on Windows, based on the file paths provided in the \u0026ldquo;Filesystem\u0026rdquo; section.\u003c/li\u003e\n\u003cli\u003eBlock the identified C2 IP address (\u003ccode\u003e83.142.209.203\u003c/code\u003e) and payload URLs (\u003ccode\u003ehttp://83.142.209.203:8080/ringtone.wav\u003c/code\u003e, \u003ccode\u003ehttp://83.142.209.203:8080/hangup.wav\u003c/code\u003e, \u003ccode\u003ehttp://83.142.209.203:8080/raw\u003c/code\u003e) at your network perimeter.\u003c/li\u003e\n\u003cli\u003eDeploy the following Sigma rule to detect the creation of \u003ccode\u003emsbuild.exe\u003c/code\u003e in the Startup folder.\u003c/li\u003e\n\u003cli\u003ePin the \u003ccode\u003etelnyx\u003c/code\u003e package to the safe version 4.87.0 in your project dependencies to prevent future installations of compromised versions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-03-30T19:15:30Z","date_published":"2026-03-30T19:15:30Z","id":"/briefs/2026-03-telnyx-pypi-compromise/","summary":"A threat actor compromised the PyPI package `telnyx`, uploading malicious versions 4.87.1 and 4.87.2 containing credential-stealing malware that exfiltrates data to a C2 server.","title":"Compromised Telnyx PyPI Package Distributes Credential-Stealing Malware","url":"https://feed.craftedsignal.io/briefs/2026-03-telnyx-pypi-compromise/"},{"_cs_actors":["TeamPCP"],"_cs_cves":[],"_cs_exploited":false,"_cs_products":[],"_cs_severities":["critical"],"_cs_tags":["kubernetes","wiper","iran","canisterworm","teampcp","destructive-attack"],"_cs_type":"threat","_cs_vendors":[],"content_html":"\u003cp\u003eTeamPCP has deployed a Kubernetes wiper named CanisterWorm, specifically targeting Iranian infrastructure. This destructive malware is designed to obliterate data within Kubernetes environments. The wiper\u0026rsquo;s emergence in March 2026 signals a heightened level of cyber aggression, particularly given the geopolitical context. Defenders need to be aware of the potential for significant operational disruption and data loss. The targeting of Kubernetes environments reflects a sophisticated understanding of modern infrastructure and the increasing reliance on containerization technologies. This campaign requires immediate attention and proactive security measures to mitigate the risk of successful attacks.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial compromise of a node within the Kubernetes cluster, possibly via exploiting a known vulnerability or through compromised credentials.\u003c/li\u003e\n\u003cli\u003eCanisterWorm gains elevated privileges within the compromised node, potentially using techniques such as privilege escalation exploits.\u003c/li\u003e\n\u003cli\u003eDiscovery of other nodes and resources within the Kubernetes cluster through reconnaissance activities, leveraging the Kubernetes API.\u003c/li\u003e\n\u003cli\u003eLateral movement to other nodes using stolen credentials or by exploiting trust relationships between nodes.\u003c/li\u003e\n\u003cli\u003eExecution of CanisterWorm on each targeted node, initiating the data wiping process.\u003c/li\u003e\n\u003cli\u003eOverwriting critical system files and data volumes within the containers and pods.\u003c/li\u003e\n\u003cli\u003eCorruption of Kubernetes configuration files, leading to instability and potential cluster failure.\u003c/li\u003e\n\u003cli\u003eFinal stage involves the complete destruction of data within the Kubernetes environment, rendering the affected systems unusable.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful deployment of CanisterWorm results in widespread data loss and service disruption within the targeted Kubernetes environments. This can lead to significant financial losses, reputational damage, and operational downtime. Given the targeting of Iranian infrastructure, this attack has the potential to impact critical services and government operations. The complete destruction of data necessitates extensive recovery efforts and may result in permanent data loss if backups are not available or are also compromised.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor Kubernetes API server logs for suspicious activity, particularly attempts to list or access sensitive resources to detect reconnaissance (reference: Attack Chain step 3).\u003c/li\u003e\n\u003cli\u003eImplement network segmentation and strict access controls within the Kubernetes cluster to limit lateral movement (reference: Attack Chain step 4).\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetect Suspicious Kubernetes Pod Deletion\u003c/code\u003e to identify potential wipe attempts.\u003c/li\u003e\n\u003cli\u003eReview and harden Kubernetes security configurations, including RBAC (Role-Based Access Control) policies, to prevent unauthorized access (reference: Attack Chain step 2).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-03-23T12:00:00Z","date_published":"2026-03-23T12:00:00Z","id":"/briefs/2026-03-canisterworm-kubernetes-wiper/","summary":"TeamPCP's CanisterWorm is a newly identified Kubernetes wiper targeting Iranian infrastructure, indicating a politically motivated destructive attack.","title":"TeamPCP's CanisterWorm Kubernetes Wiper Targeting Iran","url":"https://feed.craftedsignal.io/briefs/2026-03-canisterworm-kubernetes-wiper/"}],"language":"en","title":"CraftedSignal Threat Feed — Teampcp","version":"https://jsonfeed.org/version/1.1"}