TeamPCP Linked To Redis Attacks Dating Back To 2020 And Later Supply Chain Campaign

TeamPCP demonstrates how threat actors evolve from opportunistic exploitation of exposed infrastructure—such as unauthenticated Redis servers—into sophisticated supply chain attackers capable of poisoning open-source libraries and abusing CI/CD pipelines like GitHub Actions. The root failure spans multiple layers: internet-facing services left misconfigured or unpatched, insufficient vetting of third-party dependencies, and inadequate controls over automated build and deployment workflows. Their malware's wiper and backdoor capabilities underscore the destructive potential when supply chain compromises go undetected. This case matters because a single poisoned library or compromised GitHub Action can cascade across thousands of downstream projects and organizations simultaneously.