[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fh12bCRuyk7Jpfb2NYMu6oBYuucr52whcDlELLJMF57c":3},{"article":4,"iocs":55,"watch_terms":65,"solutions":66,"lesson":155},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"8f86cb4b-0997-4778-aa29-70b6c9eec3a7","TeamPCP Linked To Redis Attacks Dating Back To 2020 And Later Supply Chain Campaign","teampcp-linked-to-redis-attacks-dating-back-to-2020-and-later-supply-chain-campa-78779d","A new analysis has uncovered that the threat actor tracked as TeamPCP has been active on the cybercrime scene as far back as 2020, indicating the group has been compromising internet-facing infrastructure for years before training their sights on the software supply chain. \"The connection is supported by overlapping domains, malware deployment paths, staging techniques, backend infrastructure,","Analysis reveals the threat actor known as TeamPCP has been active since at least 2020, initially targeting internet-facing infrastructure like Redis servers. The group has since evolved to conduct sophisticated supply chain attacks, poisoning popular open-source libraries and leveraging GitHub Actions. Their malware arsenal includes a Python script that can deploy wiper functionality or backdoors, with specific destructive code paths observed targeting Iranian systems.","TeamPCP threat actor linked to Redis attacks since 2020 and supply chain compromises.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fteampcp-linked-to-redis-attacks-dating.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEicYXbdZUBG2jW8962nmphGWa0sWoq3jKe6HAT9wa6qlZdPPYBZRdw-uWjUbUv15BxaRgugcEAPXPZ2rMYx3RzM_vLVH18F6oTwwAklstzIRehnPJXwBs9b-d6NKjJZVhO5n1SRnBTlweRonaWCFogLrbJkyzs-F9K3lffy0tfqf2Vownwe9lj06rEe8Nn2\u002Fs1600\u002FTeamPCP.jpg","2026-08-07T06:50:05+00:00","2026-08-07T08:00:17.508893+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"TeamPCP","threat_actor",{"name":21,"type":22},"ShadowRay 2.0","campaign",{"name":24,"type":22},"IronErn",{"name":26,"type":22},"TA-NATALSTATUS",{"name":28,"type":22},"Operation PCPcat",{"name":30,"type":31},"Redis","product","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":54},{"id":32,"icon":34,"name":35,"slug":36},[56,59,62],{"type":52,"value":57,"context":58},"kube.py","Python script used after breaching Kubernetes environments, with wiper-like functionality in newer variants.",{"type":52,"value":60,"context":61},"Kamikaze","Wiper malware deployed on Kubernetes nodes configured for the Iran timezone.",{"type":52,"value":63,"context":64},"CanisterWorm","Backdoor deployed on non-Kubernetes Iranian systems.",[30],{"controls":67,"vendors":154},[68,97,125],{"slug":69,"name":70,"problem":71,"products":72},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[73,81,89],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":36,"name":98,"problem":99,"products":100},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"slug":126,"name":127,"problem":128,"products":129},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[130,138,146],{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":150,"product_name":151,"url":152,"description":153},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",[],{"slug":156,"title":157,"body":158,"framework_refs":159,"framework_notes":171},"teampcp-escalates-from-redis-exploits-to-supply-chain-poisoning","TeamPCP Escalates from Redis Exploits to Supply Chain Poisoning","TeamPCP demonstrates how threat actors evolve from opportunistic exploitation of exposed infrastructure—such as unauthenticated Redis servers—into sophisticated supply chain attackers capable of poisoning open-source libraries and abusing CI\u002FCD pipelines like GitHub Actions. The root failure spans multiple layers: internet-facing services left misconfigured or unpatched, insufficient vetting of third-party dependencies, and inadequate controls over automated build and deployment workflows. Their malware's wiper and backdoor capabilities underscore the destructive potential when supply chain compromises go undetected. This case matters because a single poisoned library or compromised GitHub Action can cascade across thousands of downstream projects and organizations simultaneously.",[160,161,162,163,164,165,166,167,168,169,170],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-161r1: Cybersecurity Supply Chain Risk Management","NIST CSF DE.CM-3: Personnel activity monitoring","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 CM-7: Least Functionality (restrict unnecessary services)","SLSA Supply Chain Levels for Software Artifacts (Framework)","OWASP Top 10 A06:2021 – Vulnerable and Outdated Components","OpenSSF Scorecard: CI\u002FCD pipeline security best practices",{}]