CVE Intelligence
Home / Threat actors / TeamPCP

TeamPCP G1056

🔔 Create alert

Also known as: PCPCat, ShellForce, DeadCatx3, SHADOW-WATER-058, UNC6780

Updated at source on Sep 2, 2026 · View on MITRE ATT&CK

2
associated CVEs
47
Techniques
3
Malware and tools

TeamPCP is a financially-motivated, cloud-native threat group that has been active since at least September 2025. Initially focused on ransomware and cryptocurrency theft, TeamPCP shifted in early 2026 to systematic, worm-driven credential theft and software supply chain attacks targeting Continuous Integration and Continuous Delivery (CI/CD) workflows. TeamPCP has monetized access through extortion and through partnerships with ransomware actors including Vect and CipherForce.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2026-33634 High · 8.8 KEV Aquasecurity Trivy Embedded Malicious Code Vulnerability
“TeamPCP has exploited misconfigurations in GitHub Actions and vulnerabilities such as CVE-2026-33634 in the Aqua Security Trivy scanner and CVE-2025-55182 (React2Shell) against vulnerable cloud endpoints.”
CVE-2025-55182 Critical · 10.0 KEV Ransomware Meta React Server Components Remote Code Execution Vulnerability
“TeamPCP has exploited misconfigurations in GitHub Actions and vulnerabilities such as CVE-2026-33634 in the Aqua Security Trivy scanner and CVE-2025-55182 (React2Shell) against vulnerable cloud endpoints.”

Techniques by tactic

Resource Development
T1583 Acquire InfrastructureT1583.001 DomainsT1583.004 ServerT1583.006 Web ServicesT1585.001 Social Media AccountsT1587.001 MalwareT1608.001 Upload MalwareT1683.001 Written Content
Initial Access
T1078 Valid AccountsT1078.004 Cloud AccountsT1190 Exploit Public-Facing ApplicationT1195.001 Compromise Software Dependencies and Development Tools
Execution
T1059.004 Unix ShellT1059.006 PythonT1059.007 JavaScriptT1059.013 Container CLI/APIT1610 Deploy ContainerT1677 Poisoned Pipeline Execution
Persistence
T1078 Valid AccountsT1078.004 Cloud AccountsT1098 Account ManipulationT1176.002 IDE ExtensionsT1543.002 Systemd ServiceT1546.016 Installer PackagesT1547.001 Registry Run Keys / Startup Folder
Privilege Escalation
T1078 Valid AccountsT1078.004 Cloud AccountsT1098 Account ManipulationT1543.002 Systemd ServiceT1546.016 Installer PackagesT1547.001 Registry Run Keys / Startup Folder
Stealth
T1027.003 SteganographyT1036.005 Match Legitimate Resource Name or LocationT1078 Valid AccountsT1078.004 Cloud AccountsT1564.001 Hidden Files and DirectoriesT1684.001 Impersonation
Defense Impairment
T1553.002 Code Signing
Credential Access
T1528 Steal Application Access TokenT1552.004 Private KeysT1555.006 Cloud Secrets Management Stores
Lateral Movement
T1550.001 Application Access Token
Collection
T1005 Data from Local System
Command and Control
T1105 Ingress Tool Transfer
Impact
T1485 Data DestructionT1486 Data Encrypted for ImpactT1657 Financial Theft

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.