Início / Grupos de ameaça / TeamPCP

TeamPCP G1056

🔔 Criar alerta

Também conhecido como: PCPCat, ShellForce, DeadCatx3, SHADOW-WATER-058, UNC6780

Atualizado na fonte em 02/09/2026 · Ver no MITRE ATT&CK

2

CVEs associadas

47

Técnicas

3

Malwares e ferramentas

TeamPCP is a financially-motivated, cloud-native threat group that has been active since at least September 2025. Initially focused on ransomware and cryptocurrency theft, TeamPCP shifted in early 2026 to systematic, worm-driven credential theft and software supply chain attacks targeting Continuous Integration and Continuous Delivery (CI/CD) workflows. TeamPCP has monetized access through extortion and through partnerships with ransomware actors including Vect and CipherForce.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2026-33634 Alta · 8.8 KEV Aquasecurity Trivy Embedded Malicious Code Vulnerability

“TeamPCP has exploited misconfigurations in GitHub Actions and vulnerabilities such as CVE-2026-33634 in the Aqua Security Trivy scanner and CVE-2025-55182 (React2Shell) against vulnerable cloud endpoints.”

CVE-2025-55182 Crítica · 10.0 KEV Ransomware Meta React Server Components Remote Code Execution Vulnerability

“TeamPCP has exploited misconfigurations in GitHub Actions and vulnerabilities such as CVE-2026-33634 in the Aqua Security Trivy scanner and CVE-2025-55182 (React2Shell) against vulnerable cloud endpoints.”

Técnicas por tática

Desenvolvimento de recursos

T1583 Acquire Infrastructure T1583.001 Domains T1583.004 Server T1583.006 Web Services T1585.001 Social Media Accounts T1587.001 Malware T1608.001 Upload Malware T1683.001 Written Content

Acesso inicial

T1078 Valid Accounts T1078.004 Cloud Accounts T1190 Exploit Public-Facing Application T1195.001 Compromise Software Dependencies and Development Tools

Execução

T1059.004 Unix Shell T1059.006 Python T1059.007 JavaScript T1059.013 Container CLI/API T1610 Deploy Container T1677 Poisoned Pipeline Execution

Persistência

T1078 Valid Accounts T1078.004 Cloud Accounts T1098 Account Manipulation T1176.002 IDE Extensions T1543.002 Systemd Service T1546.016 Installer Packages T1547.001 Registry Run Keys / Startup Folder

Escalada de privilégios

T1078 Valid Accounts T1078.004 Cloud Accounts T1098 Account Manipulation T1543.002 Systemd Service T1546.016 Installer Packages T1547.001 Registry Run Keys / Startup Folder

Furtividade

T1027.003 Steganography T1036.005 Match Legitimate Resource Name or Location T1078 Valid Accounts T1078.004 Cloud Accounts T1564.001 Hidden Files and Directories T1684.001 Impersonation

Comprometimento de defesas

T1553.002 Code Signing

Acesso a credenciais

T1528 Steal Application Access Token T1552.004 Private Keys T1555.006 Cloud Secrets Management Stores

Movimento lateral

T1550.001 Application Access Token

Coleta

T1005 Data from Local System

Comando e controle

T1105 Ingress Tool Transfer

Impacto

T1485 Data Destruction T1486 Data Encrypted for Impact T1657 Financial Theft

Malwares e ferramentas

CanisterWormMalwareS9042
Mini Shai-HuludMalwareS9043
TeamPCP Cloud StealerMalwareS9041

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.