Automation · API / MCP 中文

Group profile · G1056

TeamPCP

TeamPCP is a financially-motivated, cloud-native threat group that has been active since at least September 2025. Initially focused on ransomware and cryptocurrency theft, TeamPCP shifted in early 2026 to systematic, worm-driven credential theft and software supply chain attacks targeting Continuous Integration and Continuous Delivery (CI/CD) workflows. TeamPCP has monetized access through extortion and through partnerships with ransomware actors including Vect and CipherForce.

ATT&CK G1056 Confidence High · 100 Source src_mitre_attck_enterprise Status active
All2026

TeamPCP is a financially-motivated, cloud-native threat group that has been active since at least September 2025. Initially focused on ransomware and cryptocurrency theft, TeamPCP shifted in early 2026 to systematic, worm-driven credential theft and software supply chain attacks targeting Continuous Integration and Continuous Delivery (CI/CD) workflows. TeamPCP has monetized access through extortion and through partnerships with ransomware actors including Vect and CipherForce.123456

  1. Wiz TeamPCP Profile MAY 2026
  2. Wiz Trivy Compromise MAR 2026
  3. Aqua Security Trivy Compromise MAR 2026
  4. Aqua Security Blog Trivy Compromise APR 2026
  5. Palo Alto TeamPCP MAR 2026
  6. Trend Micro TeamPCP MAY 2026

Claims and citations

Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.

predicateobjectValidConf.Evidence
also_known_asTeamPCP— → …100src_mitre_attck_enterprise
also_known_asPCPCat— → …100src_mitre_attck_enterprise
also_known_asShellForce— → …100src_mitre_attck_enterprise
also_known_asDeadCatx3— → …100src_mitre_attck_enterprise
also_known_asSHADOW-WATER-058— → …100src_mitre_attck_enterprise
also_known_asUNC6780— → …100src_mitre_attck_enterprise
uses_techniquetech_t1027.0032026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1036.0052026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1543.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1555.0062026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1583.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t15282026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0062026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1547.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1552.0042026 → …100src_mitre_attck_enterprise
uses_techniquetech_t11052026 → …100src_mitre_attck_enterprise
uses_techniquetech_t14862026 → …100src_mitre_attck_enterprise
uses_techniquetech_t11902026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10782026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1587.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1583.0062026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1195.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10982026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1550.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1684.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1078.0042026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1546.0162026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1564.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t14852026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1683.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1585.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0072026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1553.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10052026 → …100src_mitre_attck_enterprise
uses_techniquetech_t16572026 → …100src_mitre_attck_enterprise
uses_techniquetech_t16102026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0132026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0042026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1583.0042026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1608.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t16772026 → …100src_mitre_attck_enterprise
uses_techniquetech_t15832026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1176.0022026 → …100src_mitre_attck_enterprise

Technique use

ATT&CKTechniqueplatforms
T1005Data from Local System—
T1027.003Steganography—
T1036.005Match Legitimate Resource Name or Location—
T1059.004Unix Shell—
T1059.006Python—
T1059.007JavaScript—
T1059.013Container CLI/API—
T1078Valid Accounts—
T1078.004Cloud Accounts—
T1098Account Manipulation—
T1105Ingress Tool Transfer—
T1176.002IDE Extensions—
T1190Exploit Public-Facing Application—
T1195.001Compromise Software Dependencies and Development Tools—
T1485Data Destruction—
T1486Data Encrypted for Impact—
T1528Steal Application Access Token—
T1543.002Systemd Service—
T1546.016Installer Packages—
T1547.001Registry Run Keys / Startup Folder—
T1550.001Application Access Token—
T1552.004Private Keys—
T1553.002Code Signing—
T1555.006Cloud Secrets Management Stores—
T1564.001Hidden Files and Directories—
T1583Acquire Infrastructure—
T1583.001Domains—
T1583.004Server—
T1583.006Web Services—
T1585.001Social Media Accounts—
T1587.001Malware—
T1608.001Upload Malware—
T1610Deploy Container—
T1657Financial Theft—
T1677Poisoned Pipeline Execution—
T1683.001Written Content—
T1684.001Impersonation—

Aliases

DeadCatx3 · PCPCat · SHADOW-WATER-058 · ShellForce · TeamPCP · UNC6780

Reading and review

Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.

Corrections