自动化接入 · API / MCP EN

组织档案 · G1056

TeamPCP

TeamPCP is a financially-motivated, cloud-native threat group that has been active since at least September 2025. Initially focused on ransomware and cryptocurrency theft, TeamPCP shifted in early 2026 to systematic, worm-driven credential theft and software supply chain attacks targeting Continuous Integration and Continuous Delivery (CI/CD) workflows. TeamPCP has monetized access through extortion and through partnerships with ransomware actors including Vect and CipherForce.

ATT&CK G1056 置信带 高 · 100 来源 src_mitre_attck_enterprise 状态 active
全部2026

当前只显示 2026 年的引用；分面页不参与索引，canonical 归组织档案。

TeamPCP is a financially-motivated, cloud-native threat group that has been active since at least September 2025. Initially focused on ransomware and cryptocurrency theft, TeamPCP shifted in early 2026 to systematic, worm-driven credential theft and software supply chain attacks targeting Continuous Integration and Continuous Delivery (CI/CD) workflows. TeamPCP has monetized access through extortion and through partnerships with ransomware actors including Vect and CipherForce.123456

  1. Wiz TeamPCP Profile MAY 2026
  2. Wiz Trivy Compromise MAR 2026
  3. Aqua Security Trivy Compromise MAR 2026
  4. Aqua Security Blog Trivy Compromise APR 2026
  5. Palo Alto TeamPCP MAR 2026
  6. Trend Micro TeamPCP MAY 2026

断言与引用

每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。

predicateobject有效期置信证据
uses_techniquetech_t1027.0032026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1036.0052026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1543.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1555.0062026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1583.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t15282026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0062026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1547.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1552.0042026 → …100src_mitre_attck_enterprise
uses_techniquetech_t11052026 → …100src_mitre_attck_enterprise
uses_techniquetech_t14862026 → …100src_mitre_attck_enterprise
uses_techniquetech_t11902026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10782026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1587.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1583.0062026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1195.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10982026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1550.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1684.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1078.0042026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1546.0162026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1564.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t14852026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1683.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1585.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0072026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1553.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10052026 → …100src_mitre_attck_enterprise
uses_techniquetech_t16572026 → …100src_mitre_attck_enterprise
uses_techniquetech_t16102026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0132026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0042026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1583.0042026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1608.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t16772026 → …100src_mitre_attck_enterprise
uses_techniquetech_t15832026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1176.0022026 → …100src_mitre_attck_enterprise

技术使用

ATT&CK技术platforms
T1005Data from Local System—
T1027.003Steganography—
T1036.005Match Legitimate Resource Name or Location—
T1059.004Unix Shell—
T1059.006Python—
T1059.007JavaScript—
T1059.013Container CLI/API—
T1078Valid Accounts—
T1078.004Cloud Accounts—
T1098Account Manipulation—
T1105Ingress Tool Transfer—
T1176.002IDE Extensions—
T1190Exploit Public-Facing Application—
T1195.001Compromise Software Dependencies and Development Tools—
T1485Data Destruction—
T1486Data Encrypted for Impact—
T1528Steal Application Access Token—
T1543.002Systemd Service—
T1546.016Installer Packages—
T1547.001Registry Run Keys / Startup Folder—
T1550.001Application Access Token—
T1552.004Private Keys—
T1553.002Code Signing—
T1555.006Cloud Secrets Management Stores—
T1564.001Hidden Files and Directories—
T1583Acquire Infrastructure—
T1583.001Domains—
T1583.004Server—
T1583.006Web Services—
T1585.001Social Media Accounts—
T1587.001Malware—
T1608.001Upload Malware—
T1610Deploy Container—
T1657Financial Theft—
T1677Poisoned Pipeline Execution—
T1683.001Written Content—
T1684.001Impersonation—

别名

DeadCatx3 · PCPCat · SHADOW-WATER-058 · ShellForce · TeamPCP · UNC6780

读取与复核

记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。

纠错