Recent research has revealed that the cybercriminal group known as TeamPCP has been active since at least 2020, targeting internet-facing infrastructures before shifting focus to software supply chain attacks. This connection is supported by overlapping domains, malware deployment paths, staging techniques, backend infrastructure, and operational tradecraft.
In the latter half of 2025, two significant campaigns were attributed to TeamPCP. The first, dubbed ShadowRay 2.0 (also known as IronErn), involved hijacking artificial intelligence (AI) infrastructures to create a self-propagating botnet. The second campaign, TA-NATALSTATUS, targeted exposed Redis servers to deploy cryptocurrency miners. This latter campaign appears to be an evolution of earlier activities observed in April 2020, where Redis servers were similarly compromised to deploy malware.
By the end of 2025, TeamPCP’s activities expanded to exploiting vulnerabilities in React Server Components (RSC) and Next.js frameworks. This operation, codenamed Operation PCPcat, aimed to extract credentials and sensitive data from compromised environments. In early 2026, the group launched a large-scale campaign targeting cloud-native environments to establish malicious infrastructures for subsequent exploitation. The objectives included building a distributed proxy and scanning infrastructure, exfiltrating data, deploying ransomware, conducting extortion, and mining cryptocurrency.
TeamPCP has also ventured into high-profile supply chain compromises. They have weaponized the interconnected nature of modern software by poisoning popular open-source libraries through GitHub Actions and token theft abuse. A notable operational link is the overlap between the IronErn GitHub and GitLab identities observed during ShadowRay 2.0 and TeamPCP’s later infrastructure. Correlating GitLab authentication logs, command-and-control infrastructure, reverse-shell activity, and malware staging establishes a direct operational bridge between the ShadowRay 2.0 campaign and the actor later operating publicly as TeamPCP.
These findings indicate that TeamPCP has consistently exploited known security flaws in technologies such as React, Docker, Redis, and Ray to gain access and employ automated, wormable exploitation techniques for self-propagation. Their expansion into cascading software supply chain attacks represents a natural evolution, allowing them to leverage legitimate cloud infrastructure and repurpose established methods in their operations.
Furthermore, TeamPCP has continuously updated its malware arsenal. A Python script named “kube.py” is specifically used after breaching Kubernetes environments. While earlier versions focused on propagation and establishing persistence, newer variants observed as recently as March 2026 have incorporated wiper-like functionality. This destructive code path checks if the victim system is configured for the Iran timezone and, if so, initiates a DaemonSet that wipes every node in the cluster via a wiper not-so-subtly named.
The evolution of TeamPCP’s tactics underscores the growing sophistication of cyber threats targeting both infrastructure and software supply chains. Organizations must remain vigilant, regularly update and patch systems, and implement robust security measures to defend against such multifaceted attacks.
