XeniCore

Weaponising the Guards: Deconstructing TeamPCP’s Cascading CI/CD Supply Chain Campaign

Written by

luxovius

in

,

In late March 2026, the financially motivated cybercriminal group TeamPCP executed a five-day cascading supply chain operation that compromised three widely deployed developer security tools: Aqua Security’s Trivy, Checkmarx’s KICS, and BerriAI’s LiteLLM. By exploiting a pull_request_target misconfiguration and intercepting incomplete credential rotations, TeamPCP hijacked mutable GitHub version tags (@v2) and PyPI publishing tokens. The compromised tools—running with elevated permissions in thousands of enterprise CI/CD pipelines—were turned into automated credential-harvesting engines, exfiltrating over 300GB of secrets across more than 500,000 environments.

Threat Actor Profiling: TeamPCP (PCPcat)

  • Aliases: PCPcat, ShellForce, DeadCatx3, Persy_PCP
  • Motivation: Financial Extortion & Downstream Network Access
  • Target Infrastructure: Software build workflows, GitHub Actions, PyPI package registries, and multi-cloud CI/CD runners.

Initially documented in late 2025 as a cloud-native intrusion campaign targeting exposed Kubernetes clusters and container platforms, TeamPCP underwent a rapid evolution in early 2026. Recognizing that individual cloud breaches yield isolated access, the group shifted focus upstream to developer infrastructure.

By targeting security scanners—tools explicitly trusted with high-privilege access, cloud management keys, and build secrets—TeamPCP transitioned from an opportunistic threat group into a high-consequence supply chain threat capable of triggering systemic, cross-enterprise compromises.

Attack Chain Deconstruction & Cascade Mechanics

The core innovation of the TeamPCP campaign was its cascading execution model: credentials stolen from one victim’s CI/CD pipeline provided the exact authentication material required to compromise the next vendor in the sequence.

Phase 1: Initial Access via Incomplete Credential Rotation (T1190, T1078.004)

In late February 2026, TeamPCP exploited a pull_request_target workflow flaw (commonly known as a “PwnRequest” vulnerability) in the aquasecurity/trivy repository. When Aqua Security identified the intrusion and attempted to rotate credentials for the aqua-bot service account, the rotation window was not closed cleanly. TeamPCP intercepted the newly generated Personal Access Token (PAT) during the transition window, maintaining persistent administrative access disguised as legitimate service account activity.

Phase 2: Mutable Tag Hijacking & Dual-Execution Execution (T1195.002, T1036.005)

On March 19, 2026, TeamPCP used the stolen PAT to force-push malicious commits across 76 out of 77 version tags in aquasecurity/trivy-action and all tags in setup-trivy.

Because 96% of open-source CI/CD workflows pin dependencies to mutable tags (e.g., uses: aquasecurity/trivy-action@v0.34.0) rather than immutable commit SHAs, millions of automated build pipelines pulled the malicious commit instantly without triggering developer warnings.

To avoid manual detection, TeamPCP implemented a dual-execution execution wrapper: the injected payload executed the malicious infostealer first, while simultaneously invoking the legitimate Trivy binary. Pipeline logs showed clean scanning results, masking the active breach.

Phase 3: Memory Scraping & Cloud IMDS Harvesting (T1059.004, T1552.001)

When executed inside a victim’s CI/CD runner environment, the TeamPCP payload executed a comprehensive credential sweep:

  1. Memory Scraping (T1057): Scraped /proc/*/mem in Linux runners to extract decrypted secrets held in RAM, bypassing GitHub’s stdout log-masking mechanisms.
  2. Cloud Metadata Querying (T1552.005): Queried the AWS Instance Metadata Service (IMDS) at 169.254.169.254 to harvest temporary IAM role credentials attached to build instances.
  3. Secrets Directory Sweep (T1552.001): Parsed over 50 specific file paths, including .env, .aws/credentials, .kube/config, SSH keys, and GPG keys.

Phase 4: Covert Exfiltration & Typosquatted C2 (T1071.001, T1567.002)

Stolen credentials were packaged into an AES-256 and RSA-4096 encrypted archive (tpcp.tar.gz) and exfiltrated to vendor-themed typosquatted C2 domains, such as scan.aquasecurtiy[.]org (note the tiy transposition) and checkmarx[.]zone.

If network egress controls blocked the primary C2 domain, the payload deployed a fallback mechanism: using the victim and committed the encrypted secrets payload to it (T1567.002).

Phase 5: Downstream Cascade to KICS and LiteLLM (T1195.001)

  • Checkmarx KICS Compromise: Among the credentials harvested from Trivy pipeline runs were GitHub PATs belonging to Checkmarx maintainers. On March 23, TeamPCP used these tokens to force-push malicious code to all 35 version tags of checkmarx/kics-github-action.
  • LiteLLM PyPI Poisoning: Credential harvesting from affected pipelines also yielded PyPI publishing tokens for LiteLLM (an AI gateway library with millions of downloads). On March 24, TeamPCP uploaded poisoned releases (v1.82.7 and v1.82.8) directly to PyPI. These releases leveraged Python .pth files to execute the infostealer on host initialization (T1546.012), even if the LiteLLM library was never explicitly imported.

Intelligence Take: “So What?”

The TeamPCP campaign represents the logical conclusion of open execution models within CI/CD pipelines. It exposes three fundamental security fallacies in modern software engineering:

  1. The Fallacy of Mutable Trust (@v2): Version tags are merely pointers. Assuming that uses: action@v2 remains secure over time relies entirely on the assumption that the upstream maintainer’s account will never be compromised.
  2. Unbounded Privilege in Pipeline Security Tools: Security scanners require elevated access to source code, cloud registries, and deployment keys to perform their audits. When a security tool is compromised, the attacker inherits those elevated permissions without needing to bypass enterprise security perimeters.
  3. Flawed Credential Isolation: In standard runner environments, all processes execute in a flat memory space. Secret masking in build logs offers zero protection against payloads capable of reading /proc/*/mem or querying local IMDS endpoints.

Forecast & Key Indicators

Predictive Assessment

  • We assess with high confidence threat actors will increasingly target third-party GitHub Actions and build plugins over software source code directly to achieve broad, automated credential harvesting.
  • It is highly likely that extortion demands leveraging exfiltrated cloud secrets and API keys stolen during the TeamPCP campaign will continue to surface throughout the remainder of 2026.

Key Indicators of Compromise (IoCs)

C2 Domains & Infrastructure

  • scan.aquasecurtiy[.]org
  • checkmarx[.]zone
  • models.litellm[.]cloud
  • Backup C2 Endpoint: tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0[.]io

Exfiltration Artifacts

  • Presence of GitHub repositories named tpcp-docs, docs-tpcp, or tpcp-archive created within your GitHub organization (T1567.002).
  • Outbound POST requests containing encrypted payload archives named tpcp.tar.gz.

Actionable Defense & Mitigation Strategy

If your organization utilized aquasecurity/trivy-action, checkmarx/kics-github-action, or litellm (v1.82.7–v1.82.8) between March 19 and March 25, 2026, assume your build environment secrets have been compromised.

Strategic Architecture

  • Enforce SHA Pinning for All Actions (T1195.002): Ban the use of mutable version tags in CI/CD workflows. Require all third-party GitHub Actions to be pinned to full 40-character commit SHAs.
  • Migrate to Ephemeral OpenID Connect (OIDC) Authentication: Eliminate long-lived AWS/GCP static access keys stored in repository secrets (T1552.001). Enforce short-lived OIDC role assumption that limits credential validity to the exact duration of the build step.

Tactical Controls

  • Enforce IMDSv2 and Restrict Runner Access: Enforce Instance Metadata Service Version 2 (IMDSv2) with a hop limit of 1 on build instances to prevent containerized runner processes from requesting cloud session tokens (T1552.005).
  • Implement Strict Egress Filtering on Runners: Restrict CI/CD runner outbound network access to explicitly approved package registries and vendor APIs. Block traffic to unapproved external endpoints to prevent exfiltration.
  • Audit GitHub Organization Repositories: Run automated scripts across your GitHub organization to search for unauthorized private repositories created with the prefix tpcp- or docs-.

References & Operational Sources

More posts