S9041: TeamPCP Cloud Stealer
The TeamPCP Cloud Stealer is a comprehensive filesystem credential stealer that can harvest, encrypt, and exfiltrate credentials from over 50 sensitive file paths across CI/CD, cloud, developer tooling, and container environments. The TeamPCP Cloud Stealer was the primary payload used by TeamPCP in March 2026 during early stages of a cascading supply chain campaign targeting CI/CD workflows.[1][2][3][4][5][6][7][8]
Security context for executives and security teams
S9041: TeamPCP Cloud Stealer describes The [TeamPCP Cloud Stealer](https://attack.mitre.org/software/S9041) is a comprehensive filesystem credential stealer that can harvest, encrypt, and exfiltrate credentials from over 50 sensitive file paths across CI/CD, cloud, developer tooling, and container environments. The [TeamPCP Cloud Stealer](https://attack.mitre.org/software/S9041) was the primary payload used by [TeamPCP](https://attack.mitre.org/groups/G1056) in March 2026 during early stages of a cascading supply chain campaign targeting CI/CD workflows...
Executive priority
S9041: TeamPCP Cloud Stealer is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate S9041: TeamPCP Cloud Stealer by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Containers, Linux, macOS, SaaS), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
- Cloud control-plane, SaaS audit, and container platform logs
- Network, endpoint, and security-tool telemetry
Detection direction
- Validate whether S9041: TeamPCP Cloud Stealer appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
TeamPCP Cloud Stealer
The TeamPCP Cloud Stealer is a comprehensive filesystem credential stealer that can harvest, encrypt, and exfiltrate credentials from over 50 sensitive file paths across CI/CD, cloud, developer tooling, and container environments. The TeamPCP Cloud Stealer was the primary payload used by TeamPCP in March 2026 during early stages of a cascading supply chain campaign targeting CI/CD workflows.[1][2][3][4][5][6][7][8]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1020 | Automated Exfiltration | TeamPCP Cloud Stealer can compress and encrypt data and exfiltrate it via POST to scan.aquasecurtiy[.]org. If that method fails it attempts to use a stolen GITHUB_TOKEN to create a repo and exfiltrate the data there.[1] |
| Enterprise | T1548.003 | Sudo and Sudo CachingSub-technique | TeamPCP Cloud Stealer can use `sudo` for code execution.[3] |
| Enterprise | T1140 | Deobfuscate/Decode Files or Information | TeamPCP Cloud Stealer can deobfuscate an encoded Python script prior to execution.[3] |
| Enterprise | T1552.003 | Shell HistorySub-technique | TeamPCP Cloud Stealer can target credentials in shell history on self-hosted runners.[3] |
| Enterprise | T1119 | Automated Collection | TeamPCP Cloud Stealer can identify and collect credentials across over 50 file paths in Cloud, CI/CD, developer tooling, and container enviornments.[1][3] |
| Enterprise | T1657 | Financial Theft | TeamPCP Cloud Stealer can search filesystems for cryptocurrency wallets such as Bitcoin, Litecoin, Dogecoin, Zcash, Dash, Ripple, and Monero.[1][2][3] |
| Enterprise | T1213.003 | Code RepositoriesSub-technique | TeamPCP Cloud Stealer can target sensitive file paths in Git repos to extract credentials.[1][3] |
| Enterprise | T1033 | System Owner/User Discovery | TeamPCP Cloud Stealer can use `whoami` on self-hosted runners to identify the current user.[3] |
| Enterprise | T1016 | System Network Configuration Discovery | TeamPCP Cloud Stealer has the ability to enumerate network interfaces.[1][3] |
| Enterprise | T1213.006 | DatabasesSub-technique | TeamPCP Cloud Stealer can extract credentials from multiple database configuration files including ~/.pgpass, ~/.my.cnf, ~/.mongorc.js, and /etc/mysql/my.cnf.[3] |
| Enterprise | T1609 | Container Administration Command | TeamPCP Cloud Stealer can use `kubectl get secrets` to extract credentials from Kubernetes.[3] |
| Enterprise | T1070.004 | File DeletionSub-technique | TeamPCP Cloud Stealer has the ability to remove all staged files after exfiltration.[3] |
| Enterprise | T1049 | System Network Connections Discovery | TeamPCP Cloud Stealer can search compromised systems for webhook URLs connecting to Slack and Discord.[4] |
| Enterprise | T1041 | Exfiltration Over C2 Channel | TeamPCP Cloud Stealer has exfiltrated collected data to typosquat C2 domains including scan.aquasecurtiy[.]org.[1][3][4][5] |
| Enterprise | T1526 | Cloud Service Discovery | TeamPCP Cloud Stealer can search GitHub for Actions runner processes.[3][2][1][5] |
| Enterprise | T1580 | Cloud Infrastructure Discovery | TeamPCP Cloud Stealer has the ability to search for generic GitHub runners.[5] |
| Enterprise | T1057 | Process Discovery | TeamPCP Cloud Stealer can locate GitHub Actions runner processes.[3][1][2][5] |
| Enterprise | T1083 | File and Directory Discovery | TeamPCP Cloud Stealer can identify files containing environment variables, SSH keys, cloud credentials, access tokens, and cryptocurrency wallets.[1][2][3][5] |
| Enterprise | T1573.001 | Symmetric CryptographySub-technique | TeamPCP Cloud Stealer has encrypted collected data using a hybrid AES-256 and RSA-4096 encryption prior to exfiltration over 'curl`.[1][2][4][5] |
| Enterprise | T1573.002 | Asymmetric CryptographySub-technique | TeamPCP Cloud Stealer has encrypted collected data using a hybrid RSA-4096 and AES-256-encryption prior to exfiltration over 'curl`.[1][2][4][5] |
| Enterprise | T1560.001 | Archive via UtilitySub-technique | TeamPCP Cloud Stealer has bundled collected data into a file named tpcp.tar.gz for exfiltration.[1][3][4][5] |
| Enterprise | T1564.001 | Hidden Files and DirectoriesSub-technique | TeamPCP Cloud Stealer can create a hidden directory in the user's home folder on Linux hosts to write a python backdoor.[5] |
| Enterprise | T1543.002 | Systemd ServiceSub-technique | TeamPCP Cloud Stealer can create a systemd unit to execute a python script for persistence.[1][3][5] |
| Enterprise | T1036.005 | Match Legitimate Resource Name or LocationSub-technique | TeamPCP Cloud Stealer has installed a backdoor named sysmon.py on targeted systems.[5] |
| Enterprise | T1003.007 | Proc FilesystemSub-technique | |
| Enterprise | T1552.007 | Container APISub-technique | TeamPCP Cloud Stealer can query the Kubernetes API for credentials.[5][6] |
| Enterprise | T1105 | Ingress Tool Transfer | TeamPCP Cloud Stealer has the ability to download additional payloads to targeted systems.[1][3][5][6] |
| Enterprise | T1546.016 | Installer PackagesSub-technique | TeamPCP Cloud Stealer can inject malicious pre or post-install scripts within package.json for payload execution.[6] |
| Enterprise | T1567.001 | Exfiltration to Code RepositorySub-technique | |
| Enterprise | T1059.007 | JavaScriptSub-technique | TeamPCP Cloud Stealer has infected victims through malicious pre and post-install scripts within the package.json file.[6] |
| Enterprise | T1027.013 | Encrypted/Encoded FileSub-technique | TeamPCP Cloud Stealer has used multi-stage payloads with double Base64-encoded scripts to evade static analysis.[1][2][6] |
| Enterprise | T1071.001 | Web ProtocolsSub-technique | TeamPCP Cloud Stealer has used `curl` to upload stolen data to attacker controlled domains.[4][5][6] |
| Enterprise | T1546.018 | Python Startup HooksSub-technique | TeamPCP Cloud Stealer has used .pth files to establish persistence on compromised hosts due to the Python interpreter's automatic processing of .pth files at startup.[6] |
| Enterprise | T1528 | Steal Application Access Token | |
| Enterprise | T1555 | Credentials from Password Stores | TeamPCP Cloud Stealer can harvest credentials from cryptocurrency wallets and keystores such as Ethereum keystores, Cardano keys, Solana validator keypairs, Ledger device files, and Anchor deploy keys.[2][3][8] |
| Enterprise | T1059.006 | PythonSub-technique | |
| Enterprise | T1613 | Container and Resource Discovery | TeamPCP Cloud Stealer can identify Docker and Kubernetes environments for credentials.[3][5] |
| Enterprise | T1518 | Software Discovery | TeamPCP Cloud Stealer has searched for cryptocurrency wallets on targeted hosts.[1][2] |
| Enterprise | T1008 | Fallback Channels | |
| Enterprise | T1555.006 | Cloud Secrets Management StoresSub-technique | |
| Enterprise | T1059.004 | Unix ShellSub-technique | TeamPCP Cloud Stealer has abused the shell script files entrypoint.sh (in trivy-action) and setup.sh (in ast-github-action/2.3.28) for discovery and credential harvesting.[4] [6] |
| Enterprise | T1552.001 | Credentials In FilesSub-technique | |
| Enterprise | T1480 | Execution Guardrails | TeamPCP Cloud Stealer has checked if it is running on a developer machine (rather than GitHub Actions) before executing a Python script for persistence. The script has also polled C2 every 50 minutes for additional payloads and aborted if the returned value contained YouTube.[3][5] |
| Enterprise | T1082 | System Information Discovery | TeamPCP Cloud Stealer has detected if it is on a developer machine by checking if the environmental variable GITHUB_ACTIONS != “true”.[1] TeamPCP Cloud Stealer has also identified readable memory regions on CI/CD runners and enumerated system information using `hostname` and `uname-a`.[3] |
| Enterprise | T1552.004 | Private KeysSub-technique | TeamPCP Cloud Stealer has searched victim hosts for TLS and SSH keys.[1][2][3][5] |
| Enterprise | T1074.001 | Local Data StagingSub-technique | TeamPCP Cloud Stealer has created a staging file in `/tmp` for collected data.[5] |
| Enterprise | T1678 | Delay Execution | TeamPCP Cloud Stealer has leveraged a persistence script that will sleep for five minutes before additional execution.[1][3][5] |
Groups, software, and campaigns
G1056: TeamPCP
TeamPCP is a financially-motivated, cloud-native threat group that has been active since at least September 2025. Initially focused on ransomware and cryptocurrency theft, TeamPCP shifted in early 2026 to systematic, worm-driven credential theft and software supply chain attacks targeting Continuous Integration and Continuous Delivery (CI/CD) workflows. TeamPCP has monetized access through extortion and through partnerships with ransomware actors including Vect and CipherForce.[1][2][3][4][5][6]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(2)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 20.0 | 1.0 | Older bundle | 9585ddab3960… | ||
| 19.2 | 1.0 | Current bundle | 9585ddab3960… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Wiz Trivy Compromise MAR 2026
McCarthy, R. (2026, March 20). Trivy Compromised: Everything You Need to Know about the Latest Supply Chain Attack. Retrieved July 1, 2026.
Open source URL - [2]Aqua Security Trivy Compromise MAR 2026
Aqua Security . (2026, March 21). Trivy ecosystem supply chain temporarily compromised. Retrieved July 1, 2026.
Open source URL - [3]Aqua Security Blog Trivy Compromise APR 2026
Aqua Team. (2026, April 1). Update: Ongoing Investigation and Continued Remediation. Retrieved July 1, 2026.
Open source URL - [4]Sysdig TeamPCP MAR 2026
Sysdig Threat Research Team. (2026, March 23). TeamPCP expands: Supply chain compromise spreads from Trivy to Checkmarx GitHub Actions. Retrieved July 1, 2026.
Open source URL - [5]Wiz TeamPCP KICS MAR 2026
McCarthy, R., Haughom, J., Read, B. (2026, March 23). KICS GitHub Action Compromised: TeamPCP Strikes Again in Supply Chain Attack. Retrieved July 1, 2026.
Open source URL - [6]Palo Alto TeamPCP MAR 2026
Unit 42. (2026, March 31). Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure. Retrieved July 1, 2026.
Open source URL - [7]Google AI Threat Tracker MAY 2026
Google Threat Intelligence Group. (2026, May 11). GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access. Retrieved July 7, 2026.
Open source URL - [8]FBI TeamPCP JUL 2026
FBI. (2026, July 2). Cyber Criminal Group TeamPCP. Retrieved July 7, 2026.
Open source URL - [9]SANDCLOCK
(Citation: Google AI Threat Tracker MAY 2026)(Citation: FBI TeamPCP JUL 2026)
- [10]mitre-attackS9041Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.