Alert: TeamPCP exploits Telnyx services to deploy malware targeting cloud infrastructures. Ensure your APIs and services are secured. #CyberSecurity #CloudSecurity #TeamPCP #Telnyx Link: thedailytechfeed.com/teampcp-expl...

The LiteLLM Supply Chain Attack: How a Security Scanner Became a Backdoor On March 24, 2026, versions 1.82.7 and 1.82.8 of LiteLLM — with ~97 million monthly downloads — were found to contain a credential-stealing backdoor. Here's what happened, how it worked, and what you ...

The LiteLLM Supply Chain Attack: How a Security Scanner Became a Backdoor

techlife.blog/posts/litell...

#LiteLLM #SupplyChainAttack #PyPI #Security #Malware #Python #TeamPCP #AISecurity

TeamPCP & Vect Ransomware Target OSS

~Socket~
TeamPCP partnered with Vect ransomware to weaponize OSS supply chain compromises for enterprise attacks.
-
IOCs: TeamPCP, Vect
-
#Ransomware #SupplyChain #TeamPCP #threatintel

OSSPREY

Ossprey has detected a new wave of #TeamPCP malware embedded in #telnyx versions 4.87.1 and 4.87.2 on #PyPI.

Full analysis is on our blog.

If telnyx is in your dependency tree, check your installed version now.

ossprey.com/blog/telnyx-...

#SupplyChainSecurity #PyPI #OpenSource #Malware #AppSec

TeamPCPについて TeamPCPは2025年後半から活動が知られている脅威アクターです。最近ではTrivyのセキュリティインシデントから続くCheckmarx Github Actionsへのサプライチェーン攻撃やLiteLLMへのサプライチェーン攻撃で話題になっています。本記事では現時点（2026/03/27）で判明しているTeamPCPの情報等をまとめます。

ヒートウェーブのブログを更新しました。

TeamPCPについて

#security #セキュリティ #threat #intelligence #ransomware #supplychain #teampcp

hwdream.com/teampcp/

Another supply chain attack hits home: LiteLLM was compromised by TeamPCP. Learn how a stolen token led to a massive infostealer deployment and what it means for your software.

thepixelspulse.com/posts/litellm-malware-at...

#litellm #teampcp #pypi

Popular LiteLLM PyPI package compromised in TeamPCP supply chain attack The TeamPCP hacking group continues its supply-chain rampage, now compromising the massively popular "LiteLLM" Python package on PyPI and claiming to have stolen data from hundreds of thousands of devices during the attack.

Popular #LiteLLM #PyPI package backdoored to steal credentials, auth tokens

www.bleepingcomputer.com/news/security/popular-li...

#cybersecurity #TeamPCP

TeamPCP exploited a pull_request_target workflow in Aqua Trivy to steal an aqua‑bot PAT, rewrite release tags to malicious commits (Trivy v0.69.4–0.69.6) and deploy CanisterWorm using ICP canisters. #TeamPCP #Trivy #CanisterWorm https://bit.ly/4uR5VKt

LiteLLM compromised on PyPI: Tracing the March 2026 TeamPCP supply chain campaign On March 24, 2026, legitimate LiteLLM PyPI releases 1.82.7 and 1.82.8 were compromised and distributed malicious payloads that collected credentials, installed persistence, and exfiltrated data. Datadog links the LiteLLM incident to a five-day TeamPCP supply-chain campaign that began with the Trivy compromise and spread through npm, Checkmarx, and other ecosystems; treat any host or CI that installed these versions as a full-credential exposure. #LiteLLM #TeamPCP

On March 24, 2026, LiteLLM PyPI releases 1.82.7 and 1.82.8 were compromised, delivering backdoors that harvested credentials and exfiltrated data. The incident ties to a TeamPCP supply chain campaign impacting multiple ecosystems. #SupplyChain #TeamPCP

TeamPCP escalates cyber threats with CanisterWorm, deploying a Kubernetes wiper targeting Iranian systems. Organizations must bolster defenses against this destructive malware. #CyberSecurity #Kubernetes #TeamPCP Link: thedailytechfeed.com/teampcps-kub...

TeamPCP Backdoors LiteLLM via Trivy
Read More: buff.ly/9DwmFvk

#TeamPCP #LiteLLM #Trivy #PyPI #SupplyChainSecurity #KubernetesSecurity #CredentialTheft #DevSecOps

Alert: TeamPCP exploits LiteLLM vulnerabilities to deploy backdoors in cloud systems. Ensure your deployments are secure. #CyberSecurity #CloudSecurity #LiteLLM #TeamPCP Link: thedailytechfeed.com/teampcp-expl...

Self-propagating #malware poisons open source software and wipes #Iran-based machines

arstechnica.com/security/2026/03/self-pr...

#TeamPCP #cybersecurity

TeamPCP deploys Iran-targeted wiper in Kubernetes attacks The TeamPCP hacking group is targeting Kubernetes clusters with a malicious script that wipes all machines when it detects systems configured for Iran. [...]

#TeamPCP deploys #Iran-targeted wiper in #Kubernetes attacks

www.bleepingcomputer.com/news/security/teampcp-de...

#cybersecurity

TeamPCP Hits Trivy, Checkmarx, and LiteLLM in Credential Theft Campaign Hackers compromised Trivy, Checkmarx, and LiteLLM in a supply chain attack, stealing cloud credentials, tokens, and crypto wallet data from developers.

TeamPCP injected malicious code into Trivy, Checkmarx tools, and LiteLLM in a supply chain attack designed to steal cloud credentials, tokens, and crypto wallet data.

Read: hackread.com/teampcp-triv...

#CyberSecurity #Malware #TeamPCP #Trivy #Checkmarx #LiteLLM

LiteLLM compromis: atac masiv TeamPCP - TECHNEWSRO LiteLLM este compromis în atacul TeamPCP, expunând credențiale și sisteme la risc. Află impactul, metodele folosite și cum te poți proteja.

#LiteLLM compromised: massive #TeamPCP attack

TeamPCP Backdoors LiteLLM Versions 1.82.7–1.82.8 via Trivy CI/CD Compromise movement toolkit that installs privileged pods read more about TeamPCP Backdoors LiteLLM Versions 1.82.7–1.82.8 via Trivy CI/CD Compromise

TeamPCP Backdoors LiteLLM Versions 1.82.7–1.82.8 via Trivy CI/CD Compromise reconbee.com/teampcp-back...

#TeamPCP #backdoors #CICD #cybersecurity #cyberattack

Nieuwe malware wist data op Iraanse machines - TechNieuwsVandaag.nl Een nieuwe hackergroep verspreidt gevaarlijke malware via open-source software. De groep heet TeamPCP en is actief sinds december. Onderzoekers van beveiligingsbedrijf Flare volgden de groep ... Lees verder

Nieuwe malware wist data op Iraanse machines

Een nieuwe hackergroep verspreidt gevaarlijke malware via open-source software. De groep heet TeamPCP en is actief sinds december.

#malware #TeamPCP #CanisterWorm

TeamPCP Targets OSS Security Tools

~Socket~
TeamPCP is actively compromising CI/CD pipelines and OSS security tools like Trivy and LiteLLM for mass credential exfiltration.
-
IOCs: CanisterWorm
-
#SupplyChain #TeamPCP #ThreatIntel

TeamPCP Injects Credential Stealer Into Trivy Releases and Spreads to npm via CanisterWorm Group TeamPCP (financially motivated threat actor, reportedly collaborating with LAPSUS$ for extortion; na...

#TeamPCP #Supply #Chain #Attack #CI/CD #Security […]

[Original post on cybersecsentinel.com]

TeamPCP Injects Credential Stealer Into Trivy Releases and Spreads to npm via CanisterWorm Group TeamPCP (financially motivated threat actor, reportedly collaborating with LAPSUS$ for extortion; na...

#TeamPCP #Supply #Chain #Attack #CI/CD #Security […]

[Original post on cybersecsentinel.com]

Popular LiteLLM PyPI package compromised in TeamPCP supply chain attack TeamPCP compromised the widely used LiteLLM Python package on PyPI, publishing malicious 1.82.7 and 1.82.8 releases that install an infostealer and persistence mechanisms. The campaign, linked to the Trivy supply‑chain breach, reportedly exfiltrated data from roughly 500,000 devices and requires immediate secret rotation, artifact hunting, and Kubernetes inspection. #TeamPCP #LiteLLM

TeamPCP compromised LiteLLM PyPI package with malicious 1.82.7 & 1.82.8 releases, deploying infostealers that harvest SSH keys, cloud creds, Kubernetes tokens, and more on Python startup. #LiteLLM #PythonAttack #TeamPCP

LiteLLM's latest versions were compromised via its CEO's GitHub, unleashing infostealer malware. This isn't just another supply chain attack; it reveals deeper issues.

thepixelspulse.com/posts/litellm-supply-cha...

#litellm #pypi #teampcp

Teampcp Hacks Checkmarx via Stolen CI
Read More: buff.ly/6nVcv6O

#TeamPCP #Checkmarx #GitHubActions #CICDSecurity #SupplyChainAttack #SecretsTheft #Typosquatting #DevSecOps

Self-propagating malware poisons open source software and wipes Iran-based machines https://arstechni.ca #Security #malware #teampcp #Biz&IT #worm

Trivy Supply Chain Attack Expands to Docker

~Socket~
Compromised Trivy Docker images (0.69.5, 0.69.6) containing TeamPCP infostealer malware were pushed to Docker Hub.
-
IOCs: scan. aquasecurtiy. org
-
#SupplyChain #TeamPCP #Trivy #threatintel

TeamPCP deploys Iran-targeted wiper in Kubernetes attacks TeamPCP is conducting a campaign against Kubernetes clusters that installs the CanisterWorm backdoor on non-Iranian systems and deploys a geopolitically targeted destructive payload that wipes machines configured for Iran. Aikido links this activity to the Trivy supply-chain compromise and notes variants that spread via SSH and exploit unauthenticated Docker API access. #TeamPCP #CanisterWorm

TeamPCP targets Kubernetes clusters by installing the CanisterWorm backdoor on non-Iranian systems and deploying a geopolitically targeted wiper on clusters configured for Iran. Exploits include SSH and Docker API. #TeamPCP #Iran #Kubernetes

TeamPCP deploys Iran-targeted wiper in Kubernetes attacks The TeamPCP hacking group is targeting Kubernetes clusters with a malicious script that wipes all machines when it detects systems configured for Iran.

TeamPCP deploys Iran-targeted wiper in Kubernetes attacks
www.bleepingcomputer.com/news/securit...

#Infosec #Security #Cybersecurity #CeptBiro #TeamPCP #KubernetesAttacks

Trivy supply-chain attack spreads to Docker, GitHub repos The TeamPCP hackers continued to target Aqua Security by compromising its GitHub organization and pushing malicious Trivy Docker images that delivered an infostealer. The attackers abused a compromised service account and CI runner tokens to inject credential-harvesting code, tamper with repositories, and publish unauthorized Docker Hub tags, prompting Aqua to rotate secrets and engage Sygnia for response. #TeamPCP #Trivy

TeamPCP hackers breached Aqua Security’s GitHub, injecting infostealer malware into Trivy Docker images (tags 0.69.5 & 0.69.6) via compromised service accounts and CI tokens. Secrets rotated and response ongoing. #TeamPCP #DockerAttack #Israel

Trivy Breached Twice in a Month via GitHub Actions Attackers have hijacked 75 of 76 GitHub Actions tags for Aqua Security's Trivy scanner, distributing credential-stealing malware through CI/CD pipelines.

winbuzzer.com/2026/03/23/t...

Trivy Breached Twice in a Month via GitHub Actions

#GitHub #GitHubActions #Cybersecurity #Malware #Cybercrime #SecurityBreach #OpenSource #Hackers #npm #Javascript #SoftwareDevelopment #CloudComputing #DataBreaches #Trivy #AquaSecurity #TeamPCP #CanisterWorm