A new analysis links the threat activity attributed to TeamPCP with compromises that date back to 2020. Rather than emerging suddenly in 2025, the actor appears to have spent years probing internet-facing systems, later expanding into cloud-native abuse and, eventually, software supply chain attacks.
Researchers from Oligo Security say the connection is supported by multiple technical and operational overlaps, including domain reuse patterns, malware delivery and staging approaches, backend infrastructure similarities, and consistent tradecraft.
From 2020 infrastructure abuse to a later software supply chain push
According to the findings, TeamPCP’s earlier operations centered on compromising externally reachable infrastructure long before the group became widely associated with supply chain compromises. The analysis points to the actor’s use of wormable-style exploitation methods and automation, allowing it to scale access across common cloud and container ecosystems.
Notably, the researchers argue that TeamPCP’s later behavior looks like an evolution: the actor reportedly leveraged the same kinds of techniques against modern interdependent software components, then turned those relationships into a path for infecting development environments at scale.
Spotlight on TeamPCP Redis attacks
One of the clearest threads in the research is the actor’s attention to Redis. The latest work describes a campaign referred to as TA-NATALSTATUS, which targeted exposed Redis servers to deliver cryptocurrency miners.
Oligo Security assesses that TA-NATALSTATUS is an evolution of an earlier Redis-focused effort described by Trend Micro in April 2020. That earlier activity also involved compromising Redis servers to deploy malware, suggesting continuity in targeting and tactics across several years.
In this view, TeamPCP Redis attacks are not isolated incidents but part of a longer pattern of attacking internet-accessible components spanning multiple platforms.
Campaigns observed in 2025: ShadowRay 2.0 and AI infrastructure hijacking
The research also describes two campaigns seen in the second half of 2025. The first, ShadowRay 2.0 (also known as IronErn), involved hijacking AI infrastructure and using it to build a self-propagating botnet.
The second campaign, TA-NATALSTATUS, focused on exposed Redis systems for miner delivery. Together, these efforts illustrate how the same threat activity could shift between infrastructure classes—containers, databases, and higher-level services—while keeping exploitation and staging behavior aligned.
Credentials theft and earlier web-facing operations
Before the more public supply chain focus, the researchers say the actor’s first signals surfaced toward the end of the previous year. At that stage, reporting connected the activity to exploitation of security weaknesses in React Server Components and Next.js.
The purpose of those web-facing intrusions, according to the analysis, was to extract credentials and sensitive data from compromised environments. That activity was codenamed Operation PCPcat.
Then, earlier in the year, additional reporting described a large-scale campaign aimed at cloud-native environments, laying groundwork for malicious infrastructure used in later exploitation workflows.
Building proxy and scanning infrastructure for large-scale abuse
Flare’s earlier reporting characterized the operation’s goals as building distributed proxy and scanning capabilities at scale. After establishing reach and reconnaissance, the actor would compromise servers to exfiltrate data, deploy ransomware, run extortion activity, and mine cryptocurrency.
This combination of objectives matches the pattern of “prepare infrastructure first, then expand impact,” which also aligns with the later emphasis on automated and wormable exploitation techniques.
How supply chain attacks fit the bigger pattern
After establishing a foothold in cloud-native and internet-facing targets, the actor allegedly broadened into high-profile supply chain compromises. In this phase, the threat reportedly weaponized the interconnection of modern software by poisoning widely used open-source libraries.
The research highlights a method that combined GitHub Actions abuse with token theft. This approach can allow attackers to turn trusted automation and developer workflows into delivery mechanisms, meaning infections can propagate more effectively through real software pipelines.
Evidence linking identities and infrastructure across ShadowRay and TeamPCP
Oligo Security points to one of the strongest operational connections: overlapping identities tied to the ShadowRay 2.0 activity and later infrastructure associated with TeamPCP. The overlap involved GitHub and GitLab identities observed during the relevant operations.
By correlating GitLab authentication logs, command-and-control infrastructure, reverse-shell activity, and malware staging, the researchers say they could establish a direct operational bridge between the earlier and later activity.
In other words, the evidence described is not simply that campaigns “look similar,” but that multiple layers of activity appear to align—suggesting a continuing operational ecosystem rather than a brand-new actor that suddenly appeared in late 2025.
Malware updates: from Kubernetes propagation to destructive wiper behavior
Alongside targeting shifts, the analysis describes continued evolution in the malware arsenal. Researchers mention a Python script called kube.py, used after breaching Kubernetes environments.
Earlier versions reportedly emphasized propagation and persistence. However, newer variants observed as recently as March 2026 reportedly introduced functionality described as wiper-like.
One destructive code path checks whether a victim system is configured for the Iran timezone. If the configuration matches, the malware fires a DaemonSet that wipes every node in the cluster, using a component named Kamikaze. For Kubernetes nodes outside of Iran, it deploys a backdoor called CanisterWorm.
For non-Kubernetes systems in the Iran timezone scenario, the malware executes a routine referred to as poison_pill() that erases the entire file system. While the analysis cannot determine whether these changes reflect a direct rebrand or collaboration between related operators with full certainty, it does show continuity in capabilities and intent.
What this means for defenders
The overarching takeaway is that TeamPCP Redis attacks appear connected to a broader, long-running effort: compromise internet-facing services, expand into cloud-native environments, and eventually repurpose automation and supply chain pathways for large-scale impact.
For organizations, the practical implication is straightforward. Defending against this kind of actor requires more than patching a single vulnerability or blocking one protocol. Teams need to reduce exposure of services such as Redis when misconfigured, harden web-facing frameworks, monitor token abuse patterns in CI/CD workflows, and scrutinize Kubernetes deployments for unusual resources and destructive behaviors.
Conclusion
The new research portrays TeamPCP as part of an existing operational ecosystem, not a sudden new player. By connecting campaigns across years—including Redis-focused malware delivery, AI infrastructure hijacking, credential theft through web framework weaknesses, and later supply chain poisoning—the findings suggest a methodical progression toward larger-scale compromise.
As the malware and targeting strategies continue to evolve, defenders should treat exposed internet services and trusted software delivery pipelines as equally important components of the security perimeter.
Source: https://thehackernews.com/2026/08/teampcp-linked-to-redis-attacks-dating.html
