SecurityScorecard’s STRIKE Threat Intelligence Team is unveiling new research today that brings together the full picture of TeamPCP’s recent hacking operations: who the group is, how its two alleged operators were unmasked, and how it worked with an ecosystem of five criminal groups that each played a different role in its hacking campaigns.
The newly published report also includes our own static analysis of a Mini Shai-Hulud worm sample.
On August 26, 2026, Australian and U.S. authorities arrested two men from Western Australia for allegedly leading a cybercrime group called TeamPCP. Police say the group and its partners compromised more than 1,000 organizations, stole over 500,000 credentials, and caused hundreds of millions of dollars in remediation costs. Reported victims include Cisco, the European Commission, and GitHub.
Despite internal backstabbing and the eventual arrest of TeamPCP’s leaders, TeamPCP’s supply chain attack architecture, tooling, and partner network remain. If your company runs software built by others (and most companies do), this story applies to you.
Read the full report here.
What’s New in The Research
- Coding bugs in the worm. STRIKE’s static analysis found defects that can covertly change the worm’s path, so a missing artifact does not prove a stage did not run. Examples include health checks that skip await and can block the backup exfiltration route, uploads that count as sent even when they fail, unresolved Windows file paths, and a security-tool check that is defined but never called.
- A response-order consequence. Blocking network access can make the worm’s npm check fail and trigger the wipe. Responders should stop the malware before blocking the network, not just before revoking tokens.
- A connected alliance map. STRIKE conducted dark web research, linking dark web forum posts and leak-site posts to show how TeamPCP worked with five partner groups.
What Happened
TeamPCP reportedly poisoned the trusted tools that software developers use to build and secure their products. If you installed a tampered tool, attackers likely took your passwords and the keys that open your cloud accounts.
TeamPCP never had to specifically choose its victims. It chose popular tools, stole users’ credentials and secrets, and then passed access to other cybercriminal groups. TeamPCP and its partners collaborated to monetize stolen credentials until one of them betrayed the group. HackMag reported that ShinyHunters, which TeamPCP had brought in to monetize stolen data, turned on the group by extorting victims independently without sharing the proceeds. Then ShinyHunters leaked TeamPCP’s internal chat logs to researchers. So much for honor among thieves.
Most victims were not targeted directly. They were downstream of a vendor whose tools had been poisoned. As is so often the case, your real exposure is increasingly the sum of every third and fourth party your software supply chain trusts.
A Self-Propagating Threat
The Mini Shai-Hulud worm is a piece of malicious software that spreads through the tools programmers use to build apps. The worm was originally used in a May 2026 campaign, but has resurfaced periodically. Based on threat intelligence published by Aikido, the Mini Shai-Hulud worm payload resurfaced on September 7, 2026, after 111 days of complete dormancy following its initial deployment in May. The last publicly known activity of the original payload was in late September 2026.
SecurityScorecard’s STRIKE Team performed its own static analysis of the self-propagating Mini Shai-Hulud worm sample. Here is what the worm did:
- Slipped in during a routine software installation
- Collected every credential the system could reach
- Sent the stolen data out in encrypted form, disguised as ordinary technical traffic
- Used the stolen access to publish infected versions of other software, turning each victim into a new source of infection
The worm also included a booby trap. If responders canceled the stolen credentials or cut off its network connection, it could wipe the victim’s computer. See the full report for details on the analysis.
SecurityWeek reported that the worm has outlived its creators, TeamPCP. SecurityScorecard assessed the three ways the worm persists. First, the stolen data remains: the more than 500,000 reported harvested credentials stay valid until each affected organization rotates them, and partners like LAPSUS$ likely still hold copies. Second, the tooling is public. The worm was open-sourced during the BreachForums competition and, as its September 7 resurfacing shows, keeps reappearing. Third, the model is proven and cheap to copy. The worm runs at install time inside CI/CD pipelines, harvests secrets, exfiltrates them encrypted, and republishes itself using stolen npm and GitHub access. It also includes a destructive trap that can wipe a host if tokens are revoked or egress is blocked.
Who Benefited From the Same Breach
TeamPCP allegedly acted as a mass initial access broker (IAB), feeding stolen cloud credentials to five groups:
- BreachForums, a cybercrime marketplace, recruited participants and sponsored a competition with a $1,000 prize for whoever executed the largest software supply chain compromise.
- xpl0itrs allegedly turned raw access into targeted intrusions and sold stolen data.
- Vect Ransomware allegedly planned to lock victims’ files for ransom, but a flaw in its code destroyed data permanently, and the effort collapsed.
- LAPSUS$ reportedly ran the extortion by posting data, auctioning it, and pressuring companies to pay.
- ShinyHunters didn’t appear to be a willing partner. It hijacked the stolen credentials for its own use and turned on the group.
Each group appears to have benefited from the original breach in a different way, demonstrating how a single vendor compromise can turn into several separate crises for downstream companies.
TeamPCP leaves defenders facing a repeatable blueprint: poison one trusted tool, harvest what touches it, and rent out the access. The names of victims will change. The technique will not.
What This Means for Your Business
Your exposure doesn’t stop at your own perimeter. It is the sum of every third, fourth, and nth party your software depends on. Here are the top 5 ways to defend against TeamPCP-style attacks:
- Turn off automatic install scripts. Software packages can run code the moment you install them, and that’s how the TeamPCP worm got going. Make a person approve scripts first.
- Turn on two-factor authentication (2FA). The attack began with a hijacked account. A second check, like a code on your phone, makes a stolen password much less useful.
- Use short-lived credentials instead of permanent passwords. Credentials that expire quickly are far less useful to a hacker who steals them.
- Give programs only the access they need. Don’t leave powerful keys on the computers that build software. Less access means less to steal.
- Know who your software depends on, and change keys after an incident. Most victims used a tool that was already poisoned. Keep track of your vendors, and replace any passwords or keys the bad tool could have touched.
The Bottom Line
Supply chain compromise has become a plug-and-play business for cybercriminals. To defend your organization, build visibility into your third-, fourth-, and nth-party vendor relationships, limit what any single tool can reach, expire the keys that open your cloud accounts, and plan your response before an incident forces your hand. SecurityScorecard’s TITAN Secure solution and its vendor-detection capabilities map those relationships.
Read the STRIKE Team’s full report today.
Request a SecurityScorecard demo to monitor your supply chain continuously.
