xpl0itrs is a financially motivated threat actor group that has publicly claimed compromises of major enterprises since early 2026. Within the group, an actor known as boxturtl is their most publicly vocal member, explicitly claiming membership in xpl0itrs and referencing close collaboration with TeamPCP since at least April 2026. boxturtl also claimed in an April 2026 interview to have performed professional work as a red teamer. The group has previously described itself as “purely for monetization,” claiming a separate persona is maintained for ideologically-motivated activity. xpl0itrs maintains a presence across multiple English and Russian-language illicit forums.
In June 2026, the group announced it would be launching a leak site and broadcasted upcoming sales for initial access to multiple compromised organizations.
xpl0itrs’ closest partnership is with TeamPCP . Publicly claimed joint operations between the two groups include CanisterWorm and the Bitwarden CLI compromise in April 2026. Due to xpl0itrs’ close links to TeamPCP actors, it is worth noting xpl0itrs may have had exposure to the tooling of TeamPCP’s previously operated brands such as CipherForce ransomware, ShellForce, and Black Witch. TeamPCP has stated publicly on multiple occasions it positions itself primarily as an initial access broker, which is relevant context to the group’s collaborative sharing of access and data with xpl0itrs.
TeamPCP’s March 2026 campaign illustrates the cascading downstream risk that defines this ecosystem’s threat. The campaign began with a compromise of Aqua Security’s Trivy vulnerability scanner. Using credentials exfiltrated from Trivy, TeamPCP conducted multiple waves of follow-on compromises, hitting Checkmarx KICS, LiteLLM, and Telnyx. In this campaign, initial access and data was passed to Vect and “LAPSUS$ Group” for monetization, explaining the victim overlap across those groups’ listings. Given the historical collaboration between xpl0itrs and TeamPCP, further follow-on attacks by xpl0itrs leveraging credentials harvested from compromised developer environments and CI/CD pipelines are assessed as likely.
Other related actors include:
Adjacent actors currently or previously loosely associated via the wider TeamPCP ecosystem:
A notable shift came for the group on June 17, 2026, when xpl0itrs published a forum post announcing the upcoming launch of a data leak site and teasing major upcoming initial access sales. More on that is available here.
First alluded to by boxturtl multiple times in May with a formal sale post published June 10, xpl0itrs advertised purported internal GitHub data from a US software vendor for $12,000 USD. The sale post listed 246 repositories totaling 14 GB of uncompressed data, with initial access claimed to be related to a developer’s Personal Access Token. The actor explicitly framed the package as post-access enablement, not initial access by stating “if you’re already inside, or want to be there, this will be very very useful for figuring out their infrastructure. This positioned it for buyers who already held or planned to acquire a foothold and wanted the internal topology to operationalize follow-on activity.
The published sample repository of 336 files appeared credible with plausible references to internal development resources. Notably, the sample contained a git log committer artifact with a handle suffix potentially consistent with a major US financial analytics firm previously named in a TeamPCP campaign almost two months prior, potentially adding a notable third-party risk dimension for integration partners and customers if a compromise is confirmed. Persona boxturtl had been hinting at the compromise on social media since May 22, with a Unix timestamp in the sample archive suggesting access may have been maintained until at least May 19.
xpl0itrs is linked to multiple TeamPCP software supply chain compromise campaigns. Both groups have confirmed joint operations in public interviews, including joint involvement on the CanisterWorm campaign and the BitWarden CLI compromise, which xpl0itrs reportedly led. Threat actor boxturtl has also publicly discussed TeamPCP tooling on multiple occasions.
On February 17, 2026, an xpl0itrs account advertised 800 leaked documents and a related insecure direct object reference (IDOR) exploit related to a major European automotive company on the Russian-language illicit forum Rehub and English-language DarkForums. The documents were priced at $3,000, and the exploit $6,000. The actor claimed to have accessed the documents using the IDOR exploit. The initial sample documents appeared to be primarily related to dealership systems, including post-sale forms and employee PII.
Five weeks later on March 25, xpl0itrs posted an updated sale post for the same automotive company – now packaged as an initial access and exfiltrated data sale bundle for $30,000. This new post suggested xpl0itrs had pivoted the original IDOR exploit into widened internal infrastructure access, reportedly exfiltrating tens of thousands of customer and employee PII records globally, plus a certificate advertised as usable to sign malware. The March 25 post also claimed data exfiltration and expanded access potentially impacting over 30 other automotive brands to varying degrees. Newly listed subdomain mapping was claimed to cover nearly every subsidiary and internal chat logs from 26 automakers.
On February 14, 2026, xpl0itrs advertised multiple purported vulnerabilities for compromising Snapchat accounts and sensitive user data for $350,000.
boxturtl has previously discussed use of AI in operations to expedite malware development. Additionally, both xpl0itrs and TeamPCP actors have mentioned abusing the legitimate offensive security tool Gato-X (GitHub Attack Toolkit – Extreme Edition) for targeting misconfigurations in GitHub development environments and harvesting credentials.
boxturtl has also previously stated both xpl0itrs and TeamPCP contributed to the development of CanisterWorm, the self-propagating worm used previously in joint supply chain operations.
In a time of increasing cyber threats and AI-driven attacks, security teams need actionable insights to drive a preemptive cyberdefense strategy. This report analyzes global risks and offers the intelligence needed for a proactive cybersecurity strategy.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
