Emerging Cyber Threats: CRPx0 Ransomware and TeamPCP Supply Chain Attacks

• •CRPx0 ransomware operation linked to 'MrAnon00' targets healthcare organizations.
• •TeamPCP has transitioned from data brokering to executing major supply chain attacks.
• •Both groups utilize Telegram for operations and have rapidly expanded their criminal activities.

CRPx0 is a rapidly growing ransomware operation linked to the cybercriminal 'MrAnon00', active since July 2025, targeting small healthcare and dental organizations. The operation employs social engineering tactics to distribute its malware, which includes data theft and file encryption. Meanwhile, TeamPCP (UNC6780) has evolved from a Telegram data broker into a significant threat actor behind supply chain attacks, compromising tools like Trivy and Checkmarx KICS. TeamPCP's activities include a notable attack in Kenya and partnerships with ransomware operations, including a collaboration with the Vect group. As of August 2026, both groups pose serious risks to various sectors, with TeamPCP's automation and self-propagation capabilities marking a new trend in cybercrime. The current status of these threats is active, with ongoing investigations into their operations.