TeamPCP Supply Chain Attack Compromises Databricks Platform

• •Databricks is investigating a potential compromise linked to the TeamPCP supply chain attack.
• •TeamPCP operates under multiple aliases and runs two parallel ransomware operations.
• •Organizations using Databricks should treat their credentials as potentially compromised.

Databricks is investigating a potential security compromise linked to the TeamPCP supply chain attack. This incident follows a notification from International Cyber Digest, which indicated that Databricks was alerted last week. The TeamPCP campaign has previously targeted various security tool vendors, and a Databricks compromise would mark the first major cloud platform victim of this campaign. Analysts have identified TeamPCP as operating under multiple aliases and running dual ransomware operations, including their proprietary CipherForce program. The attack is believed to involve a credential trove of 300 GB, which could impact organizations using Databricks. As of now, Databricks has not issued an official statement regarding the breach. Organizations using Databricks are advised to monitor for updates and treat potentially compromised credentials with caution.