Related Threat Clusters
-
LiteLLM Python Package Compromised in Major Supply Chain Attack by TeamPCP
On March 24, 2026, two malicious versions of the LiteLLM Python package (1.82.7 and 1.82.8) were published on PyPI, containing credential-stealing malware. The attack, attributed to the TeamPCP threat group, exploited…
53 articles · Updated March 24, 2026 -
Mercor Cyberattack Linked to LiteLLM Supply Chain Compromise
AI recruiting startup Mercor confirmed it was impacted by a supply chain attack linked to the LiteLLM project, which has affected thousands of organizations. The breach was attributed to the hacking group TeamPCP, with…
30 articles · Updated April 1, 2026 -
Checkmarx Data Leak Linked to Supply-Chain Attack by TeamPCP
Checkmarx, a software security firm, is investigating a significant data leak after its GitHub repository was compromised in a supply-chain attack on March 23, 2026. The attack, attributed to the TeamPCP cybercrime…
12 articles · Updated April 27, 2026 -
Mini Shai-Hulud Supply Chain Attack Targets SAP npm Packages
A new supply chain attack, dubbed 'Mini Shai-Hulud', has compromised multiple npm packages related to SAP's Cloud Application Programming Model (CAP). This attack involves injecting malicious preinstall scripts into…
751 articles · Updated April 29, 2026 -
TeamPCP Hackers Arrested for Major Supply Chain Attacks
On August 26, 2026, Australian Federal Police arrested two men, Ruben Thomson and Louis Gaebler, linked to the TeamPCP hacking group. This group is notorious for sophisticated supply chain attacks that compromised over…
25 articles · Updated August 27, 2026 -
Vect 2.0 Ransomware Functions as Data Wiper, Not Encryptor
The Vect 2.0 ransomware, emerging from a partnership with the TeamPCP group, has been found to irreversibly destroy files larger than 128 KB instead of encrypting them for ransom. This critical flaw, identified by Check…
21 articles · Updated April 28, 2026 -
PCPJack Malware Targets TeamPCP Victims for Credential Theft
The newly discovered PCPJack malware framework is actively targeting cloud environments to steal credentials while removing remnants of the TeamPCP cybercrime group. This worm exploits exposed services such as Docker,…
11 articles · Updated May 7, 2026 -
Scattered Spider Reclassified as Decentralized Cybercrime Collective
Scattered Spider, a cybercrime entity linked to various high-profile attacks since 2022, has been reclassified as a decentralized collective rather than a unified group. Group-IB's analysis indicates that it consists of…
2 articles · Updated July 7, 2026 -
GitHub Breach: 3,800 Internal Repositories Compromised via Malicious VS Code Extension
On May 20, 2026, GitHub confirmed a significant security breach involving a poisoned Visual Studio Code (VS Code) extension that compromised an employee's device. The attack, attributed to the TeamPCP hacking group,…
149 articles · Updated May 20, 2026 -
TeamPCP Supply Chain Attack Compromises Databricks Platform
Databricks is investigating a potential security compromise linked to the TeamPCP supply chain attack. This incident follows a notification from International Cyber Digest, which indicated that Databricks was alerted…
4 articles · Updated March 30, 2026
Recent Intelligence Reports
- Two TeamPCP members arrested in Australia — News.Risky.Biz · August 28, 2026
- Tracker — www.globenewswire.com · August 27, 2026
- Connecting Scattered Spider — www.group-ib.com · July 8, 2026
- How software development’s speed obsession enabled TeamPCP’s chaos crusade — Cyberscoop · June 18, 2026
- GitHub breached via poisoned VS Code extension, 3,800 repos stolen — Thenextweb · May 20, 2026
- GitHub Confirms Breach of Internal Repositories Via Malicious VS Code Extension — Infosecurity-Magazine · May 20, 2026
- New PCPJack worm steals credentials, cleans TeamPCP infections — Bleepingcomputer · May 7, 2026
- Vect 2.0 Ransomware Acts as Wiper, Thanks to Design Error — Darkreading · April 29, 2026