TeamPCP — Software Supply-Chain Compromise (FBI FLASH-20260702-01)

TeamPCP is a large-scale software supply-chain campaign flagged by the FBI in FLASH advisory FLASH-20260702-01 (2026-07-02), reportedly affecting 1,000+ organizations. The actors inject malicious code into legitimate developer and security packages — publicly named examples include Trivy, KICS, LiteLLM, and the Telnyx Python SDK — then publish trojanized versions through normal distribution channels and wait for CI/CD pipelines to pull them automatically.

Once installed, the tainted packages deploy credential-stealing malware — CanisterWorm (cloud access tokens, API keys, and credentials for AWS/GCP/Azure), SANDCLOCK (AWS credentials, Kubernetes ServiceAccount tokens, environment variables, and cryptocurrency wallet data), and the self-replicating Mini Shai-Hulud / Miasma worms that spread across npm and PyPI while harvesting secrets. Stolen data is exfiltrated to attacker-controlled GitHub repositories (tpcp-docs, docs-tpcp) and lookalike domains; the actors then extort victims and publish names on a leak site.

The attacker objective is credential harvesting at build time — a single tainted dependency yields cloud keys and cluster secrets that unlock downstream environments. The highest-value defensive angle is watching build/developer hosts and CI runners for package-manager processes that read cloud/SSH/Kubernetes credential material or make outbound connections to the published TeamPCP infrastructure.

Defender priority: Block the FBI-published C2 IPs and lookalike domains (Q1/Q2 — real atomic IOCs), then hunt build/dev hosts for package-install processes touching .aws/.ssh/kube credentials (Q3) and any egress to the attacker GitHub exfil repos (Q4). Rotate every credential exposed to an affected pipeline — assume harvested until proven otherwise.

Web-hunter note: The FBI FLASH lists 27 file hashes that are not enumerated in secondary reporting; this pack therefore uses only the IP and domain IOCs that appear verbatim in reliable secondary sources and leaves hash blocks as REPLACE_WITH_... placeholders to be filled from the FLASH PDF or your own findings. Do not substitute unverified hashes.

Hunt hypotheses (fidelity-ordered)

1. H1 (high): A host connects to a published TeamPCP C2 IP — direct atomic-IOC match.
2. H2 (high): A host resolves a TeamPCP lookalike domain (checkmarx.zone, models.litellm.cloud, git-tanstack.com, recv.hackmoltrepeat.com).
3. H3 (high): A package-manager / interpreter process (npm, node, pip, python, bun, yarn) reads cloud/SSH/Kubernetes credential material during or after an install — the SANDCLOCK/CanisterWorm harvest behavior.
4. H4 (medium): Outbound push or reference to the attacker GitHub exfil repos tpcp-docs / docs-tpcp.
5. H5 (medium): The Bun runtime is fetched and executed on a build/dev host — the Mini Shai-Hulud / Miasma bootstrap.
6. H6 (medium): A security-scanner binary (trivy, kics) or LiteLLM spawns a shell or makes unexpected egress — trojanized-tool post-install behavior.

Attack chain

Provenance: IPs and domains below appear verbatim in FBI-derived secondary reporting (SecurityAffairs). File hashes (27 in the FLASH) are not reproduced here and are left as placeholders — pull them from the IC3 FLASH PDF before blocking.

• Dependency audit: Enumerate installed versions of Trivy, KICS, LiteLLM, and the Telnyx Python SDK across build images and lockfiles; compare against vendor advisories and pin to known-good versions.
• AWS CloudTrail: Hunt for GetCallerIdentity, ListBuckets, or STS activity from CI/CD credentials originating from unfamiliar source IPs (correlate with the C2 IPs) or new user agents shortly after a build.
• GCP / Azure audit: Review service-account key usage and token grants from non-pipeline locations after 2026-06-01.
• Kubernetes API audit: Look for ServiceAccount tokens used from outside the cluster / from developer or unknown IPs.
• GitHub org audit log: Search for pushes to or creation of repos named tpcp-docs / docs-tpcp, and for outbound data pushes from CI tokens.

The network indicators (Q1/Q2) are best deployed as Falcon Custom IOCs (block) rather than IOAs. Keep Q3/Q6 as detect-only IOAs until the IaC/plugin exclusions are baselined.

IPs and domains are ready to import. Hashes are placeholders — pull the 27 from the IC3 FLASH PDF before enabling the SHA256 block.

type,value,action,severity,expiration,description,tags
ipv4,83.142.209.11,detect,critical,2027-01-08,TeamPCP C2,campaign:TeamPCP
ipv4,83.142.209.194,detect,critical,2027-01-08,TeamPCP C2,campaign:TeamPCP
ipv4,83.142.209.203,detect,critical,2027-01-08,TeamPCP C2,campaign:TeamPCP
ipv4,45.148.10.212,detect,critical,2027-01-08,TeamPCP C2,campaign:TeamPCP
ipv4,94.154.172.43,detect,critical,2027-01-08,TeamPCP C2,campaign:TeamPCP
ipv4,67.217.57.240,detect,critical,2027-01-08,TeamPCP C2,campaign:TeamPCP
domain,checkmarx.zone,detect,critical,2026-10-08,Checkmarx lookalike,campaign:TeamPCP
domain,models.litellm.cloud,detect,critical,2026-10-08,LiteLLM lookalike,campaign:TeamPCP
domain,git-tanstack.com,detect,critical,2026-10-08,GitHub lookalike,campaign:TeamPCP
domain,recv.hackmoltrepeat.com,detect,critical,2026-10-08,Exfil receiver,campaign:TeamPCP
sha256,REPLACE_WITH_FLASH_HASH,detect,critical,2027-01-08,TeamPCP payload (from IC3 FLASH),campaign:TeamPCP

Parent(node|npm|python|pip|bun) -> cmdline reads .aws|.ssh|.kube|serviceaccount|.env
Parent(trivy|kics|litellm) -> Child(sh|bash|curl|wget|nc)
Bun runtime fetched/executed by a package-install parent
cmdline references tpcp-docs | docs-tpcp
Egress to any TeamPCP C2 IP or lookalike domain

Campaign: TeamPCP (FBI FLASH-20260702-01, 2026-07-02)
Malware: CanisterWorm (cloud tokens/keys AWS/GCP/Azure)
         SANDCLOCK (AWS creds, K8s ServiceAccount tokens, env, wallets)
         Mini Shai-Hulud / Miasma (self-replicating npm/PyPI worms)
Trojanized: Trivy, KICS, LiteLLM, Telnyx Python SDK
Exfil repos: tpcp-docs, docs-tpcp

1. Inventory Trivy/KICS/LiteLLM/Telnyx SDK versions in build images + lockfiles
2. Pin to vendor known-good; rebuild affected images
3. Rotate ALL secrets reachable from affected pipelines:
   - AWS/GCP/Azure keys & STS tokens
   - SSH keys (id_rsa, id_ed25519)
   - Kubernetes ServiceAccount tokens
   - npm/PyPI publish tokens, .npmrc, .env
4. Review cloud + GitHub audit logs since 2026-06-01

1 · Inventory affected packages (shell)

# Find the named tools + versions across the fleet / build images
for t in trivy kics litellm; do command -v "$t" >/dev/null 2>&1 && printf '%s: %s\n' "$t" "$($t --version 2>/dev/null | head -1)"; done
# Python SDK check
pip show telnyx 2>/dev/null | grep -E '^(Name|Version)'
# Grep lockfiles for the named packages
grep -REn 'trivy|kics|litellm|telnyx' --include=package-lock.json --include=requirements*.txt --include=poetry.lock . 2>/dev/null

2 · Harden npm/pip installs (CI config)

# npm: deterministic install, no lifecycle scripts, verified integrity
npm ci --ignore-scripts
# pip: require hashes so a swapped artifact fails closed
pip install --require-hashes -r requirements.txt
# Restrict runner egress (example: default-deny + registry allowlist at the network layer)
#   allow: registry.npmjs.org, pypi.org, files.pythonhosted.org, internal mirror
#   deny:  everything else (block the TeamPCP IPs/domains explicitly)

3 · Rotate exposed cloud/K8s credentials (CLI)

# AWS: deactivate + rotate any key used by CI
aws iam list-access-keys --user-name ci-deployer
aws iam update-access-key --access-key-id AKIAEXAMPLE --status Inactive --user-name ci-deployer
# Kubernetes: rotate a compromised ServiceAccount token (delete the secret; controller reissues)
kubectl -n build delete secret ci-deployer-token
# GitHub: revoke and reissue CI/publish tokens from org settings (audit tpcp-docs/docs-tpcp first)

Known gaps: The initial trojanized-package pull and the downstream use of stolen cloud/Kubernetes credentials happen off the endpoint (in the registry and in the cloud control plane) — those require dependency auditing and cloud/K8s/GitHub audit-log review (§7), not EDR telemetry. CI/CD runners frequently have no Falcon sensor, which is the single biggest coverage risk for this campaign; deploy sensors to runners or compensate with runner egress control. File hashes are unenumerated pending the IC3 FLASH PDF.