A previously unknown threat actor designated TeamPCP has been conducting an aggressive and evolving offensive across the internet. This group employs a self-propagating backdoor that spreads autonomously, coupled with a data-erasing component focused on systems in Iran. Security analysts first noted TeamPCP’s activities in December, when Flare researchers documented its use of a worm to exploit inadequately secured cloud platforms. The initial goal involved constructing a distributed proxy and scanning network to hijack servers for data theft, ransomware deployment, extortion, and cryptocurrency mining. TeamPCP distinguishes itself through sophisticated automation and the integration of established attack methods.
TeamPCP’s operations have intensified recently, with the group deploying continuously updated malware to expand its control over more systems. Last week, the group executed a supply-chain attack by compromising the GitHub account of Aqua Security, the developer of the widely used Trivy vulnerability scanner. This breach allowed TeamPCP to inject malicious code into nearly all versions of Trivy. Over the weekend, researchers observed the group distributing potent malware equipped with worm capabilities, enabling it to spread automatically without user interaction.
Upon infecting a machine, the malware searches for access tokens to the npm repository. It then compromises any publishable packages by creating new versions that include the malicious code. According to Aikido, the worm targeted 28 packages in under 60 seconds. Early iterations required manual intervention to spread across all packages accessible via a compromised npm token, but updated versions released over the weekend automated this process, significantly increasing its reach.
The worm’s command and control infrastructure relies on an unusual tamper-proof mechanism. It utilizes an Internet Computer Protocol-based canister, a type of self-enforcing smart contract designed to be impervious to third-party takedowns or alterations. This canister directs infected machines to ever-changing URLs hosting malicious binaries. By providing attackers with a dynamic method for the worm to locate control servers, they can continuously update URLs at any time. Infected systems report to the canister every 50 minutes.
TeamPCP’s campaign is notable for its persistence and adaptability, leveraging both novel techniques like the ICP canister and conventional supply-chain compromises. The inclusion of a data wiper targeting Iranian machines adds a geopolitical dimension to the attacks, though the group’s broader objectives remain focused on building infrastructure for various malicious activities. Security experts emphasize the need for robust access controls and monitoring of open-source repositories to mitigate such threats.
