Hacker Group TeamPCP Traced to Redis Attacks Dating Back to 2020

A threat actor known as TeamPCP has been active in cybercrime since at least 2020, a new analysis from Oligo Security reveals, suggesting the group spent years compromising internet-facing infrastructure before pivoting to high-profile software supply chain attacks. Security researchers Avi Lumelsky and Gal Elbaz traced the group's origins through overlapping domains, malware deployment paths, staging techniques, and backend infrastructure. The findings show TeamPCP isn't a new actor that emerged in late 2025, but rather the continuation of an existing operational ecosystem.

The analysis connects TeamPCP to two campaigns observed in the second half of 2025: ShadowRay 2.0 (also called IronErn), which hijacked artificial intelligence infrastructure into a self-propagating botnet, and TA-NATALSTATUS, which targeted exposed Redis servers to deliver cryptocurrency miners. TA-NATALSTATUS is assessed to be an evolution of a campaign detailed by Trend Micro in April 2020 that involved targeting Redis servers to deploy malware. This indicates the threat actor has been actively attacking internet-accessible infrastructure across Ray, Docker, Redis, and React well before adopting the TeamPCP name. The attackers first drew attention toward the end of 2025 when they exploited security flaws in React Server Components and Next.js to extract credentials and sensitive data from compromised environments in an operation codenamed Operation PCPcat. Earlier this year, the group undertook a massive campaign to systematically target cloud native environments to build malicious infrastructure for follow-on exploitation, with goals that included data exfiltration, ransomware deployment, extortion, and cryptocurrency mining.

"One of the strongest operational links is the overlap between the IronErn GitHub and GitLab identities observed during ShadowRay 2.0 and TeamPCP's later infrastructure," the Oligo researchers noted. Correlating GitLab authentication logs, command-and-control infrastructure, reverse-shell activity, and malware staging establishes a direct operational bridge between the ShadowRay 2.0 campaign and the actor later operating publicly as TeamPCP, according to the report. The group has since branched into high-profile supply chain compromises, weaponizing the interconnected nature of modern software to infect developer systems en masse by poisoning popular open-source libraries through a combination of GitHub Actions and token theft abuse.

The report explains that the threat actor repeatedly abused known security flaws impacting React, Docker, Redis, and Ray to gain access and relied on automated and wormable exploitation techniques for self-propagation. The expansion into cascading software supply chain attacks represents a natural evolution of this trend, allowing the threat actors to take advantage of legitimate cloud infrastructure and repurpose tried and tested methods in their efforts. The group has continuously updated its malware arsenal, including a Python script called kube.py specifically used after breaching Kubernetes environments. While earlier versions focused on propagation and persistence, new variants observed as recently as March 2026 began to incorporate wiper-like functionality. This destructive code path checked whether the victim system was configured for the Iran timezone and, if so, fired a DaemonSet that wiped every node in the cluster via a wiper named Kamikaze. On Kubernetes nodes located outside of Iran, it deployed the CanisterWorm backdoor, while non-Kubernetes Iranian systems saw the malware execute a "poison_pill()" routine to erase the entire file system.

Whether this continuity reflects a direct rebrand, a shared operator set, or close collaboration between historically related actors can't be determined with complete certainty, the researchers said. What the evidence does show is that TeamPCP represents the continuation of an existing operational ecosystem rather than an entirely new threat actor that appeared in late 2025. The report's tracing of TeamPCP's six-year evolution underscores the difficulty of detecting adversaries who incrementally refine their tradecraft while moving laterally across different attack surfaces. Organizations that treat each campaign as isolated may miss the strategic patience required to defend against actors who blend infrastructure exploitation with supply chain manipulation over multi-year timelines.