TEAMPCP turns cloud infrastructure into crime bots, with a threat actor systematically targeting misconfigured and exposed cloud management services and control interfaces to hijack infrastructure, expand its operations, and monetise compromised systems.
The campaign appears to have started in late December 2025 and has already compromised at least 60,000 servers worldwide via a worm-like attack that scans for and infects the next vulnerable target; according to Flare, the operation is tracked as TeamPCP and operates under several aliases including PCPcat and ShellForce.
The group harvests credentials in Kubernetes environments using a script (kube[.]py) and relies on exposed Docker APIs, Kubernetes clusters, Redis servers, Ray dashboards, and React2Shell vulnerabilities such as CVE-2025-29927. More than 60% of the attacks involve cloud infrastructure hosted on Azure, with 37% on AWS, and targeted servers also stretch across Google and Oracle cloud environments.
Flare found multiple revenue streams, including cryptomining, selling access to compromised systems, and hosting data exfiltration and command-and-control infrastructure for ransomware, with stolen data sometimes published on a data-leak site operated by ShellForce and exemplified by the JobsGO breach of over two million records.