THE threat actor known as TeamPCP has resurfaced with a dual campaign that blends cryptojacking and software supply chain abuse, targeting Redis installations and open‑source developer tools alike. According to The Hacker News, the group’s activity was first detected on 6 August 2026 and continued through the following day, showing a clear link to operations that began as early as 2020. The renewed focus highlights how long‑running criminal sets can pivot from pure mining to more disruptive intrusion chains.
Technical analysis from Oligo Security, reported by Infosecurity Magazine, shows that TeamPCP injects malicious modules into publicly available Redis packages, altering the startup routine to launch a concealed miner while also opening a backdoor for further commands. The altered packages are then pushed to popular code repositories where developers unwittingly pull them into build pipelines, allowing the threat to spread downstream into container images and Kubernetes clusters. No public CVE has been assigned to these modifications, reflecting the reliance on trusted‑source abuse rather than a software vulnerability.
The investigation uncovered shared infrastructure between TeamPCP and the previously tracked group TA‑NATALSTATUS, including overlapping command‑and‑control domains and identical malware file paths used for both cryptojacking payloads and post‑exploitation tools. Attackers make heavy use of mass‑scanning scripts that locate exposed Redis instances lacking authentication, then deploy a lightweight dropper that establishes persistence through altered systemd services or privileged containers.
In several cases the malware attempts to escape the container runtime by exploiting misconfigured privileged flags, giving the host level access to deploy additional modules.
Telemetry gathered between 6 and 7 August 2026 indicates active exploitation across Europe and Asia, with victims ranging from small development shops to larger managed service providers that rely on automated CI/CD pipelines. Researchers note that the timing coincides with heightened geopolitical tension in certain regions, suggesting the actors may be testing destructive capabilities alongside their profit‑driven mining operations. Collaboration between Oligo, Mandiant and GitLab led to the swift removal of associated accounts and the publication of indicators that defenders can now use to hunt for the threat.
Defenders should begin by auditing all third‑party dependencies for unsigned or altered components, enforcing strict signature verification before any code enters the build environment. Network monitors must be tuned to detect outbound connections to known mining pools or to anomalous DNS queries that match the command‑and‑control patterns identified by Oligo.
Runtime security tools that alert on the creation of privileged containers or on unexpected changes to systemd unit files can help catch the dropper before it establishes a foothold. Finally, ensuring that Redis instances are not exposed to the internet without strong authentication and disabling unnecessary modules reduces the attack surface that TeamPCP exploits.
Organisations are also encouraged to subscribe to threat intelligence feeds that file the specific hashes and YARA rules associated with the TeamPCP dropper, enabling proactive hunting across endpoints and container registries. Developers should be trained to verify the provenance of open‑source packages, preferring those with reproducible builds and transparent supply chain documentation. By combining hardened configuration, vigilant monitoring and educated teams, the risk of falling victim to this evolving supply chain and cryptojacking threat can be markedly reduced.