Excerpt
The pattern is consistent: steal credentials from a trusted security tool, use those credentials to push malicious versions of whatever that tool had access to, collect whatever's running in the next environment, repeat. Where This Fits in the Campaign
A quick recap of what TeamPCP has done over the past two weeks:
March 19: Trivy compromised. A…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Aikido on aikido.dev.
Mentioned in the excerpt
More from Aikido2
- CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets IranAikido · Published 22 Mar
- TeamPCP deploys CanisterWorm on NPM following Trivy compromiseAikido · Published 20 Mar
On the same topics
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Trust the Tunnel, Get the Trojan: Silver Fox Delivers Atlas RAT via Weaponized VPN Installershexastrike.com · Published 25 Mar
- Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent TrafficThe Hacker News · Published 19 Oct
- Investigating Ephemeral Supply Chain TamperingMandiant (Google) · Published 15 Oct
