Research reports
1,224 reports from 387 publishers45 added in the past week
Added Thu 6 Aug
CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets Iran
We found a new payload in the TeamPCP arsenal, and this one doesn't just steal credentials or install backdoors. It wipes entire Kubernetes clusters. The script uses the exact same ICP canister ( tdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]io ) we documented…
Malware
Popular telnyx package compromised on PyPI by TeamPCP
The pattern is consistent: steal credentials from a trusted security tool, use those credentials to push malicious versions of whatever that tool had access to, collect whatever's running in the next environment, repeat. Where This Fits in the Campaign A…
Supply chain
TeamPCP deploys CanisterWorm on NPM following Trivy compromise
On 20 Mar 2026, 20:45 UTC, we detected a large number of packages being compromised on NPM with a new worm that hasn't been observed before. We're calling this specific attack CanisterWorm, because it makes use of an ICP Canister for its C2 dead-drop, which…
Supply chain
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.