TeamPCP Linked To Redis Attacks Dating Back To 2020 And Later Supply Chain Campaign
Summary: Oligo Security researchers Avi Lumelsky and Gal Elbaz linked the threat actor TeamPCP to Redis-server attacks dating to a campaign Trend Micro detailed in April 2020, citing overlapping domains, malware deployment paths, staging techniques, backend infrastructure, and tradecraft. The group's activity includes ShadowRay 2.0 (IronErn), which hijacked AI infrastructure into a self-propagating botnet, TA-NATALSTATUS, which targeted exposed Redis servers to deliver cryptocurrency miners, and later supply chain compromises poisoning open-source libraries through GitHub Actions and token theft abuse.
What you should know: A March 2026 variant of the group's kube.py script added wiper functionality: it checked for the Iran timezone and, if found, fired a DaemonSet that wiped every node in the cluster via a wiper named Kamikaze, while non-Kubernetes Iranian systems had their entire file system erased by a poison_pill() routine.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026