Full Report
Oligo Security uncovered evidence of a long operational history, including multiple previous attacks it traced to the same attacker infrastructure and tools. The post Open-source software’s archenemy TeamPCP goes back further than anyone thought appeared first on CyberScoop.
Analysis Summary
# Threat Actor: TeamPCP
## Attribution & Identity
**TeamPCP** is an active threat group that emerged as a public "brand" in late 2025 but has an operational history dating back to at least 2020. The group is notable for its lack of operational security regarding its public profile, even linking malicious infrastructure to its official GitHub account.
**Known Aliases and Associations:**
* **TA-NATALSTATUS**
* **IronErn**
* **Oligo Security** (Primary research source)
## Activity Summary
TeamPCP has recently conducted a massive campaign targeting the open-source software supply chain, compromising and injecting malicious code into over 1,000 software packages in early 2026.
Key historical operations include:
* **ShadowRay 2.0 (Late 2025):** Exploited AI infrastructure vulnerabilities to create the first known self-propagating botnet running on hijacked AI resources.
* **Broad Public Campaigns (Late 2025 - 2026):** Aggressive, "noisy" campaigns characterized by social media boasting and public claims of victims.
## Tactics, Techniques & Procedures
* **AI-Augmented Payloads:** Uses AI to rapidly evolve and adapt malware payloads to specific target environments at speeds far exceeding traditional human-led development.
* **Supply Chain Compromise:** Injection of malicious code into open-source software packages to exploit the trust model of automated deployment systems.
* **Self-Propagating Botnets:** Development of worms designed to spread across hijacked AI and cloud infrastructure.
* **Infrastructure Orchestration:** Leveraging AI to control C2 infrastructure and orchestrate large-scale attacks.
* **Exploitation of ShadowRay:** Targeting vulnerabilities in AI frameworks (specifically Ray) to gain initial access.
## Targeting
* **Sectors:** Open-source software development, AI infrastructure providers, and organizations heavily reliant on automated code deployment.
* **Geography:** Global (described as a "global campaign").
* **Victims:** Over 1,000 open-source software packages; organizations using hijacked AI infrastructure.
## Tools & Infrastructure
* **Malware:** Rapidly evolving AI-generated payloads; self-propagating botnet code.
* **Infrastructure:**
* **C2:** Integrated command-and-control servers used for cross-campaign orchestration.
* **File Servers:** Shared repositories for hosting malicious payloads.
* **GitHub:** Official account used to link to attacker-controlled domains.
* **Domains/IPs:** (Historical infrastructure remains consistent across aliases like IronErn and TA-NATALSTATUS).
## Implications
TeamPCP represents a shift toward "AI-powered" threat actors. Their ability to rapidly iterate malware and automate the exploitation of complex AI environments suggests that traditional, slower defense mechanisms are becoming obsolete. By targeting the open-source supply chain, they jeopardize the foundational trust of modern software development. Their "noisy" branding indicates a high level of confidence and a potential shift toward hacktivism or brand-building for future Ransomware-as-a-Service (RaaS) operations.
## Mitigations
* **Supply Chain Security:** Implement rigorous software composition analysis (SCA) and integrity checking for all open-source dependencies.
* **AI Infrastructure Hardening:** Specifically patch and secure AI orchestration frameworks (e.g., Ray) and ensure AI environments are not exposed to the public internet without strict authentication.
* **Behavioral Monitoring:** Move beyond signature-based detection toward behavioral analysis to counter AI-generated payloads that change rapidly.
* **Visibility:** Increase monitoring of automated deployment pipelines to detect unauthorized code injections before they reach production.