Ransomwarehigh
FBI: TeamPCP Compromised Dev Tools to Steal Cloud Credentials
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-55182 | Unauthenticated RCE in React Server Components (React2Shell) | 10.0 | 100% | KEVRansomwarePoC ×14 | KEV |
| CVE-2026-33634 | Embedded Malicious Code in Aquasecurity Trivy, trivy-action, and setup-trivy Releases | 9.4 | 60% | KEVPoC ×2 | KEV |
| CVE-2026-45321 | Supply chain compromise: credential-stealing code in 42 @tanstack/* npm packages | 9.6 | 3% | KEVRansomwarePoC ×2 | KEV |
| CVE-2026-48027 | Malicious Code Embedded in Nx Console VS Code Extension 18.95.0 | 9.3 | 2% | KEVRansomwarePoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | checkmarx.zone | also includes 27 file hashes and a set of domains including checkmarx[.]zone, models.litellm[.]cloud, git-tanstack[.]com, and recv.hac |
| domain | git-tanstack.com | domains including checkmarx[.]zone, models.litellm[.]cloud, git-tanstack[.]com, and recv.hackmoltrepeat[.]com, among others. The indicat |
| domain | hackmoltrepeat.com | ]zone, models.litellm[.]cloud, git-tanstack[.]com, and recv.hackmoltrepeat[.]com, among others. The indicators in this alert are derived f |
| domain | litellm.cloud | hes and a set of domains including checkmarx[.]zone, models.litellm[.]cloud, git-tanstack[.]com, and recv.hackmoltrepeat[.]com, among |
| ipv4 | 45.148.10.212 | . Six IP addresses appear in the indicators: 83.142.209.11, 45.148.10.212, 83.142.209.194, 83.142.209.203, 94.154.172.43, and 67.217. |
| ipv4 | 67.217.57.240 | .10.212, 83.142.209.194, 83.142.209.203, 94.154.172.43, and 67.217.57.240. The indicator set also includes 27 file hashes and a set o |
| ipv4 | 83.142.209.11 | CVE-2025-55182 . Six IP addresses appear in the indicators: 83.142.209.11, 45.148.10.212, 83.142.209.194, 83.142.209.203, 94.154.172. |
| ipv4 | 83.142.209.194 | ses appear in the indicators: 83.142.209.11, 45.148.10.212, 83.142.209.194, 83.142.209.203, 94.154.172.43, and 67.217.57.240. The indi |
| ipv4 | 83.142.209.203 | e indicators: 83.142.209.11, 45.148.10.212, 83.142.209.194, 83.142.209.203, 94.154.172.43, and 67.217.57.240. The indicator set also i |
| ipv4 | 94.154.172.43 | .142.209.11, 45.148.10.212, 83.142.209.194, 83.142.209.203, 94.154.172.43, and 67.217.57.240. The indicator set also includes 27 file |
From the original article
5 min read at securityaffairs.com
FBI says TeamPCP poisoned trusted developer tools to steal cloud credentials, spread malware through software updates, and extort victims. On July 2, 2026, the FBI published a FLASH alert identifying the criminal group called TeamPCP and detailing how it compromised widely used developer and security tools to steal credentials from victim environments at scale. The targets weren’t end users.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.