Two Arrests, One Supply-Chain Attack, and a Lot of Stolen Credentials
AFP charges two men over TeamPCP open-source supply-chain attacks that stole 500,000+ credentials from 1,000+ organizations via four malware families.
Australian police charged two Western Australian men as principal participants in TeamPCP, which allegedly inserted malicious code into open-source software to steal credentials and sensitive data from government, academia, and private sector organizations worldwide. The campaign compromised more than 1,000 organizations, harvested over 500,000 credentials, and exfiltrated at least 300 GB of data, with remediation costs in the hundreds of millions of dollars. Four malware families were deployed: CanisterWorm (cloud token harvesting), SANDCLOCK (AWS and Kubernetes credential theft), Mini Shai-Hulud (self-replicating npm/PyPI worm), and Miasma (credential-harvesting worm variant). Trojanized tools included Trivy, KICS, LiteLLM, and the Telnyx Python SDK, with exfiltration via GitHub repositories tpcp-docs and docs-tpcp.
- 14 combined charges filed after joint AFP, WAPF, and FBI investigation
- Four malware families: CanisterWorm, SANDCLOCK, Mini Shai-Hulud, and Miasma
- Exfiltration confirmed through GitHub repos tpcp-docs and docs-tpcp
- Malware harvested AWS, GCP, and Azure tokens plus crypto wallet data
- Investigators warn to check GitHub orgs for worm-created repositories
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1552.001 Credentials In FilesT1098.001 Additional Cloud CredentialsT1567.002 Exfiltration to Cloud StorageT1486 Data Encrypted for Impact
- Vendors
- Aqua Security
- Threat actors
- TeamPCP
- Countries
- Australia
From the original article
4 min read at securityaffairs.com
Australian police charged two men linked to TeamPCP over malware hidden in open-source code that stole 500,000+ credentials from 1,000+ organizations. Australian police have charged two men from Western Australia over a global cybercrime operation that allegedly hid malicious code in open-source software and used it to steal data from thousands of organisations.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.