- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Unknown
- Seen
- to 2026
- Status
- Active
- ATT&CK
- G1056 · 37 techniques
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0248 · teampcp
What it is
TeamPCP is a financially-motivated, cloud-native threat group that has been active since at least September 2025. Initially focused on ransomware and cryptocurrency theft, TeamPCP shifted in early 2026 to systematic, worm-driven credential theft and software supply chain attacks targeting Continuous Integration and Continuous Delivery (CI/CD) workflows. TeamPCP has monetized access through extortion and through partnerships with ransomware actors including Vect and CipherForce.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Altered Spider
- Mandiant
- UNC6780
- Microsoft
- Storm-2999
- Other names
- CanisterWorm, DeadCatx3, PCPCat, SHADOW-WATER-058, ShellForce
Tools
The tools and malware families the sources tie to it.
- CanisterWorm
- CrossRat
- GraphicBooting
- Mini Shai-Hulud
- TeamPCP Cloud Stealer
Sources
- MITRE ATT&CK attack.mitre.org
- Malpedia malpedia.caad.fkie.fraunhofer.de