PCPJack Cloud Worm Evicts TeamPCP Tools and Steals Credentials

May 8, 2026 · Original article ↗

Summary

SentinelLABS analyzed PCPJack, a modular worm that removes TeamPCP artifacts, harvests cloud and developer credentials, and propagates through exposed services. A separate toolset deploys Sliver beacons and steals credentials from more than 30 services.

Key points

SentinelLABS discovered PCPJack on April 28, 2026, while investigating a script that removed artifacts associated with TeamPCP.
PCPJack harvests secrets from local files, cloud and container services, developer tools, and financial platforms, then attempts to spread through exposed Docker, Kubernetes, Redis, MongoDB, RayML, and vulnerable web applications.
Its modules establish persistence through systemd or cron, use Kubernetes, Docker, Redis, RayML, MongoDB, and SSH for propagation or lateral movement, and communicate through Telegram.
Stolen data is encrypted before Telegram exfiltration, but the article notes the tool may fall back to sending plaintext if its cryptography dependency is unavailable.
A separate toolset on the same delivery server deploys Sliver beacons and harvests credentials from more than 30 services before exfiltrating data to a typosquatted domain.
SentinelLABS found no cryptocurrency-mining functionality in either toolset. Researchers said they had no evidence that the PCPJack operator was associated with TeamPCP.
The researchers recommend secret management, MFA for service accounts, enforcing AWS IMDSv2, and requiring authentication for Docker and Kubernetes management services.

Article Details

Attack Vectors: bootstrap.sh sets up the Linux environment, downloads PCPJack modules from attacker-hosted S3 storage, and establishes persistence through a systemd service or cron jobs.
PCPJack propagates by exploiting exposed services and web applications; the article identifies CVE-2025-29927, CVE-2025-55182, CVE-2026-1357, CVE-2025-9501, and CVE-2025-48703.
The framework harvests credentials and secrets from files, environment variables, SSH stores, cloud instance metadata, Kubernetes service accounts, Docker secrets, and Git history.
For internal propagation, PCPJack abuses Kubernetes APIs, Docker sockets, Redis configuration, RayML jobs, MongoDB access, and SSH credentials; it also attempts container escape by mounting the host filesystem.
PCPJack sends encrypted stolen data through Telegram channels. A separate toolset installs Sliver beacons, harvests credentials from more than 30 services, and exfiltrates data to a typosquatted endpoint.
The second toolset SSH-sprays up to 10 lateral targets before deleting itself.
Defensive Notes: Use an enterprise-wide vault or secrets-management service, and do not store access to secret stores in cleartext files.
Require MFA for service accounts rather than relying on API keys alone.
Enforce IMDSv2 across AWS services to reduce credential theft through instance metadata.
Allow-list downloads to approved S3 resources.
Require authentication for Docker and Kubernetes management interfaces, including when systems are not internet-exposed.
Restrict Kubernetes service-account scopes according to least privilege.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`lastpass-login-help[.]com`	Phishing domain reported on an infrastructure IP and identified as harvesting LastPass master credentials.
IPV4	`161[.]97[.]129[.]25`	Hardcoded in bootstrap.sh's attacker-infrastructure exclusion list; attribution to the PCPJack operator is uncertain.
IPV4	`161[.]97[.]135[.]154`	Hardcoded in bootstrap.sh's attacker-infrastructure exclusion list; attribution to the PCPJack operator is uncertain.
IPV4	`161[.]97[.]163[.]87`	Hardcoded in bootstrap.sh's attacker-infrastructure exclusion list; attribution to the PCPJack operator is uncertain.
IPV4	`161[.]97[.]186[.]175`	Hardcoded in bootstrap.sh's attacker-infrastructure exclusion list; attribution to the PCPJack operator is uncertain.
IPV4	`161[.]97[.]187[.]42`	Hardcoded in bootstrap.sh's attacker-infrastructure exclusion list; attribution to the PCPJack operator is uncertain.
IPV4	`193[.]187[.]129[.]143`	Hardcoded in bootstrap.sh's attacker-infrastructure exclusion list; attribution to the PCPJack operator is uncertain.
IPV4	`213[.]136[.]80[.]73`	Hardcoded in bootstrap.sh's attacker-infrastructure exclusion list; attribution to the PCPJack operator is uncertain.
IPV4	`38[.]242[.]204[.]245`	Hardcoded in bootstrap.sh's attacker-infrastructure exclusion list; attribution to the PCPJack operator is uncertain.
IPV4	`38[.]242[.]237[.]196`	Hardcoded in bootstrap.sh's attacker-infrastructure exclusion list; attribution to the PCPJack operator is uncertain.
IPV4	`38[.]242[.]245[.]147`	Hardcoded in bootstrap.sh's attacker-infrastructure exclusion list and reported to have hosted the LastPass credential-phishing domain; attribution to the PCPJack operator is uncertain.
IPV4	`83[.]171[.]249[.]231`	Hardcoded in bootstrap.sh's attacker-infrastructure exclusion list; attribution to the PCPJack operator is uncertain.
SHA1	`005587975a483876c1fa26b64b418931019be38f`	SHA-1 hash of the Sliver beacon binary update.bin.
SHA1	`01cebc48016395e284ac76afc1816f143ee3e7b6`	SHA-1 hash of the PCPJack cloud_scan.py component.
SHA1	`0b86434ca5145636d745222f7e49c903ce6ef538`	SHA-1 hash of the PCPJack worm.py orchestrator.
SHA1	`2cd2c5268e41cdece1b0506bcda3b9eba2998119`	SHA-1 hash of the PCPJack crypto_util.py component.
SHA1	`2fab324eb0d927846c8744dc0e217beea65138e0`	SHA-1 hash of the Sliver beacon binary update-386.bin.
SHA1	`339cbf61c80f757085c5afb7304d69f323bdf87a`	SHA-1 hash of the second toolset's check.sh script.
SHA1	`6060da100b5cd587131a1c11a20d6e0108604744`	SHA-1 hash of the Sliver beacon binary update-arm.bin.
SHA1	`848ef1f638807826586802428a7ebafdc710915c`	SHA-1 hash of the PCPJack cloud_ranges.py component.
SHA1	`9c7ab48c9fdbbeecdad8433529bdab38584f0e25`	SHA-1 hash of the PCPJack utils.py credential-parsing component.
SHA1	`a20a9924d92c2b06d82b79c0fe87451c650cabec`	SHA-1 hash of the PCPJack bootstrap.sh dropper.
SHA1	`c2dd8051d89c4efa71bd67d2df7d9b4bc3e67810`	SHA-1 hash of the PCPJack bootstrap.sh dropper.
SHA1	`fed52a4bbac7b5b6ae4f76cab3eadd67e79227e3`	SHA-1 hash of the PCPJack lateral.py component.
URL	`hxxps[:]//cdn[.]cloudfront-js[.]com:8443/u`	Specific typosquatted endpoint used by the second toolset to exfiltrate stolen data.
URL	`hxxps[:]//spm-cdn-assets-dist-2026[.]s3[.]us-east-2[.]amazonaws[.]com`	PCPJack payload-hosting URL configured in bootstrap.sh; the article says the S3 resource was likely registered by the attacker for unauthorized purposes.