cyber.hendryadrian.com
Threat Research · securityweek.com

PCPJack Worm Removes TeamPCP Artifacts and Steals Credentials

· Original article ↗

Summary

SentinelOne reports that PCPJack removes artifacts from TeamPCP infections, steals credentials across cloud and other services, and attempts to spread through vulnerable web applications and exposed deployments.

Key points

  • The campaign has been active since late April. Its Linux script first searches for and removes processes and artifacts associated with TeamPCP infections.
  • The script downloads six modules, establishes persistence and launches an orchestrator; the modules handle credential parsing, lateral movement, encrypted C&C messages, cloud lookups and scanning.
  • PCPJack targets files, environment variables, SSH keys, cryptocurrency wallets, credentials and tokens for services including AWS, Kubernetes, Docker, GitHub, Slack and WordPress.
  • The framework attempts to spread by exploiting listed vulnerabilities in Next.js, React, WordPress plugins and CentOS Web Panel, and by using credentials or SSH keys to reach other deployments and machines.
  • PCPJack uses Telegram for C&C and encrypts data sent to its channel.
  • SentinelOne also identified a related toolset that includes Sliver implants and credential theft targeting dozens of cloud services. SentinelOne says the operator could be a former TeamPCP member, but this is an assessment, not confirmed attribution.

Article Details

Attack Vectors
  • A Linux shell script removes artifacts associated with TeamPCP infections, sets up a Python virtual environment, downloads six modules from an AWS S3 bucket, and launches the framework orchestrator.
  • PCPJack collects .env and configuration files, environment variables, SSH keys, cryptocurrency wallets, credentials, and tokens from the infected system.
  • The framework scans cloud environments and attempts to propagate using extracted credentials across Kubernetes, Docker, Redis, RayML, and MongoDB deployments.
  • The framework uses SSH keys to run its initial script on remote machines and targets known web-application vulnerabilities, including the five listed CVEs, to attempt further infection.
  • PCPJack downloads Parquet files from Common Crawl to identify additional internet targets and uses Telegram for command and control, encrypting data sent to its channel.

MITRE ATT&CK

T1021.004 · SSHPCPJack uses extracted SSH keys to execute its initial script on remote machines.T1046 · Network Service DiscoveryThe framework includes cloud scanning and attempts to identify and infect additional internet targets.T1059.004 · Unix ShellThe infection begins with a Linux shell script that prepares the environment and fetches payloads.T1059.006 · PythonPCPJack creates a Python virtual environment and launches a Python module as its framework orchestrator.T1070.004 · File DeletionThe script removes files and artifacts associated with TeamPCP infections and deletes itself after launching the framework.T1078 · Valid AccountsThe framework attempts to propagate across cloud and deployment environments using extracted credentials.T1105 · Ingress Tool TransferThe shell script downloads six modules from an AWS S3 bucket, and the framework downloads Parquet files from Common Crawl.T1190 · Exploit Public-Facing ApplicationThe spreading module targets known vulnerabilities in web applications to attempt infection.T1552.001 · Credentials In FilesPCPJack searches for credentials in .env files, configuration files, and environment variables.T1552.004 · Private KeysThe framework collects SSH keys from infected systems.T1573 · Encrypted ChannelPCPJack encrypts data sent to its Telegram command-and-control channel.

CVE

CVE-2025-29927vercel · next.jsThe spreading module targets known vulnerabilities in web applications, including CVE-2025-29927 (Next.js), CVE-2025-55182 (React2Shell), CVE-2026-1357 (WPVivid Backup plugin for WordPress), CVE-2025-9501 (W3 TotalCVE-2025-48703centos-webpanel · CentOS Web Panel(WPVivid Backup plugin for WordPress), CVE-2025-9501 (W3 Total Cache plugin for WordPress), and CVE-2025-48703 (CentOS Web Panel).CVE-2025-55182Meta · react-server-dom-parcel; Meta · react-server-dom-turbopack; +1 moremodule targets known vulnerabilities in web applications, including CVE-2025-29927 (Next.js), CVE-2025-55182 (React2Shell), CVE-2026-1357 (WPVivid Backup plugin for WordPress), CVE-2025-9501 (W3 Total CacheCVE-2025-9501Vendor / Product unavailable(Next.js), CVE-2025-55182 (React2Shell), CVE-2026-1357 (WPVivid Backup plugin for WordPress), CVE-2025-9501 (W3 Total Cache plugin for WordPress), and CVE-2025-48703 (CentOS Web Panel).CVE-2026-1357wpvividplugins · WPvivid — Backup, Migration & Stagingin web applications, including CVE-2025-29927 (Next.js), CVE-2025-55182 (React2Shell), CVE-2026-1357 (WPVivid Backup plugin for WordPress), CVE-2025-9501 (W3 Total Cache plugin for WordPress), and

Threat Actors

TeamPCPThe article identifies TeamPCP as a hacking group behind recent supply chain attacks targeting multiple open-source software ecosystems. PCPJack removes artifacts associated with TeamPCP infections.

Malware

PCPJackSentinelOne has named the framework PCPJack, due to its focus on removing from the infected systems any tools and artifacts associated with TeamPCP, the hacking group behind a recent flurry of supply chain attacks

Products

AWSNext, the script creates a Python virtual environment, downloads six modules from an AWS S3 bucket, renames them, establishes persistence, launches the first module, which serves as the main framework orchestrator, andCentOS Web Panelplugin for WordPress), CVE-2025-9501 (W3 Total Cache plugin for WordPress), and CVE-2025-48703 (CentOS Web Panel).Dockerwallets, credentials, and tokens for various web apps and cloud services, including AWS, Kubernetes, Docker, Gmail, GitHub, Office 365/Outlook, RayML, Slack, and WordPress.Kubernetescryptocurrency wallets, credentials, and tokens for various web apps and cloud services, including AWS, Kubernetes, Docker, Gmail, GitHub, Office 365/Outlook, RayML, Slack, and WordPress.MongoDBPCPJack also attempts to use the extracted credentials to propagate across Kubernetes, Docker, Redis, RayML, and MongoDB deployments, and leverages SSH keys to execute the initial script on remote machines.Next.jsThe spreading module targets known vulnerabilities in web applications, including CVE-2025-29927 (Next.js), CVE-2025-55182 (React2Shell), CVE-2026-1357 (WPVivid Backup plugin for WordPress), CVE-2025-9501 (W3 TotalRayMLweb apps and cloud services, including AWS, Kubernetes, Docker, Gmail, GitHub, Office 365/Outlook, RayML, Slack, and WordPress.RedisPCPJack also attempts to use the extracted credentials to propagate across Kubernetes, Docker, Redis, RayML, and MongoDB deployments, and leverages SSH keys to execute the initial script on remote machines.W3 Total CacheCVE-2025-55182 (React2Shell), CVE-2026-1357 (WPVivid Backup plugin for WordPress), CVE-2025-9501 (W3 Total Cache plugin for WordPress), and CVE-2025-48703 (CentOS Web Panel).WordPresscloud services, including AWS, Kubernetes, Docker, Gmail, GitHub, Office 365/Outlook, RayML, Slack, and WordPress.WPVivid Backupapplications, including CVE-2025-29927 (Next.js), CVE-2025-55182 (React2Shell), CVE-2026-1357 (WPVivid Backup plugin for WordPress), CVE-2025-9501 (W3 Total Cache plugin for WordPress), and CVE-2025-48703 (CentOS

Tools

Sliverthe framework, SentinelOne identified a second toolset associated with the threat actor, which includes Sliver implants and credential theft across dozens of cloud services, including Anthropic, Digital Ocean,

Related Articles