PCPJack Malware Steals Cloud Credentials and Removes TeamPCP Access
Summary
SentinelLabs says PCPJack targets exposed cloud systems, steals credentials, and removes TeamPCP artifacts. The malware spreads through vulnerable services, moves laterally, establishes persistence, and sends encrypted, chunked data to Telegram.
Key points
- SentinelLabs says PCPJack infects Linux cloud systems through a shell script, then downloads modules, establishes persistence, and launches its main orchestrator.
- The malware removes TeamPCP processes, files, containers, services, and persistence artifacts; researchers say it may have been developed by a former TeamPCP operator.
- PCPJack scans exposed Docker, Kubernetes, Redis, MongoDB, and RayML services, and exploits vulnerabilities including CVE-2025-29927, CVE-2025-55182, and CVE-2026-1357.
- It steals credentials and secrets, including SSH keys and cloud and developer-service credentials, and can move laterally by accessing reachable internal hosts.
- Stolen data is encrypted with X25519 ECDH and ChaCha20-Poly1305, split into 2,800-byte chunks, and exfiltrated through Telegram.
- Researchers found a Sliver-based backdoor on the actor's infrastructure. Recommended mitigations include MFA, authenticated Docker and Kubernetes services, least privilege, and avoiding plaintext secrets.
Article Details
- Attack Vectors
- PCPJack scans exposed cloud infrastructure for services including Docker, Kubernetes, Redis, MongoDB, and RayML, then attempts to exploit known vulnerabilities.
- The article reports exploitation of CVE-2025-29927, CVE-2025-55182, CVE-2026-1357, CVE-2025-9501, and CVE-2025-48703.
- After initial access, PCPJack harvests SSH keys and credentials, enumerates Kubernetes clusters and Docker daemons, and executes itself on reachable internal hosts.
- On Linux-based cloud systems, PCPJack uses bootstrap.sh to install dependencies, download modules, establish persistence, and launch monitor.py.
- Defensive Notes
- Enforce multi-factor authentication.
- Use IMDSv2 in AWS.
- Require proper authentication for Docker and Kubernetes services.
- Apply least-privilege principles.
- Avoid storing secrets in plaintext.
MITRE ATT&CK
T1046 · Network Service DiscoveryPCPJack scans external cloud infrastructure for exposed services, including Docker, Kubernetes, Redis, MongoDB, and RayML.T1053.003 · CronPCPJack establishes persistence using cron jobs and Redis cron rewrites.T1059.004 · Unix ShellThe malware infects Linux-based cloud systems using the shell script bootstrap.sh.T1105 · Ingress Tool TransferDuring setup, PCPJack downloads additional modules.T1190 · Exploit Public-Facing ApplicationPCPJack scans exposed services and attempts to exploit known vulnerabilities to gain access.T1543.002 · Systemd ServicePCPJack establishes persistence using systemd services.T1552.004 · Private KeysDuring lateral movement, PCPJack harvests SSH keys.T1564.001 · Hidden Files and DirectoriesPCPJack creates a hidden working directory on infected systems.T1567 · Exfiltration Over Web ServicePCPJack exfiltrates stolen credentials and other data to Telegram channels.T1613 · Container and Resource DiscoveryPCPJack enumerates Kubernetes clusters and Docker daemons inside compromised environments.
CVE
CVE-2025-29927vercel · next.jsCVE-2025-29927: auth bypass in Next.js middleware via crafted headerCVE-2025-48703centos-webpanel · CentOS Web PanelCVE-2025-48703: shell injection in CentOS Web Panel Filemanager changePerm functionalityCVE-2025-55182Meta · react-server-dom-parcel; Meta · react-server-dom-turbopack; +1 moreCVE-2025-55182 (“React2Shell”): Server Actions deserialization flaw in React and Next.jsCVE-2025-9501Vendor / Product unavailableCVE-2025-9501: PHP injection in W3 Total Cache via cached mfunc commentCVE-2026-1357wpvividplugins · WPvivid — Backup, Migration & StagingCVE-2026-1357: unauthenticated file upload in WPVivid Backup
Threat Actors
Malware
Vendors
Products
CentOS Web PanelCVE-2025-48703: shell injection in CentOS Web Panel Filemanager changePerm functionalityDigitalOceanservices, databases, SSH keys, Slack tokens, WordPress configs, OpenAI keys, Anthropic keys, Discord, DigitalOcean, and more.Discordfinancial services, databases, SSH keys, Slack tokens, WordPress configs, OpenAI keys, Anthropic keys, Discord, DigitalOcean, and more.DockerIt targets services and applications such as Docker, Kubernetes, Redis, MongoDB, RayML, and vulnerable web apps, and may be linked to a former TeamPCP affiliate.KubernetesIt targets services and applications such as Docker, Kubernetes, Redis, MongoDB, RayML, and vulnerable web apps, and may be linked to a former TeamPCP affiliate.MongoDBIt targets services and applications such as Docker, Kubernetes, Redis, MongoDB, RayML, and vulnerable web apps, and may be linked to a former TeamPCP affiliate.Next.jsCVE-2025-29927: auth bypass in Next.js middleware via crafted headerRayMLIt targets services and applications such as Docker, Kubernetes, Redis, MongoDB, RayML, and vulnerable web apps, and may be linked to a former TeamPCP affiliate.ReactCVE-2025-55182 (“React2Shell”): Server Actions deserialization flaw in React and Next.jsRedisIt targets services and applications such as Docker, Kubernetes, Redis, MongoDB, RayML, and vulnerable web apps, and may be linked to a former TeamPCP affiliate.Slacktargeting cloud environments, developer systems, messenger apps, financial services, databases, SSH keys, Slack tokens, WordPress configs, OpenAI keys, Anthropic keys, Discord, DigitalOcean, and more.TelegramIt exfiltrates stolen data to Telegram after encrypting and chunking it.W3 Total CacheCVE-2025-9501: PHP injection in W3 Total Cache via cached mfunc commentWordPressenvironments, developer systems, messenger apps, financial services, databases, SSH keys, Slack tokens, WordPress configs, OpenAI keys, Anthropic keys, Discord, DigitalOcean, and more.WPVivid BackupCVE-2026-1357: unauthenticated file upload in WPVivid Backup