Unit 42 Details TeamPCP Supply-Chain Attacks on Trivy, KICS, LiteLLM and Telnyx
Summary
Unit 42 details TeamPCP’s Feb–Mar 2026 compromise of Trivy, KICS, LiteLLM and Telnyx packages, describing credential theft, CanisterWorm’s ICP-based C2 and wiper, and mitigations. Exfiltration scale is reported, not independently established here.
Key points
- Unit 42 reports that TeamPCP targeted Aqua Security Trivy, Checkmarx KICS, BerriAI LiteLLM and the Telnyx Python SDK between late February and March 2026.
- The Trivy wave used a compromised service account to force-push malicious code to repository tags; later attacks abused stolen GitHub personal access tokens and PyPI publishing credentials.
- Payloads were inserted into GitHub Actions and packages. The LiteLLM version 1.82.8 payload used a .pth file that ran when Python started; malicious Telnyx versions executed code on import.
- The reported payloads sought cloud credentials, SSH keys, Kubernetes secrets and LLM API keys. The article cites estimates of more than 300 GB of data and about 500,000 credentials, but does not establish those figures independently.
- CanisterWorm used an Internet Computer Protocol canister for C2 and included self-replication and wiper capabilities; the article says a wiper was observed targeting Iran on March 23.
- Recommendations include checking SBOMs for affected packages, pinning package versions, hardening CI/CD policies and auditing or rotating potentially exposed credentials.
Article Details
- Attack Vectors
- TeamPCP reportedly force-pushed malicious code to Trivy and KICS GitHub Action version tags, and compromised GitHub and PyPI publishing credentials to distribute altered packages.
- Malicious pre-install or post-install scripts in poisoned npm packages ran when developers or CI/CD runners installed them.
- A malicious litellm_init.pth file in LiteLLM version 1.82.8 executed during Python interpreter startup; poisoned LiteLLM versions 1.82.7 and 1.82.8 were uploaded to PyPI.
- Malicious Telnyx Python SDK versions 4.87.1 and 4.87.2 reportedly ran an injector on import and used WAV steganography to conceal encrypted second-stage payloads.
- The TeamPCP cloud stealer harvested cloud credentials, SSH keys, Kubernetes secrets, and LLM API keys; the article reports collection from environment files and cloud configuration directories.
- CanisterWorm used an ICP canister for C2 and reportedly spread by scanning exposed Docker APIs and local networks; its wiper component deployed privileged DaemonSets or recursively deleted files.
- Defensive Notes
- Maintain real-time SBOM visibility and use software composition analysis to identify affected or otherwise risky packages.
- Pin known package versions and Git dependencies to specific commit hashes; scan packages before implementing them.
- Harden CI/CD policies and review dependencies, including unused dependencies and packages installed without integrity checks.
- Audit and rotate GitHub personal access tokens, cloud-provider credentials, Kubernetes service account tokens, and container-based SSH keys.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | checkmarx[.]zone | Vendor-themed typosquat used by the Checkmarx-wave payload for data exfiltration. |
| DOMAIN | models[.]litellm[.]cloud | Typosquatted C2 and exfiltration domain used in the LiteLLM wave. |
| DOMAIN | scan[.]aquasecurtiy[.]org | Typosquatted TeamPCP exfiltration domain used by the Trivy-wave payload. |
| DOMAIN | tdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]io | Backup C2 domain used by the Trivy-wave payload. |
| HOSTNAME | championships-peoples-point-cassette[.]trycloudflare[.]com | Cloudflare tunnel hostname listed as infrastructure used for staging or redirects. |
| HOSTNAME | create-sensitivity-grad-sequence[.]trycloudflare[.]com | Cloudflare tunnel hostname listed as infrastructure used for staging or redirects. |
| HOSTNAME | investigation-launches-hearings-copying[.]trycloudflare[.]com | Cloudflare tunnel hostname listed as infrastructure used for staging or redirects. |
| HOSTNAME | plug-tab-protective-relay[.]trycloudflare[.]com | Cloudflare tunnel hostname listed as infrastructure used for staging or redirects. |
| HOSTNAME | souls-entire-defined-routes[.]trycloudflare[.]com | Cloudflare tunnel hostname listed as infrastructure used for staging or redirects. |
| IPV4 | 195[.]5[.]171[.]242 | IP listed in the article's TeamPCP C2 and infrastructure indicators. |
| IPV4 | 209[.]34[.]235[.]18 | IP listed in the article's TeamPCP C2 and infrastructure indicators. |
| IPV4 | 212[.]71[.]124[.]188 | IP listed in the article's TeamPCP C2 and infrastructure indicators. |
| IPV4 | 23[.]142[.]184[.]129 | IP listed in the article's TeamPCP C2 and infrastructure indicators. |
| IPV4 | 45[.]148[.]10[.]212 | IP listed in the article's TeamPCP C2 and infrastructure indicators. |
| IPV4 | 63[.]251[.]162[.]11 | IP listed in the article's TeamPCP C2 and infrastructure indicators. |
| IPV4 | 83[.]142[.]209[.]11 | IP listed in the article's TeamPCP C2 and infrastructure indicators. |
| IPV4 | 83[.]142[.]209[.]203 | IP listed in the article's TeamPCP C2 and infrastructure indicators. |
| SHA256 | 0880819ef821cff918960a39c1c1aada55a5593c61c608ea9215da858a86e349 | SHA-256 of a malicious file listed among TeamPCP payloads and binaries. |
| SHA256 | 18a24f83e807479438dcab7a1804c51a00dafc1d526698a66e0640d1e5dd671a | SHA-256 of a malicious file listed among TeamPCP payloads and binaries. |
| SHA256 | 30015dd1e2cf4dbd49fff9ddef2ad4622da2e60e5c0b6228595325532e948f14 | SHA-256 of a self-signed certificate associated with a TeamPCP operation wave. |
| SHA256 | 41c4f2f37c0b257d1e20fe167f2098da9d2e0a939b09ed3f63bc4fe010f8365c | SHA-256 of a self-signed certificate associated with a TeamPCP operation wave. |
| SHA256 | 61ff00a81b19624adaad425b9129ba2f312f4ab76fb5ddc2c628a5037d31a4ba | SHA-256 of a malicious file listed among TeamPCP payloads and binaries. |
| SHA256 | 7b5cc85e82249b0c452c66563edca498ce9d0c70badef04ab2c52acef4d629ca | SHA-256 of a malicious file listed among TeamPCP payloads and binaries. |
| SHA256 | 887e1f5b5b50162a60bd03b66269e0ae545d0aef0583c1c5b00972152ad7e073 | SHA-256 of a malicious file listed among TeamPCP payloads and binaries. |
| SHA256 | cd08115806662469bbedec4b03f8427b97c8a4b3bc1442dc18b72b4e19395fe3 | SHA-256 of a malicious file listed among TeamPCP payloads and binaries. |
| SHA256 | d8caf4581c9f0000c7568d78fb7d2e595ab36134e2346297d78615942cbbd727 | SHA-256 of a self-signed certificate associated with a TeamPCP operation wave. |
| SHA256 | e6310d8a003d7ac101a6b1cd39ff6c6a88ee454b767c1bdce143e04bc1113243 | SHA-256 of a malicious file listed among TeamPCP payloads and binaries. |
| SHA256 | e87a55d3ba1c47e84207678b88cacb631a32d0cb3798610e7ef2d15307303c49 | SHA-256 of a malicious file listed among TeamPCP payloads and binaries. |
| SHA256 | ecce7ae5ffc9f57bb70efd3ea136a2923f701334a8cd47d4fbf01a97fd22859c | SHA-256 of a malicious file listed among TeamPCP payloads and binaries. |
| SHA256 | f7084b0229dce605ccc5506b14acd4d954a496da4b6134a294844ca8d601970d | SHA-256 of a malicious file listed among TeamPCP payloads and binaries. |
MITRE ATT&CK
T1003.007 · Proc FilesystemThe first Trivy-wave script read runner.worker process memory through /proc/<pid>/mem to obtain plaintext tokens.T1021.007 · Cloud ServicesThe article reports Python-process requests to Kubernetes API endpoints for secrets, namespaces, and nodes, describing the activity as enumeration and lateral movement.T1041 · Exfiltration Over C2 ChannelThe payloads exfiltrated harvested credentials and secrets to TeamPCP C2 infrastructure.T1059.004 · Unix ShellThe kamikaze.sh loader used Bash scripts to run the multi-stage payload.T1059.006 · PythonPython loaders and the malicious LiteLLM .pth file executed payload code, including during Python interpreter startup.T1074 · Data StagedThe malware created local artifacts including session.key, payload.enc, session.key.enc, and tpcp.tar.gz in its staging and exfiltration activity.T1105 · Ingress Tool TransferA later kamikaze.sh loader downloaded the second-stage kube.py payload.T1195.002 · Compromise Software Supply ChainTeamPCP reportedly poisoned trusted GitHub Action tags and published malicious npm and PyPI package versions to compromise downstream development and CI/CD environments.T1485 · Data DestructionThe CanisterWorm wiper reportedly bricked Kubernetes clusters or recursively deleted files on non-containerized hosts.T1546.017 · Udev RulesThe litellm_init.pth file executed malicious code automatically when Python processes initialized.T1552.001 · Credentials In FilesPayloads harvested secrets from .env files, cloud configuration directories, and Kubernetes configuration files.T1552.004 · Private KeysThe malware harvested SSH keys from compromised environments.T1552.005 · Cloud Instance Metadata APIThe Trivy-wave payload queried instance metadata services to harvest cloud credentials.
CVE
Threat Actors
Malware
CanisterWormSSH keys and Kubernetes secrets at scale (reported >300 GB and ~500,000 credentials), deployed the CanisterWorm decentralized ICP canister C2 and added targeted wiper components for destructive operations.TeamPCP Cloud stealerMalicious payloads (TeamPCP cloud stealer / CanisterWorm) harvested cloud access tokens, SSH keys, Kubernetes secrets and high-density LLM API keys, then exfiltrated data to typosquatted domains and ICP canisters.
Vendors
Aqua Securitychain compromises that poisoned widely trusted open-source security and developer tooling — including Aqua Security Trivy, Checkmarx KICS, BerriAI LiteLLM and the Telnyx Python SDK — to plant infostealer payloads intoBerriAItrusted open-source security and developer tooling — including Aqua Security Trivy, Checkmarx KICS, BerriAI LiteLLM and the Telnyx Python SDK — to plant infostealer payloads into GitHub Actions and PyPI packages.Checkmarxpoisoned widely trusted open-source security and developer tooling — including Aqua Security Trivy, Checkmarx KICS, BerriAI LiteLLM and the Telnyx Python SDK — to plant infostealer payloads into GitHub Actions andPalo Alto NetworksAs of March 27, Palo Alto Networks Cortex Xpanse has identified the presence of three unique self-signed certificates associated with the three waves of operations.Telnyxsecurity and developer tooling — including Aqua Security Trivy, Checkmarx KICS, BerriAI LiteLLM and the Telnyx Python SDK — to plant infostealer payloads into GitHub Actions and PyPI packages.
Products
Cortex CloudCortex Cloud offers extensive application security posture management (ASPM) and supply chain security capabilities to help identify the vulnerabilities and misconfigurations that TeamPCP relies upon.GitHub ActionsTrivy, Checkmarx KICS, BerriAI LiteLLM and the Telnyx Python SDK — to plant infostealer payloads into GitHub Actions and PyPI packages.KICSwidely trusted open-source security and developer tooling — including Aqua Security Trivy, Checkmarx KICS, BerriAI LiteLLM and the Telnyx Python SDK — to plant infostealer payloads into GitHub Actions and PyPILiteLLMopen-source security and developer tooling — including Aqua Security Trivy, Checkmarx KICS, BerriAI LiteLLM and the Telnyx Python SDK — to plant infostealer payloads into GitHub Actions and PyPI packages.Telnyx Python SDKand developer tooling — including Aqua Security Trivy, Checkmarx KICS, BerriAI LiteLLM and the Telnyx Python SDK — to plant infostealer payloads into GitHub Actions and PyPI packages.Trivythat poisoned widely trusted open-source security and developer tooling — including Aqua Security Trivy, Checkmarx KICS, BerriAI LiteLLM and the Telnyx Python SDK — to plant infostealer payloads into GitHub