TeamPCP-Linked Attack Compromises Microsoft DurableTask Python Packages

May 19, 2026 · Original article ↗

Summary

Wiz reports that TeamPCP-linked attackers used compromised GitHub credentials and a PyPI token to publish malware in durabletask 1.4.1–1.4.3. PyPI quarantined the packages; the payload steals credentials and can spread through AWS SSM and Kubernetes.

Key points

The compromised releases were durabletask 1.4.1, 1.4.2, and 1.4.3; PyPI quarantined them after Wiz’s analysis.
Wiz links the incident to a prior campaign wave: attackers allegedly used a compromised GitHub account to access repository secrets and obtain a PyPI publishing token.
The Linux payload can steal cloud, Kubernetes, Vault, filesystem, and password-manager credentials, scrape shell history, and propagate to up to five targets per infected host.
Check lockfiles and CI logs for the affected versions, and systems for /tmp/managed.pyz, /tmp/rope-*.pyz, and the listed infection markers.
If exposure is suspected, rotate potentially exposed credentials and review AWS CloudTrail for SSM activity, Kubernetes audit logs for unexpected kubectl exec, and password-manager CLI use.
Block C2 domains check[.]git-service[.]com and t[.]m-kosche[.]com; monitor for outbound requests to /v1/models, /audio.mp3, and /api/public/version.

Article Details

Attack Vectors: Compromised GitHub credentials were used to access a repository containing a PyPI token, which was then used to publish malicious durabletask versions 1.4.1, 1.4.2, and 1.4.3.
The packages contain a Python payload that steals credentials, attempts password-manager brute force, and propagates through AWS SSM and Kubernetes.
The payload communicates with primary and backup C2 infrastructure and uses identified endpoints for command activity and exfiltration.
Defensive Notes: Search lockfiles and CI logs for durabletask versions 1.4.1, 1.4.2, and 1.4.3; inspect Linux systems for the reported payload files, infection markers, and running process.
Rotate potentially exposed AWS, Azure, GCP, Kubernetes, Vault, and password-manager credentials; assume shell history may have been exfiltrated.
Review CloudTrail for SSM:SendCommand and SSM:DescribeInstanceInformation, Kubernetes audit logs for unexpected kubectl exec activity, and Bitwarden and 1Password CLI usage.
Block the reported C2 domains and outbound connections to /v1/models, /audio.mp3, and /api/public/version.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`check[.]git-service[.]com`	Primary C2 domain identified for the payload.
DOMAIN	`t[.]m-kosche[.]com`	Secondary C2 domain identified for the payload.
IPV4	`83[.]142[.]209[.]194`	Legacy C2 IP listed among the network indicators.
SHA256	`069ac1dc7f7649b76bc72a11ac700f373804bfd81dab7e561157b703999f44ce`	Hash listed for the malicious rope.pyz payload.
SHA256	`7d80b3ef74ad7992b93c31966962612e4e2ceb93e7727cdbd1d2a9af47d44ba8`	Hash listed for the compromised durabletask-1.4.1-py3-none-any.whl package.
SHA256	`877ff2531a63393c4cb9c3c86908b62d9c4fc3db971bc231c48537faae6cb3ec`	Hash listed for the compromised durabletask-1.4.3-py3-none-any.whl package.
SHA256	`aeaf583e20347bf850e2fabdcd6f4982996ba023f8c2cd56bbd299cfd56516f5`	Hash listed for the compromised durabletask-1.4.2-py3-none-any.whl package.
URL	`hxxps[:]//check[.]git-service[.]com/rope[.]pyz`	Payload URL identified for the malicious rope.pyz file.
URL	`hxxps[:]//t[.]m-kosche[.]com/rope[.]pyz`	Backup payload URL identified for the malicious rope.pyz file.