Investigation Maps TeamPCP’s Cross-Platform Activity Through Shared Accounts and Infrastructure
Summary
An investigation links TeamPCP, CipherForce and PCPcat through historical infrastructure, recurring account identifiers and cross-platform posts. It cautions that some correlations and claims remain unresolved and do not establish real-world identities.
Key points
- Historical snapshots reportedly showed an onion site associated with a CipherForce victim listing operating as CipherForce in March 2026 and later under the TeamPCP name.
- A Session ID and TOX ID recurred across CipherForce-related material and TeamPCP forum posts, helping investigators trace links across platforms.
- A TeamPCP forum account claimed a co-owner role, including responsibilities for staffing, infrastructure, partnerships and platform resources.
- A TeamPCP account offered approximately 4,000 private-code repositories and internal organizations for sale; the post named a $50,000 minimum offer and showed a $95,000 offer. The article does not independently verify access to the material.
- A separate BulkDMT post shared the Session ID but had a different TOX ID and predated the CipherForce activity; the article treats the connection as unresolved.
- A Telegram message claimed that forum owners had been arrested and that the site would become a honeypot; the article says these claims were not independently established.
- The article describes earlier reporting of PCPcat exploitation involving Next.js and React environments, with a headline citing more than 59,000 affected servers.
Article Details
- Attack Vectors
- PCPcat was associated with a report of exploitation targeting Next.js and React environments; the report said more than 59,000 servers were affected.
- A TeamPCP account advertised approximately 4,000 private-code repositories and internal organizations for sale. The account described the sale as non-extortionate and said the material might otherwise be leaked.
- CipherForce's victim page listed BMW Group internal documents/recon as for sale; the article does not establish how the material was obtained.
MITRE ATT&CK
People
Threat Actors
CipherForceCipherForce was listed in ransomware monitoring with victims, and its associated onion page offered BMW Group internal documents/recon for sale. Historical snapshots reportedly showed the onion site operating as CipherForce before it appeared under the TeamPCP name.TeamPCPA TeamPCP account advertised private source-code repositories for sale and claimed a role in managing Breached. The article links TeamPCP to CipherForce through recurring identifiers and branding but does not establish a definitive real-world attribution.
Products
Breachedhttps://breached.**/threads/bmw-group********3GitHubThe post, titled “Internal Github Source Code,” appeared at:TelegramNames such as PCPcat, ShellForce, DeadCatx3 and CipherForce appear across different parts of the ecosystem, while the group's presence has also extended into underground forum administration and Telegram communications.