Oligo Traces TeamPCP Activity Back to 2020
Summary
Oligo Security links TeamPCP activity dating to 2020 to aliases including TA-NATALSTATUS and IronErn, citing shared infrastructure. Researchers also describe a ShadowRay campaign that created a self-propagating botnet on hijacked AI infrastructure.
Key points
- Oligo Security says TeamPCP-linked attacks date to 2020, predating the group’s public emergence as a brand in late 2025.
- Researchers linked activity tracked as TA-NATALSTATUS and IronErn to TeamPCP through shared IPs, domains, a file server and a command-and-control server.
- Oligo attributes a late-2025 ShadowRay 2.0 campaign to TeamPCP; the campaign exploited a ShadowRay vulnerability and resulted in a self-propagating botnet on hijacked AI infrastructure.
- Oligo researchers said payloads adapted rapidly to their environments and attributed that pace to AI assistance.
- The article says TeamPCP compromised and injected malicious code into more than 1,000 software packages in less than four months earlier that year.
Article Details
- Event Type
- Oligo Security research linked TeamPCP to malicious campaigns dating back to 2020, including activity tracked under the names TA-NATALSTATUS and IronErn.
- Impact
- The reported campaigns targeted open-source software and AI infrastructure. TeamPCP compromised and injected malicious code into more than 1,000 software packages in less than four months, and a late-2025 ShadowRay exploitation campaign reportedly created a self-propagating botnet on hijacked AI infrastructure.
People
Avi LumelskyAI security researcher at Oligo Security; discussed a domain identified in TeamPCP's GitHub account profile and the group's activity.Gal ElbazCo-founder and CTO at Oligo Security; discussed TeamPCP's campaign growth and the limits of researchers' ability to detect or prove the group's involvement in other attacks.Uri KatzDirector of research at Oligo Security; described the rapid, environment-adaptive evolution of campaign payloads and attributed the changes to AI assistance.
Threat Actors
IronErnOligo Security linked TeamPCP to activity tracked under the name IronErn, spanning 2020 to late 2025; the article does not independently establish that this name is an alias.TA-NATALSTATUSOligo Security linked TeamPCP to activity tracked under the name TA-NATALSTATUS, spanning 2020 to late 2025; the article does not independently establish that this name is an alias.TeamPCPOligo Security attributed campaigns targeting open-source software and AI infrastructure to TeamPCP, with activity reported as dating back to 2020. The group was linked to a late-2025 ShadowRay exploitation campaign and to the creation of a self-propagating botnet on hijacked AI infrastructure.