SANDCLOCK

Reported Context (2)

On every compromised CI runner, TeamPCP's stealer (tracked by Google as SANDCLOCK) escalated to root and swept: CloudSEK finds potential exposure of 2,500 companies in LiteLLM supply-chain attack
The threat actor typically used compromised packages to deploy credential stealers, including SANDCLOCK, to obtain high value secrets. Google and Mandiant Urge Stronger Defenses as Open-Source Supply-Chain Attacks Grow

Malware (5)

People (4)

Threat Actors (10)

MITRE ATT&CK (2)

Vendors (5)

Products (15)

Tools (3)

Industries (6)

Countries (8)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.