An unusual hacking initiative has emerged, with malicious actors targeting systems previously compromised by the cybercrime group known as TeamPCP. Cybersecurity firm SentinelOne reported that these new hackers, dubbed “PCPJack,” not only removed TeamPCP operatives and their tools from the systems but also installed their own malicious code designed to replicate across various cloud infrastructures.
The hackers are leveraging their access to pilfer credentials and transmit stolen data back to their own networks. Recent activities attributed to TeamPCP include high-profile breaches affecting the European Commission and a significant cyberattack on the widely utilized vulnerability scanner, Trivvy, impacting numerous companies, including LiteLLM and AI startup Mercor.
SentinelOne’s senior researcher, Alex Delamotte, speculated on the identity of the PCPJack attackers, suggesting they could be former TeamPCP members, rivals, or individuals who have adapted TeamPCP’s tactics for their own objectives. The ongoing campaign reflects similarities to previous TeamPCP operations, specifically targeting cloud services.