TeamPCP, a financially motivated threat cluster tracked as SHADOW-WATER-058, orchestrated a highly coordinated supply chain poisoning campaign from March 19 through April 24, 2026. Across at least seven distinct waves, the actor successfully compromised trusted developer toolchains spanning five programming ecosystems and three registry types. Their primary objective remained ruthlessly consistent: the rapid harvesting and monetization of developer credentials, cloud provider keys, and CI/CD tokens. TeamPCP’s operational tradecraft relies heavily on abusing implicit trust within build pipelines, eliminating the need to compromise end-user systems directly. The threat actor demonstrated an unusual preference for embedding distinct branding within their payloads, including Dune-themed staging repositories, specific commit-message markers (“LongLiveTheResistanceAgainstMachines”), and customized exfiltration headers like X-Rise-To-The-Trinny. By leveraging diverse delivery mechanisms, TeamPCP proved adept at tailoring their cryptographic sophistication—ranging from AES-256-GCM to custom MD5-keystream XOR ciphers—to fit the specific operational requirements of each target.
Case Study 1: The Multi-Channel KICS Compromise
On April 22, 2026, the threat actor executed a highly complex, multi-channel poisoning of the Checkmarx KICS distribution infrastructure. Over an 83-minute window, TeamPCP simultaneously overwrote six official Docker Hub tags, published malicious VS Code and OpenVSX extensions, and modified the project’s GitHub Actions workflow to serialize repository secrets. The core payload, an obfuscated 10 MB file named mcpAddon.js, was executed via a downloaded Bun runtime. This stealer aggressively targeted AWS, Azure, GCP credentials, and AI configuration files (including ~/.claude.json), utilizing a robust AES-256-GCM encryption scheme paired with an attacker-embedded RSA public key. The stolen npm tokens were weaponized within 24 hours to hijack the @bitwarden/cli package. The downstream Bitwarden payload introduced a highly resilient C&C fallback mechanism that queried the GitHub commit-search API to retrieve RSA-signed alternate exfiltration domains, ensuring infrastructure survival even if the primary domain was neutralized.
Case Study 2: The elementary-data Script Injection
Just two days later, the elementary-data attack demonstrated a technically simpler, yet structurally devastating, initial access vector. A single malicious comment (curl... | bash) on an open GitHub pull request was interpolated directly into a run: block without sanitization by the .github/workflows/update_pylon_issue.yml workflow. This granted the attacker a runner token with repository write access, allowing them to forge a tagged release commit and invoke the project’s legitimate signing infrastructure. The resulting PyPI package, verified by standard checks, deployed a 46 KB pure-Python outer loader that exploited the .pth import mechanism to execute before application code. Utilizing an MD5-keystream XOR cipher—seeded by the operator’s Session messenger ID—the payload decrypted an inner stealer that executed directly in memory. Notably, this stealer engaged in live AWS Cloud API abuse, utilizing secretsmanager:ListSecrets and ssm:DescribeParameters to enumerate and dump plaintext secrets across the account, vastly expanding the blast radius beyond local disk-resident files.
Credential harvesting: More than 80 paths across six categories :
| Category | Scope |
|---|---|
| SSH | Private keys (RSA, Ed25519, ECDSA, DSA), authorized_keys, SSH config, and system host keys from /etc/ssh/ssh_host*_key |
| Cloud (AWS/GCP/Azure) | Credential files, environment variables, EC2 IMDS v2, and ECS task credentials |
| Kubernetes | ~/.kube/config, cluster-wide secret enumeration via kubectl get secrets --all-namespaces -o json, ServiceAccount tokens from /var/run/secrets/ |
| Developer tooling | .npmrc, .pypirc, .cargo/credentials.toml, .vault-token, gh auth token, .netrc, .git-credentials, and IaC files (terraform.tfstate, .gitlab-ci.yml, Jenkinsfile) |
| Databases | MySQL, PostgreSQL, Redis, MongoDB, LDAP credential files; and environment-variable scans for DATABASE, DB_, MYSQL, POSTGRES, MONGO, REDIS, VAULT patterns |
| Cryptocurrency | Bitcoin, Ethereum, Solana (including validator and authorized-withdrawer keypairs), Litecoin, Dogecoin, Zcash, Dash, Ripple, Monero, and Cardano wallet keystores |
Remediation and Incident Response
Organizations exposed to either the KICS or elementary-data compromises must assume full CI/CD environment breach and initiate comprehensive incident response protocols.
- Credential Rotation: Immediately rotate all GitHub PATs, AWS IAM access keys, Azure service principal secrets, GCP service account keys, and npm tokens from a verified clean host.
- Infrastructure Auditing: Audit GitHub Actions logs for anomalous
format-check.ymlworkflow runs and search for auto-created public repositories matching the Dune-themed naming pattern. - Payload Hunting: Proactively hunt for Bun runtime artifacts in unexpected directories and investigate any
elementary.pthfile in Python site packages exceeding 100 KB. - Telemetry Review: Monitor CloudTrail logs for unexpected
secretsmanager:ListSecretscalls originating from CI/CD runner principals, which serves as a highly reliable hunting signal for this specific threat actor.
Expert Opinion: The Fragility of Implicit Trust in CI/CD Pipelines
The TeamPCP campaign exposes a fundamental, industry-wide architectural flaw: our dangerous over-reliance on implicit trust within CI/CD pipelines. While the multi-channel KICS attack was operationally impressive, the elementary-data breach is far more alarming. The fact that a single, unsanitized pull request comment could hijack a trusted runner token and trick a project’s own infrastructure into cryptographically signing malware highlights a severe disconnect between software security and pipeline security.
We are witnessing a paradigm shift where threat actors no longer need to burn expensive zero-days to breach enterprise networks; they simply exploit the excessive permissions granted to automated workflows. TeamPCP’s ability to seamlessly pivot from static credential harvesting to live AWS API abuse demonstrates a mature understanding of modern cloud-native environments. Furthermore, the actor’s deliberate choice to use pure-Python payloads with plaintext-level entropy to bypass traditional, pattern-based static analysis engines underscores the limitations of legacy endpoint detection tools. Moving forward, the industry must mandate “zero trust” principles for CI/CD environments. We must strictly scope runner tokens, aggressively sanitize all external inputs in GitHub Actions, and treat build pipelines as highly privileged, inherently hostile perimeters rather than secure internal utilities.
MITRE ATT&CK mapping
| Tactic | Technique | ID | Observation |
|---|---|---|---|
| Initial Access | Supply Chain Compromise: Compromise Software Supply Chain | T1195.002 | Poisoned Docker Hub images, VS Code extensions, PyPI packages, and GitHub Actions across both incidents |
| Initial Access | Valid Accounts | T1078 | KICS incident: stolen publisher credentials used for Docker Hub, VS Code, and GitHub Action republish |
| Initial Access | Trusted Relationship | T1199 | Elementary-data incident: GitHub Actions runner token abused through PR comment script injection |
| Execution | Command and Scripting Interpreter: JavaScript | T1059.007 | KICS mcpAddon.js executed via Bun runtime on the victim system |
| Execution | Command and Scripting Interpreter: Python | T1059.006 | Elementary-data .pth payload executed at Python interpreter startup |
| Execution | Command and Scripting Interpreter: Unix Shell | T1059.004 | Elementary-data: GitHub Actions runner executes shell stager after comment injection |
| Persistence | Boot or Logon Autostart Execution | T1547 | Elementary-data .pth fires on every Python interpreter startup on the host |
| Defense Evasion | Obfuscated Files or Information | T1027 | KICS payload uses AES-256-GCM + RSA OAEP-SHA256; elementary-data uses MD5-keystream XOR |
| Defense Evasion | Indicator Removal: File Deletion | T1070.004 | Elementary-data uses a temporary-directory context manager to delete trin.tar.gz on exit |
| Credential Access | Unsecured Credentials: Credentials In Files | T1552.001 | Both payloads harvest SSH keys, cloud credential files, and developer tokens from disk |
| Credential Access | Unsecured Credentials: Cloud Instance Metadata API | T1552.005 | Elementary-data stealer queries EC2 IMDS v2 and ECS task credential endpoints |
| Credential Access | Steal Application Access Token | T1528 | Elementary-data: GitHub Actions runner GITHUB_TOKEN abused to forge release commit |
| Discovery | Cloud Service Discovery | T1526 | Elementary-data: secretsmanager:ListSecrets and ssm:DescribeParameters live enumeration |
| Discovery | Container and Resource Discovery | T1613 | Elementary-data: kubectl get secrets –all-namespaces enumeration |
| Collection | Data from Local System | T1005 | Credential files, shell history, AI and MCP configuration files harvested |
| Collection | Data from Cloud Storage | T1530 | Elementary-data: secretsmanager:GetSecretValue retrieves plaintext secrets |
| Command and Control | Application Layer Protocol: Web Protocols | T1071.001 | HTTPS exfiltration to actor-controlled C&C endpoints in both incidents |
| Command and Control | Dead Drop Resolver | T1102.001 | KICS and Bitwarden variants use GitHub commit-search API to recover fallback C&C domains |
| Exfiltration | Exfiltration Over C2 Channel | T1041 | Both payloads POST encrypted credential archives over HTTPS to the primary C&C endpoint |
| Exfiltration | Exfiltration Over Web Service | T1567 | KICS dead-drop to auto-created public GitHub repositories under Dune-themed names |
| Impact | Financial Theft | T1657 | Cryptocurrency wallet harvesting observed in the elementary-data payload |
