TeamPCP: The Cloud Threat You Didn’t Notice

Cyber attacks are evolving, not by becoming more complex, but by becoming more automated, scalable, and hidden in plain sight.

One group that clearly shows this shift is TeamPCP, a cloud-focused threat actor that doesn’t hack users — but instead takes over infrastructure itself.

Who is TeamPCP?

TeamPCP is a cybercriminal group that emerged around late 2025, also known by aliases such as PCPcat, ShellForce, and DeadCatx3

Unlike traditional attackers:

• They don’t target laptops or users
• They focus on cloud infrastructure
• They rely heavily on automation

Their model is simple:

Find exposed cloud systems → take control → reuse them for profit

Target

Observed countries:

• United States
• Canada
• UAE
• South Korea
• Serbia
• Vietnam

Targeted sectors:

• Banking & Financial Services
• Technology
• Telecommunications

https://socradar.io/blog/dark-web-profile-teampcp/

What Does TeamPCP Actually Do?

TeamPCP is not just malware it is a full cybercrime platform.

Once they gain access, they:

• Steal data
• Deploy ransomware
• Run cryptomining (XMRig)
• Use systems as proxy / bot infrastructure
• Spread to other systems

One infected server becomes:

A tool for attacking more systems

Attack Chain

TeamPCP attack chain

How to Detect (Elastic )

1. Suspicious Container Activity

container.id : * AND process.name : ("bash" or "sh" or "python")

Look for scripting inside containers

2. Crypto Mining Detection

process.name : "xmrig"

Strong indicator of compromise

3. Unusual Outbound Traffic

network.direction : "outbound" AND NOT destination.ip : (trusted_ranges)

Detect abnormal connections

4. Docker / Kubernetes Abuse

process.command_line : "*docker*" OR process.command_line : "*kubectl*"

Look for unusual admin commands

5. Execution from Temp Locations

process.executable : "/tmp/*"

Common malware behaviour

Conclusion

TeamPCP is more than just another threat actor, it represents a shift in how modern attacks are carried out.

Instead of targeting users directly, TeamPCP focuses on cloud infrastructure, exposed services, and misconfigurations, allowing them to scale attacks quickly with minimal effort. This makes their operations highly efficient and difficult to detect using traditional methods.

For defenders, the takeaway is clear:

• Securing cloud environments is no longer optional
• Visibility into container and network behaviour is critical
• Detection must focus on anomalies and patterns, not just known indicators

Ultimately, TeamPCP highlights a simple but important reality:

In today’s threat landscape, exposed infrastructure is often the easiest entry point — and the hardest to notice.