VulnHub

Researchers have traced the cyber group known as TeamPCP back to 2020, revealing their long-term involvement in compromising internet-facing systems. Initially focused on exploiting these systems, the group has since shifted to targeting software supply chains, raising concerns about the security of widely used applications. The analysis points to shared domains and similar techniques used by TeamPCP over the years, indicating a well-established operation. This ongoing activity emphasizes the need for organizations to bolster their defenses, particularly against supply chain vulnerabilities that could affect multiple software products. Companies should remain vigilant as attackers continue to evolve their methods and targets.

Recent research has identified thirty-six malicious npm packages related to the Strapi framework that have been linked to Redis remote code execution (RCE), database theft, and persistent command and control (C2) capabilities. In addition, malicious LNK files are being used to distribute a Python-based backdoor. The Kimsuky Group has also been noted for changing their distribution techniques to enhance their attacks. These developments pose serious risks to developers and organizations using these tools, as they could lead to unauthorized access and data breaches. It is crucial for users to be vigilant and ensure they are using secure versions of these packages to avoid falling victim to these threats.

Researchers have identified a significant cyber campaign known as the TeamPCP worm, which has been targeting cloud-native environments since late December 2025. This worm exploits vulnerabilities in widely used technologies, including exposed Docker APIs, Kubernetes clusters, Ray dashboards, and Redis servers. By hijacking these services, attackers are able to create a malicious infrastructure for further exploitation. This situation is alarming as it can potentially affect numerous organizations that rely on these cloud services for their operations. Companies need to ensure their cloud environments are properly secured against such vulnerabilities to prevent unauthorized access and data breaches.