TeamPCP Turns Cloud Misconfigurations into a Self-Propagating Cybercrime Machine

Quick Takeaways

1. TeamPCP, active from December 2025, exploited exposed Docker APIs, Kubernetes, and cloud vulnerabilities to build a large-scale, automated cybercriminal infrastructure focused on data exfiltration, ransomware, extortion, and cryptocurrency mining.
2. Their operations relied on mass scanning and automated deployment of malicious containers and jobs, transforming compromised servers into relay points and scanning nodes within a self-sustaining ecosystem.
3. The group targeted predominantly Western organizations in sectors like e-commerce, finance, and HR, leveraging cloud infrastructure (Azure and AWS) for 97% of their victims.
4. Their operational scale and deployment tactics—using standardized command patterns and multiple control endpoints—highlight a focus on automation and resilience rather than technical novelty.

The Core Issue

In December 2025, the advanced cyber threat group known as TeamPCP, also referred to as PCPcat, ShellForce, and DeadCatx3, launched a widespread campaign targeting vulnerable cloud infrastructure. They exploited exposed Docker APIs, Kubernetes clusters, Ray dashboards, Redis servers, and React2Shell vulnerabilities to establish a large-scale, automated network. The group’s goal was to compromise servers, exfiltrate data—primarily from Western countries in sectors like finance, e-commerce, and human resources—and deploy ransomware or mine cryptocurrency. The campaign peaked around Christmas, with the infrastructure going silent afterward, though members celebrated their stolen assets publicly on Telegram. This operation was not merely innovative but remarkable for its operational scale; it leveraged existing vulnerabilities to create a self-repairing, cloud-native criminal ecosystem. They used automation extensively, turning compromised servers into relay points for cryptomining, data hosting, and command-and-control relays, effectively weaponizing widespread infrastructure vulnerabilities.

Researchers from Flare identified at least 185 compromised servers executing standardized commands, revealing TeamPCP’s modular and redundant infrastructure. They discovered primary command nodes at IP addresses 67.217.57.240 and secondary nodes at 44.252.85.168, suggesting ongoing infrastructure reconfiguration. The attackers initiated their operations by scanning vast IP ranges for exposed APIs, then deploying malicious containers using unauthenticated management APIs—such as pulling Alpine images or submitting base64-encoded jobs—furthering their self-propagation. Their scripts, notably proxy.sh, ensured persistent presence by installing tools, relays, and scanners, transforming infected hosts into autonomous cybercrime units. The attack targeted cloud services, predominantly Microsoft Azure and Amazon Web Services, utilizing tailored strategies for cloud environments like Kubernetes. This operation exemplifies how well-documented vulnerabilities can be weaponized into a formidable, automated ecosystem, with the threat actor’s activities reported by cybersecurity researchers highlighting the growing risks posed by large-scale, cloud-native cybercrimes.

Critical Concerns

The issue titled “TeamPCP Industrializes Cloud Misconfigurations Into a Self-Propagating Cybercrime Platform” illustrates a dangerous threat that can strike any business. If cloud settings are misconfigured, cybercriminals can exploit these vulnerabilities to create a powerful, self-spreading platform for cyberattacks. Consequently, your business could face data theft, operational disruptions, or financial losses. Furthermore, once compromised, sensitive information might be leaked or manipulated, damaging your reputation and eroding customer trust. Importantly, because such attacks are self-propagating, they can quickly grow beyond initial points of entry, making remediation difficult and costly. Therefore, safeguarding your cloud infrastructure against misconfigurations is crucial to prevent falling victim to this sophisticated cyber threat that can damage your business’s stability and growth.

Fix & Mitigation

In the rapidly evolving landscape of cybersecurity threats, swiftly addressing and remediating cloud misconfigurations is critical to prevent the escalation into self-propagating cybercrime platforms, such as the case with TeamPCP. Timely intervention minimizes potential damage, limits attack surface, and ensures organizational resilience.

Containment Measures

• Isolate affected cloud resources to prevent further spread.
• Disable or revoke compromised access credentials immediately.

Assessment & Analysis

• Conduct thorough audits of all cloud configurations and permissions.
• Identify vulnerabilities and anomalous activities linked to the misconfiguration.

Remediation Actions

• Correct misconfigured settings using established security baselines.
• Update and enforce access controls and multi-factor authentication protocols.

Strengthening Security

• Implement automated configuration management tools for continuous monitoring.
• Regularly review and update security policies to adapt to emerging threats.

Incident Response & Reporting

• Document the incident details for future analysis.
• Report significant issues to relevant authorities and stakeholders.

Preventive Measures

• Train staff on cloud security best practices.
• Develop rapid response plans tailored to cloud security incidents.

Stay Ahead in Cybersecurity

Stay informed on the latest Threat Intelligence and Cyberattacks.

Understand foundational security frameworks via NIST CSF on Wikipedia.

Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.

Cyberattacks-V1cyberattack-v1-multisource