{
  "id": "teampcp",
  "name": "TeamPCP",
  "aliases": [
    "PCPCat",
    "ShellForce",
    "DeadCatx3",
    "SHADOW-WATER-058",
    "UNC6780"
  ],
  "domain": "cyber",
  "country": "UNK",
  "category": "Cybercriminal group",
  "status": "tracked",
  "fielded": null,
  "operators": [],
  "summary": "TeamPCP is a financially-motivated, cloud-native threat group that has been active since at least September 2025. Initially focused on ransomware and cryptocurrency theft, TeamPCP shifted in early 2026 to systematic, worm-driven credential theft and software supply chain attacks targeting Continuous Integration and Continuous Delivery (CI/CD) workflows.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Financially motivated, cloud-focused group",
      "src": [
        "mitre-g1056"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2025,
      "src": [
        "mitre-g1056"
      ],
      "conf": "medium",
      "note": "At least 2025"
    },
    {
      "k": "attack_id",
      "v": "G1056",
      "src": [
        "mitre-g1056"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "Initially focused on ransomware and cryptocurrency theft, TeamPCP shifted in early 2026 to systematic, worm-driven credential theft and software supply chain attacks targeting Continuous Integration and Continuous Delivery (CI/CD) workflows.",
      "src": [
        "mitre-g1056"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 37,
      "src": [
        "mitre-g1056"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "CanisterWorm, Mini Shai-Hulud, TeamPCP Cloud Stealer",
      "src": [
        "mitre-g1056"
      ],
      "conf": "high",
      "note": "3 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "TeamPCP is a financially-motivated, cloud-native threat group that has been active since at least September 2025. Initially focused on ransomware and cryptocurrency theft, TeamPCP shifted in early 2026 to systematic, worm-driven credential theft and software supply chain attacks targeting Continuous Integration and Continuous Delivery (CI/CD) workflows. TeamPCP has monetized access through extortion and through partnerships with ransomware actors including Vect and CipherForce. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G1056)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/teampcp.html",
  "sources": {
    "mitre-g1056": {
      "title": "TeamPCP, Group G1056",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G1056/",
      "published": "2026-09-02",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}