D
CyberUnattributed

TeamPCP

Cybercriminal groupTrackedPending verification

Also known as: PCPCat, ShellForce, DeadCatx3, SHADOW-WATER-058, UNC6780

CyberUNK
Identification silhouette. Not drawn to scale between entries.
Fact cardConfidence · Source
System
TypeCybercriminal group
Alternative designationsPCPCat, ShellForce, DeadCatx3, SHADOW-WATER-058, UNC6780
ProliferationOrigin country only
Active since2025At least 2025Med[1]
MITRE ATT&CK IDG1056High[1]
Capabilities
ATT&CK techniques used37ATT&CK v20.1High[1]
Malware and toolsCanisterWorm, Mini Shai-Hulud, TeamPCP Cloud Stealer3 malware and tool entries linked in ATT&CKHigh[1]
Attribution and activity
Attributed sponsorFinancially motivated, cloud-focused groupMed[1]
TargetsInitially focused on ransomware and cryptocurrency theft, TeamPCP shifted in early 2026 to systematic, worm-driven credential theft and software supply chain attacks targeting Continuous Integration and Continuous Delivery (CI/CD) workflows.Med[1]
Notes
TeamPCP is a financially-motivated, cloud-native threat group that has been active since at least September 2025. Initially focused on ransomware and cryptocurrency theft, TeamPCP shifted in early 2026 to systematic, worm-driven credential theft and software supply chain attacks targeting Continuous Integration and Continuous Delivery (CI/CD) workflows. TeamPCP has monetized access through extortion and through partnerships with ransomware actors including Vect and CipherForce. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.
Summary

TeamPCP is a financially-motivated, cloud-native threat group that has been active since at least September 2025. Initially focused on ransomware and cryptocurrency theft, TeamPCP shifted in early 2026 to systematic, worm-driven credential theft and software supply chain attacks targeting Continuous Integration and Continuous Delivery (CI/CD) workflows.

Draft entry. Values come from the cited public sources and are awaiting editor verification.
CompareJSON
Operators
Sources
  1. TeamPCP, Group G1056, MITRE ATT&CK
    Published/updated 2026-09-02 · Tier 2 · checked 2026-11-08
Change log
  • 2026-11-08 Entry created from MITRE ATT&CK Enterprise v20.1 (group G1056)