IOC dataset
Indicators of compromise
Two tables on this page. Indicators first - every domain, IP, hash, compromised package, payload filename, persistence artifact, MITRE technique, and CVE associated with the TeamPCP / UNC6780 campaign, in one searchable filterable list with CSV export. Actor profile second - the names and accounts behind the campaign, role-tagged so you can tell hijacked-victim from attacker-owned at a glance. Click any source chip to see which researcher published it. Defanged where appropriate.
133 IOCs
Category
Campaign / wave
Source
| Category | Value | Detail | Campaign | Sources |
|---|---|---|---|---|
| Domain | scan.aquasecurtiy[.]org | C2 | Trivy (Mar 19) | ramimacugurratesUnit 42 |
| Domain | checkmarx[.]zone | C2 | LiteLLM (Mar 24) | ramimacugurrates |
| Domain | checkmarx[.]zone/vsx | C2 path | Multi-wave / shared | ramimac |
| Domain | checkmarx[.]zone/static/checkmarx-util-1.0.4.tgz | second-stage payload | Checkmarx (Mar 23) | ugurrates |
| Domain | checkmarx[.]zone/raw | persistence polling | LiteLLM (Mar 24) | ugurrates |
| Domain | models.litellm[.]cloud | C2 | LiteLLM (Mar 24) | Unit 42ugurrates |
| Domain | tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0[.]io | ICP canister dead-drop C2 | CanisterWorm (Mar 20) | Unit 42ugurrates |
| Domain | check.git-service[.]com | C2 (primary) | @antv mass-republish (May 18-19) | Wiz |
| Domain | t.m-kosche[.]com | C2 (backup) | @antv mass-republish (May 18-19) | Wizramimac |
| Domain | git-tanstack[.]com | C2 (typosquat) | Multi-wave / shared | ramimac |
| Domain | nsa[.]cat | attacker VPS | Operator infrastructure | ramimac |
| Domain | recv.hackmoltrepeat[.]com | PAT exfil endpoint | Trivy (Mar 19) | OSM |
| Domain | audit.checkmarx[.]cx/v1/telemetry | C2 endpoint | Bitwarden CLI (Apr 23) | Socket |
| IP | 83.142.209.11 | C2 server | Checkmarx (Mar 23) | ugurrates |
| IP | 45.148.10.212 | C2 server | Trivy (Mar 19) | ugurrates |
| IP | 83.142.209.194 | legacy C2 | DurableTask (May 18) | Wiz |
| IP | 83.142.209.203:8080 | C2 (plain HTTP) | Telnyx (Mar 27) | Socket |
| IP | 94.154.172.43 | C2 IP | Bitwarden CLI (Apr 23) | Socket |
| Cloudflare tunnel | championships-peoples-point-cassette.trycloudflare[.]com | C2 tunnel URL | TeamPCP operator infra | Unit 42 |
| Cloudflare tunnel | create-sensitivity-grad-sequence.trycloudflare[.]com | C2 tunnel URL | TeamPCP operator infra | Unit 42 |
| Cloudflare tunnel | investigation-launches-hearings-copying.trycloudflare[.]com | C2 tunnel URL | TeamPCP operator infra | Unit 42 |
| Cloudflare tunnel | plug-tab-protective-relay.trycloudflare[.]com | C2 tunnel URL | TeamPCP operator infra | Unit 42 |
| Cloudflare tunnel | souls-entire-defined-routes.trycloudflare[.]com | C2 tunnel URL | TeamPCP operator infra | Unit 42 |
| SHA-256 | 18a24f83e807479438dcab7a1804c51a00dafc1d526698a66e0640d1e5dd671a | Trivy malicious entrypoint.sh stealer | Trivy (Mar 19) | Phoenix Security |
| SHA-256 | c37c0ae9641d2e5329fcdee847a756bf1140fdb7f0b7c78a40fdc39055e7d926 | CanisterWorm Wave 4 (final form) | CanisterWorm (Mar 20) | Aikido |
| SHA-256 | 0c0d206d5e68c0cf64d57ffa8bc5b1dad54f2dda52f24e96e02e237498cb9c3a | CanisterWorm Wave 3 (self-propagating test) | CanisterWorm (Mar 20) | Aikido |
| SHA-256 | 61ff00a81b19624adaad425b9129ba2f312f4ab76fb5ddc2c628a5037d31a4ba | CanisterWorm Wave 2 (armed ICP backdoor) | ICP fallback C2 (Mar 22) | Aikido |
| SHA-256 | f398f06eefcd3558c38820a397e3193856e4e6e7c67f81ecc8e533275284b152 | CanisterWorm Wave 1 deploy.js | CanisterWorm (Mar 20) | Aikido |
| SHA-256 | 7df6cef7ab9aae2ea08f2f872f6456b5d51d896ddda907a238cd6668ccdc4bb7 | CanisterWorm Wave 2 deploy.js | CanisterWorm (Mar 20) | Aikido |
| SHA-256 | 5e2ba7c4c53fa6e0cef58011acdd50682cf83fb7b989712d2fcf1b5173bad956 | CanisterWorm Wave 3+ deploy.js minified | CanisterWorm (Mar 20) | Aikido |
| SHA-256 | e9b1e069efc778c1e77fb3f5fcc3bd3580bbc810604cbf4347897ddb4b8c163b | CanisterWorm Wave 1 index.js (dry run, empty payload, manual deployment) | CanisterWorm (Mar 20) | Aikido |
| SHA-256 | 069ac1dc7f7649b76bc72a11ac700f373804bfd81dab7e561157b703999f44ce | durabletask rope.pyz | DurableTask (May 18) | Wiz |
| SHA-256 | 7d80b3ef74ad7992b93c31966962612e4e2ceb93e7727cdbd1d2a9af47d44ba8 | durabletask-1.4.1-py3-none-any.whl | DurableTask (May 18) | Wiz |
| SHA-256 | aeaf583e20347bf850e2fabdcd6f4982996ba023f8c2cd56bbd299cfd56516f5 | durabletask-1.4.2-py3-none-any.whl | DurableTask (May 18) | Wiz |
| SHA-256 | 877ff2531a63393c4cb9c3c86908b62d9c4fc3db971bc231c48537faae6cb3ec | durabletask-1.4.3-py3-none-any.whl | DurableTask (May 18) | Wiz |
| SHA-256 | 4066781fa830224c8bbcc3aa005a396657f9c8f9016f9a64ad44a9d7f5f45e34 | Mini Shai-Hulud setup.mjs loader (byte-identical across SAP CAP packages) | SAP CAP (Apr 29) | OSM |
| SHA-256 | 80a3d2877813968ef847ae73b5eeeb70b9435254e74d7f07d8cf4057f0a710ac | Mini Shai-Hulud execution.js shipped with mbt@1.2.48 | SAP CAP (Apr 29) | OSM |
| SHA-256 | 6f933d00b7d05678eb43c90963a80b8947c4ae6830182f89df31da9f568fea95 | Mini Shai-Hulud execution.js shipped with @cap-js/sqlite@2.2.2 | SAP CAP (Apr 29) | OSM |
| SHA-256 | 72c08e044dd427964bc14339f95838e3d45f51f6a586330c683fbb59ea374b1d | PureHVNC oqqqqoa.mp3 PowerShell loader (36,748-line obfuscated, MP3 masquerade) | PureHVNC (Mar 31) | OSM |
| SHA-256 | eb6eb4154b03ec73218727dc643d26f4e14dfda2438112926bb5daf37ae8bcdb | Mini Shai-Hulud execution.js third variant (SAP CAP wave) | SAP CAP (Apr 29) | Socket |
| SHA-256 | 35baf8316645372eea40b91d48acb067 | Mini Shai-Hulud setup.mjs (MD5; complements the OSM-contributed SHA-256) | Multi-wave / shared | Socket |
| SHA-256 | 29ac906c8bd801dfe1cb39596197df49f80fff2270b3e7fbab52278c24e4f1a7 | Mini Shai-Hulud SAP CAP embedded /proc/mem credential dumper | SAP CAP (Apr 29) | Snyk |
| SHA-256 | a68dd1e6a6e35ec3771e1f94fe796f55dfe65a2b94560516ff4ac189390dfa1c | Mini Shai-Hulud @antv payload | @antv mass-republish (May 18-19) | Snyk |
| SHA-256 | 71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238 | LiteLLM Stage 1 litellm_init.pth | LiteLLM (Mar 24) | Snyk |
| SHA-256 | a0d229be8efcb2f9135e2ad55ba275b76ddcfeb55fa4370e0a522a5bdee0120b | LiteLLM Stage 2 proxy_server.py | LiteLLM (Mar 24) | Snyk |
| SHA-256 | 6cf223aea68b0e8031ff68251e30b6017a0513fe152e235c26f248ba1e15c92a | LiteLLM Stage 3 sysmon.py persistence | LiteLLM (Mar 24) | Snyk |
| Malware family | SANDCLOCK | credential stealer - formal malware-family designation for TeamPCP's credential stealer - the 204-line entrypoint.sh that self-identifies as 'TeamPCP Cloud stealer' | Multi-wave / shared | Google GTIG |
| Malware family | CanisterWorm | self-propagating npm worm - 4 distinct waves over the March 2026 campaign; first npm malware to use an ICP blockchain canister for C2 | ICP fallback C2 (Mar 22) | Aikidosometimes used interchangeably with the actor in press) |
| Malware family | Mini Shai-Hulud | self-propagating npm worm - First wave Apr 29 (SAP CAP, 4 packages). Expanded to 170+ packages across 19 npm namespaces + 2 PyPI by May 13. Uses .vscode/tasks.json folderOpen primitive borrowed from DPRK-aligned PolinRider/TasksJacker. Bun runtime as LOLBin. Exfil via Session P2P messaging network. | Mini Shai-Hulud (May 13) | Self-named by TeamPCPSnyk |
| Malware family | PureHVNC RAT | remote access trojan - Suspected TeamPCP pivot. MP3-masquerade PowerShell loader → multi-stage drop → hidden VNC. Attribution: hypothesized only (audio-file tradecraft match with Telnyx WAV stego). | Telnyx (Mar 27) | pre-existing commercial RAT familyOSM |
| Compromised package | 47+ packages in @emilgroup, @opengov, @v7 namespaces | npm | CanisterWorm (Mar 20) | AikidoOSMugurrates |
| Compromised package | @teale.io/eslint-config v1.8.11, v1.8.12 | npm | CanisterWorm self-propagating variant (Mar 21) | Aikido |
| Compromised package | 323 packages in @antv ecosystem | npm | @antv mass-republish (May 18-19) | SnykOX Securityramimac |
| Compromised package | 42 @tanstack/* packages with 84 malicious versions | npm | Mini Shai-Hulud TanStack (May 11) | ThreatLockerStepSecurity |
| Compromised package | Bitwarden CLI @bitwarden/cli@2026.4.0 | npm | Mini Shai-Hulud 'Third Coming' (Apr 23) | OSMSocket |
| Compromised package | Mistral AI npm packages | npm | Mini Shai-Hulud wave victim | ramimac |
| Compromised package | litellm v1.82.7, v1.82.8 | pypi | LiteLLM (Mar 24) | Unit 42SnykEndor Labs |
| Compromised package | telnyx v4.87.1, v4.87.2 | pypi | Telnyx (Mar 27) | Socketramimac |
| Compromised package | guardrails-ai v0.10.1 | pypi - Key A RSA payload | guardrails-ai (Apr-May) | Wiz |
| Compromised package | durabletask v1.4.1, v1.4.2, v1.4.3 | pypi - Key B RSA payload | durabletask (May 18) | Wiz |
| Compromised package | mistralai v2.4.6 | pypi | PyPI Mini Shai-Hulud | ramimac |
| Compromised package | aquasecurity/trivy-action | github_actions - 75 of 76 tags per ugurrates / 76 of 77 per SANS - inventory delta | Trivy (Mar 19) | ugurratesSANS |
| Compromised package | aquasecurity/setup-trivy | github_actions - all 7 tags | Trivy (Mar 19) | ugurratesSANS |
| Compromised package | Checkmarx/kics-github-action | github_actions - all 35 tags | KICS (Mar 23) | Sysdigramimac |
| Compromised package | Checkmarx/ast-github-action | github_actions - v2.3.28 confirmed, likely all | Checkmarx ast (Mar 23) | Sysdig |
| Compromised package | docker.io/aquasec/trivy: 0.69.4, 0.69.5, 0.69.6 | container_images | Trivy (Mar 19) | Socketramimac |
| Compromised package | ghcr.io/aquasecurity/trivy: 0.69.4, 0.69.5, 0.69.6 | container_images | Trivy (Mar 19) | Socketramimac |
| Compromised package | public.ecr.aws/aquasecurity/trivy: 0.69.4, 0.69.5, 0.69.6 | container_images | Trivy (Mar 19) | Socketramimac |
| Compromised package | checkmarx.ast-results v2.53.0 | openvsx_extensions - safe: >=2.56.0 | Checkmarx OpenVSX (Mar 23) | ugurratesCSA |
| Compromised package | checkmarx.cx-dev-assist v1.7.0 | openvsx_extensions - safe: >=1.10.0 | Checkmarx OpenVSX (Mar 23) | ugurratesCSA |
| Compromised package | Unnamed extension (initial-access vector for May 20 GitHub breach) | vs_code_marketplace - GitHub disclosure did not name the extension | GitHub internal breach (May 20) | The Hacker NewsCoinfomania |
| Compromised package | Nx Console | vs_code_marketplace - referenced as compromised; details thin | GitHub-adjacent (May 20) | The Hacker News |
| Payload filename | litellm_init.pth | Stage 1 orchestrator | LiteLLM (Mar 24) | Snyk |
| Payload filename | proxy_server.py | Stage 2 collector | LiteLLM (Mar 24) | Snyk |
| Payload filename | sysmon.py | Stage 3 persistence | LiteLLM (Mar 24) | Snyk |
| Payload filename | hangup.wav | Windows steganography delivery | Telnyx (Mar 27) | Socketramimac |
| Payload filename | ringtone.wav | Linux/macOS steganography delivery | Telnyx (Mar 27) | Socketramimac |
| Payload filename | msbuild.exe | Windows persistence dropper | Telnyx (Mar 27) | Socketramimac |
| Payload filename | entrypoint.sh | Trivy stealer, 204 lines, self-identifies as 'TeamPCP Cloud stealer' (formally SANDCLOCK) | Trivy (Mar 19) | Phoenix SecurityramimacUnit 42 |
| Payload filename | tpcp.tar.gz | encrypted exfil archive | Trivy → Telnyx cascade | ugurratesUnit 42 |
| Payload filename | kamikaze.sh | Iran wiper container | CanisterWorm Iran variant (Mar 22) | AikidoUnit 42 |
| Payload filename | kube.py | K8s reconnaissance / wiper helper | CanisterWorm | Aikido |
| Payload filename | prop.py | atool/prop maintainer-account loader script | @antv mass-republish (May 18-19) | SnykOX Security |
| Payload filename | /tmp/pglog | CanisterWorm dropper binary | CanisterWorm (Mar 20) | Aikido |
| Payload filename | /tmp/managed.pyz | durabletask staged Python archive | durabletask (May 18) | Wiz |
| Payload filename | /tmp/rope-*.pyz | durabletask staged Python archive (rope.pyz family) | durabletask (May 18) | Wiz |
| Payload filename | monitor.js | NOTE: this is GhostClaw, NOT TeamPCP - exclude from TeamPCP detection | GhostClaw (false positive) | JFrog |
| Payload filename | setup.mjs | Mini Shai-Hulud preinstall loader; downloads Bun then runs execution.js | Mini Shai-Hulud | OSMSnykSocket |
| Payload filename | execution.js | Mini Shai-Hulud SAP CAP wave 11.6 MB obfuscated stage | Mini Shai-Hulud SAP CAP (Apr 29) | OSMSnykSocket |
| Payload filename | tanstack_runner.js | Mini Shai-Hulud TanStack/OpenSearch wave Bun stage | Mini Shai-Hulud TanStack (May 11) | StepSecurityThreatLocker |
| Payload filename | router_init.js | Mini Shai-Hulud TanStack wave 2.3 MB obfuscated stage | Mini Shai-Hulud TanStack (May 11) | StepSecurityThreatLocker |
| Payload filename | oqqqqoa.mp3 | PureHVNC PowerShell loader masquerading as MP3 (36,748-line obfuscated) | PureHVNC pivot (Mar 31) | OSM |
| Persistence artifact | ~/.config/sysmon/ | backdoor directory | LiteLLM / Trivy era | Snykramimac |
| Persistence artifact | ~/.config/sysmon.py | Stage-3 persistence script | LiteLLM (Mar 24) | Snyk |
| Persistence artifact | ~/.config/systemd/user/sysmon.service | systemd user-mode persistence unit | LiteLLM (Mar 24) | Snyk |
| Persistence artifact | ~/.config/systemd/user/pgmon.service | PostgreSQL masquerade systemd unit | CanisterWorm (Mar 20) | Aikido |
| Persistence artifact | /tmp/pglog, /tmp/.pg_state | CanisterWorm dropper + state files | CanisterWorm (Mar 20) | Aikido |
| Persistence artifact | ~/.cache/.sys-update-check, ~/.cache/.sys-update-check-k8s | durabletask persistence markers | durabletask (May 18) | Wiz |
| Persistence artifact | .claude/ directory | Mini Shai-Hulud Claude Code workspace plant | Mini Shai-Hulud | StepSecuritySnyk |
| Persistence artifact | .vscode/ directory | Mini Shai-Hulud VS Code workspace plant | Mini Shai-Hulud | StepSecuritySnyk |
| Persistence artifact | LaunchAgent services on macOS | Mini Shai-Hulud macOS persistence | Mini Shai-Hulud | Snyk |
| Persistence artifact | .vscode/tasks.json with `runOn: folderOpen` | Mini Shai-Hulud; primitive borrowed from DPRK PolinRider/TasksJacker | Mini Shai-Hulud | SnykStepSecurity |
| Persistence artifact | .claude/settings.json with SessionStart hook | Mini Shai-Hulud; novel addition over PolinRider - fires when Claude Code attaches to workspace | Mini Shai-Hulud | Snyk |
| Persistence artifact | .claude/execution.js / .claude/router_runtime.js / .claude/setup.mjs | Mini Shai-Hulud Claude-folder payload triplet | Mini Shai-Hulud | SnykStepSecurity |
| Persistence artifact | .vscode/setup.mjs | Mini Shai-Hulud VS Code payload | Mini Shai-Hulud | SnykStepSecurity |
| Persistence artifact | .github/workflows/* injected via GraphQL createCommitOnBranch with spoofed author `claude@users.noreply.github.com` | Mini Shai-Hulud TanStack wave commit-injection persistence | Mini Shai-Hulud TanStack (May 11) | StepSecuritySnyk |
| Persistence artifact | hidden VNC server | PureHVNC RAT GUI access channel | PureHVNC pivot (Mar 31) | OSM |
| Exfil repo | tpcp-docs | Trivy wave fallback dead-drop | Trivy (Mar 19) | ramimacugurrates |
| Exfil repo | docs-tpcp | Checkmarx wave fallback dead-drop | Checkmarx (Mar 23) | ramimac |
| Exfil repo | HackingLZ/litellm_1.82.8_payload | GitHub dead-drop with full malicious payload | LiteLLM (Mar 24) | ramimacSnyk |
| Exfil repo | HackingLZ/telnyx_4.87.1_payload | GitHub dead-drop with full malicious payload | Telnyx (Mar 27) | ramimacSocket |
| Exfil repo | nxb1t/litellm-1.82.7_sample | GitHub dead-drop sample copy | LiteLLM (Mar 24) | ramimac |
| Orphaned commit | 1885610c | Orphaned (non-merged) commit on the Trivy repository associated with the Feb 27 PwnRequest staging - useful for forensic searches across forks | Trivy PwnRequest (Feb 27) | ramimac |
| Orphaned commit | 70379aad | Orphaned (non-merged) commit on the Trivy repository associated with the Feb 27 PwnRequest staging - useful for forensic searches across forks | Trivy PwnRequest (Feb 27) | ramimac |
| MITRE ATT&CK | T1195.002 | Supply Chain Compromise: Software Dependencies - GitHub Actions tag poisoning, OpenVSX, npm, PyPI | MITRE ATT&CK mapping | Unit 42 |
| MITRE ATT&CK | T1552.005 | Unsecured Credentials: Cloud Instance Metadata API - AWS IMDS theft from CI runners | MITRE ATT&CK mapping | Unit 42Wiz |
| MITRE ATT&CK | T1555 | Credentials from Password Stores - Filesystem credential sweep (50+ paths) | MITRE ATT&CK mapping | Unit 42 |
| MITRE ATT&CK | T1003 | OS Credential Dumping - Runner.Worker /proc/<pid>/mem scraping | MITRE ATT&CK mapping | ThreatLockerSnyk |
| MITRE ATT&CK | T1041 | Exfiltration Over C2 Channel - Encrypted tpcp.tar.gz to typosquat domains | MITRE ATT&CK mapping | Unit 42ugurrates |
| MITRE ATT&CK | T1102 | Web Service - ICP canister dead-drop C2 | MITRE ATT&CK mapping | Unit 42Aikido |
| MITRE ATT&CK | T1543.002 | Systemd Service - pgmon.service, sysmon.service persistence | MITRE ATT&CK mapping | AikidoSnyk |
| MITRE ATT&CK | T1105 | Ingress Tool Transfer - checkmarx-util-1.0.4.tgz download | MITRE ATT&CK mapping | ugurrates |
| MITRE ATT&CK | T1583.001 | Acquire Infrastructure: Domains - Per-wave typosquat domains | MITRE ATT&CK mapping | Unit 42ramimac |
| MITRE ATT&CK | T1546.018 | Event Triggered Execution: Python Initialization - litellm_init.pth (CPython startup hijack) | MITRE ATT&CK mapping | Snyk |
| CVE / advisory | CVE-2026-33634 | CVSS 9.4 - Trivy supply chain compromise (the most impactful CI/CD attack of 2026 so far per ugurrates). Listed in CISA KEV with April 8 federal remediation deadline. Sources: CISA KEV catalog; ugurrates community timeline; SANS ISC Update 007. | CVE / advisory | CISA KEV catalogugurratesSANS ISC |
| CVE / advisory | CVE-2026-45321 | CVSS 9.6 - TanStack supply chain compromise via pull_request_target / OIDC theft. Source: ThreatLocker May 11 attack-chain analysis + NVD. | CVE / advisory | ThreatLocker |
| CVE / advisory | CVE-2025-55182 | React2Shell campaign (Dec 2025 precursor; chained backward by ramimac + Unit42 timelines). | CVE / advisory | - |
| FP filter | setup.sh (filename) | too generic; legitimate uses: Ansible, Bitnami, Claude Code plugin cache | Defender utility (FP filter) | ugurrates |
| FP filter | service.py (filename) | too generic; legitimate uses: Ansible module_utils, K8s | Defender utility (FP filter) | ugurrates |
| FP filter | deploy.js (filename) | too generic; standard npm/node file | Defender utility (FP filter) | ugurrates |
| FP filter | 169.254.169.254 (IMDS IP) | legitimate monitoring tools also hit this (FortiMonitor, Oracle AHF) | Defender utility (FP filter) | ugurrates |
| FP filter | icp0.io (parent domain) | too broad; catches legitimate ICP traffic - filter on the specific canister ID instead | Defender utility (FP filter) | ugurratesAikido |
| FP filter | hooks.slack.com / discord.com/api/webhooks | legitimate integrations; correlate with payload behavior before alerting | Defender utility (FP filter) | ugurrates |
Actor profile
Names and accounts
Identity intelligence on the TeamPCP / UNC6780 operator: the names they go by (and who coined each one), the accounts they own, the accounts they created as sock-puppets, the legitimate accounts they hijacked, and the identities they impersonate. Each role implies a different response - rotate (hijacked), block / report (sock-puppet), monitor (actor-owned), harden author-verification (impersonation).
25 entries
Kind
Role / designation
| Identifier | Kind | Role / designation | Platform / designator | Detail |
|---|---|---|---|---|
| TeamPCP | Name | Self-named | - | Primary self-chosen name. Appears in their own forum posts, the git-tanstack.com defacement page ("With Love TeamPCP"), and the 'TeamPCP Cloud stealer' payload self-identifier string. Catalogued by ramimac + Unit42 + every vendor write-up. |
| UNC6780 | Name | Vendor-designated | Google Threat Intelligence Group (GTIG) | UNC = uncategorized cluster designation; financial-motivation assessment. The vendor-canonical cluster label used in Mandiant + GTIG reporting. |
| PCPcat | Name | Self-named | - | Informal self-reference; explains the "play around with the cats" line in @xploitrsturtle2's May 20 X post. Catalogued by ramimac. |
| ShellForce | Name | Self-named | - | Self-chosen alias used in operator communications. Catalogued by ramimac + Unit42. |
| CipherForce | Name | Self-named | - | Self-chosen alias; also the name of a coalition group announced late March 2026 on BreachForums. Catalogued by ramimac + Unit42. |
| DeadCatx3 | Name | Self-named | - | Self-chosen alias used in operator communications. Catalogued by ramimac + Unit42. |
| @Persy_PCP | Handle | Actor-owned | Telegram | Primary operator-facing Telegram handle. Linked-to from LAPSUS$ Telegram channel (per OSM 2026-03-26). Catalogued by ramimac + Unit42. |
| @teampcp | Handle | Actor-owned | Telegram | Group-name Telegram handle alongside @Persy_PCP. Catalogued by ramimac + Unit42. |
| Team_PCP | Handle | Actor-owned | Telegram | Underscore-form Telegram identifier; previously operated as 'Black Witch / PCP' before renaming (per Okta 2026-05-18). |
| Black Witch / PCP | Handle | Actor-owned | Telegram (historical) | Prior Telegram identifier for the group before the 'Team_PCP' rename - useful for forensic searches in older threat-intel archives (per Okta 2026-05-18). |
| @xploitrsturtle2 | Handle | Actor-owned | X (Twitter) | TeamPCP statement channel during GitHub breach (May 20). Catalogued by The Hacker News + Coinfomania. |
| @xpl0itrs | Handle | Actor-owned | X (Twitter) | Second TeamPCP-linked X account, recent posts around the GitHub breach including stated intent to donate proceeds to charity. Catalogued by The Hacker News. |
| MegaGame10418 | Handle | Attacker sock-puppet | GitHub | Attacker-created GitHub account that opened the Feb 27 PwnRequest against Trivy (PR #10252). Catalogued by ramimac + ugurrates. |
| hackerbot-claw | Handle | Attacker sock-puppet | GitHub | Attacker-created automated scanner account used for Feb 20 reconnaissance against ~5 candidate target repos. Catalogued by ARMO + ramimac. |
| ast-phoenix | Handle | Hijacked account | OpenVSX | Compromised Checkmarx publisher account on OpenVSX. Used to publish poisoned ast-results extension (per ugurrates + CSA). |
| cx-plugins-releases | Handle | Hijacked account | GitHub | Compromised Checkmarx publisher account on GitHub. Used to push kics-github-action tag updates (per Sysdig TRT + ramimac). |
| aqua-bot | Handle | Hijacked account | GitHub | Compromised Aqua service account. PAT harvested during Feb 27 PwnRequest, used Mar 19 to push the malicious trivy-action and setup-trivy tags (per ramimac + ugurrates + SANS). |
| atool | Handle | Hijacked account | npm | Maintainer account hijacked in May 18-19 mass-republish wave; publishes 547 packages including full AntV suite; 318 packages republished by attacker (per OX + Snyk). |
| prop | Handle | Hijacked account | npm | Second hijacked maintainer account in same May 18-19 wave; 6 packages including openclaw-cn family + @starmind/collector-cli (per OX + Snyk). |
| cloudmtabot | Handle | Hijacked account | npm (SAP) | Legitimate SAP service account whose npm token was stolen to publish malicious mbt@1.2.48 in the Apr 29 SAP CAP wave (per Snyk + OSM). |
| Argon-DevOps-Mgt | Handle | Hijacked account | GitHub (Aqua) | Aqua service-account token harvested from a Trivy CI runner during Mar 19 strike; used Mar 22 to deface aquasec-com org (per OSM forensic analysis). |
| agwagwagwa | Handle | Hijacked account | GitHub | Compromised GitHub account used as one of the vehicles for the May 12 open-source release of the Shai-Hulud worm code; submitted a FreeBSD-support PR (per OX 2026-05-12). |
| headdirt | Handle | Hijacked account | GitHub | Compromised GitHub account hosting open-source-release Shai-Hulud code; private profile (per OX 2026-05-12). |
| tmechen | Handle | Hijacked account | GitHub | Compromised GitHub account hosting open-source-release Shai-Hulud code; cat-themed profile picture - matches PCPcat alias / 'the cats' theme in May 20 X-account quote (per OX 2026-05-12). |
| dependabot[bot] (impersonation) | Handle | Impersonation | git commit author | Spoofed git commit author on injected persistence commits in SAP CAP wave; used alongside claude@users.noreply.github.com to disguise malicious commits as automated bot output (per Snyk 2026-04-29). |
Note: this dataset is updated as new disclosures land. If an IOC you've seen elsewhere is missing, or you spot an attribution error, email support@pluto.security or reach Yotam Perkal ↗. Corrections welcome and credited.