TeamPCP

{
  "id": "ATTACK:enterprise:G1056",
  "title": "TeamPCP",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G1056",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--20f26558-e05d-46cf-8847-c2b5a83ee779",
  "external_id": "G1056",
  "domain": "enterprise",
  "created": "2026-07-16T15:13:31.109Z",
  "modified": "2026-09-02T17:31:48.218Z",
  "version": "1.0",
  "aliases": [
    "TeamPCP",
    "PCPCat",
    "ShellForce",
    "DeadCatx3",
    "SHADOW-WATER-058",
    "UNC6780"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "UNC6780"
    },
    {
      "source_name": "PCPCat"
    },
    {
      "source_name": "ShellForce"
    },
    {
      "source_name": "DeadCatx3"
    },
    {
      "source_name": "Aqua Security Trivy Compromise MAR 2026",
      "url": "https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23"
    },
    {
      "source_name": "Aqua Security Blog Trivy Compromise APR 2026",
      "url": "https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"
    },
    {
      "source_name": "Google AI Threat Tracker MAY 2026",
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access"
    },
    {
      "source_name": "Wiz Trivy Compromise MAR 2026",
      "url": "https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack"
    },
    {
      "source_name": "Trend Micro TeamPCP MAY 2026",
      "url": "https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html"
    },
    {
      "source_name": "Palo Alto TeamPCP MAR 2026",
      "url": "https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"
    },
    {
      "source_name": "Wiz TeamPCP Profile MAY 2026",
      "url": "https://threats.wiz.io/all-actors/teampcp"
    }
  ]
}