Tracking TeamPCP: Investigating Post-Compromise Attacks Seen in the Wild

How TeamPCP are leveraging stolen secrets from the recent supply chain attacks to compromise cloud environments

Following the recent supply chain attacks targeting the Trivy, KICKS, and LiteLLM projects, the Wiz Customer Incident Response Team (CIRT) and Wiz Research have proactively hunted, notified, and responded to multiple attacks being carried out by the TeamPCP threat actor group.

Wiz Research has tracked the campaign of supply chain operations against popular open source tools carried out by the group calling themselves "TeamPCP" over the past two weeks:

March 19 -Trivy: Credential-stealing malware injected into Aqua Security's vulnerability scanner through the binary, GitHub Actions and container images.

March 23 -KICS: Same malware injected into Checkmarx's IaC scanner, through the GitHub Action and OpenVSX extensions.

March 24 -LiteLLM: Malicious PyPI packages targeting the popular LLM proxy library.

March 27 - Telnyx: Malicious versions of the Telnyx Python package were published to PyPI.

All four attacks deployed malware that harvests cloud credentials, SSH keys, Kubernetes configuration files, and CI/CD secrets, encrypting and exfiltrating them to attacker-controlled domains. This blog post details how Wiz has seen these credentials used after they were stolen.

Wiz CIRT saw indications in Cloud, Code, and Runtime evidence that the credentials and secrets stolen in the supply chain compromises were quickly validated and used to explore victim environments and exfiltrate additional data. While the speed at which they were used suggests that it was the work of the same threat actors responsible for the supply chain operations, we are not able to rule out the secrets being shared with other groups and used by them.

Wiz CIRT identified activity leveraging secrets stolen via the Trivy supply chain compromise as early as March 19, just hours after initial malware was deployed. As is often seen in mass credential harvesting operations, the first steps were  validating the stolen secrets using the open-source toolTruffleHog. TruffleHog can automate credential validation by making live API calls directly to the respective cloud providers. For example, when verifying an AWS access key, the TruffleHog invokes the sts:GetCallerIdentity API call to confirm whether the compromised credentials remain active and usable. The team identified TruffleHog calls against different types of cloud and SaaS keys, including AWS access keys, Azure application secrets, and different SaaS tokens.

After the secrets were  validated, and as quickly as 24 hours after the initial theft, the threat actor began performing AWS discovery operations. This phase focused on enumerating the victims’ environment across several AWS services:

Identity and Compute:IAM (ListUsers, ListRoles, ListAttachedUserPolicies), EC2 (DescribeInstances), and Lambda (ListFunctions).

Infrastructure and Storage:RDS (DescribeDBInstances), Route 53 (ListHostedZones), and S3 (ListBuckets, GetBucketPublicAccessBlock).

Container Environments (ECS):TeamPCP showed a distinct focus on ECS, mapping clusters and task definitions (ListClusters, ListTaskDefinitions, DescribeTaskDefinition, ListTasks, DescribeTasks) to identify targets for interactive container access.

Secrets Management:AWS Secrets Manager (ListSecrets), which was targeted to prepare a list of secrets available for bulk exfiltration.

Once access had been validated and the layout identified, the actors used a variety of techniques to further their scheme by executing additional code and gaining access to other parts of the victim environments.

In multiple instances TeamPCP abused GitHub workflows to execute code within targeted repositories. Using stolen Personal Access Tokens (PATs), the attackers created pull requests containing malicious workflows, which were then triggered to run in the context of the repository. These workflows likely provided access to repository contents and runtime secrets, including environment variables and tokens available during execution. After execution, the attacker deleted the associated workflow logs, likely to remove evidence of their activity and hinder detection.

In other cases, residual evidence indicated that the malicious workflows were created by theNord StreamGitHub tool.

In AWS environments, the ECS Exec feature (leveraging the SSM Agent) was used to execute Bash commands and Python scripts directly on running containers. This access enabled the attackers to explore the environment and exfiltrate sensitive data.

The threat actors targeted valuable information throughout the victim environments, using native techniques to efficiently steal data.  . Beyond its immediate value, the exfiltrated data may also contain additional secrets that enable further access and exploitation.

In GitHub, they abused authenticated access via Personal Access Tokens (PATs) to clone repositories at scale using “git.clone”, enabling access to source code, configuration files, and embedded secrets within impacted environments.

Within AWS environments, the attackers used the stolen credentials to access and extract data from services such as S3 buckets, Secrets Manager, and databases, enabling bulk data retrieval and potential exposure of sensitive information.

TeamPCP’s post-compromise activities focused on compromising additional secrets and exfiltrating massive amounts of data from code repositories and cloud resources. The exfiltrated data and compromised secrets are potentially being shared with other groups to enable a range of operations.

TeamPCP is not trying to hide or blend in - they prioritized ease of use and speed by using open-source tools with strong signatures, conducting massive operations, and using bold resource names such as “pawn” or “massive-exfil”. Wiz CIRT observed the bulk of TeamPCP’s activity originating from Mullvad Virtual Private Network (VPN) exit nodes and virtual private server hosts such as InterServer.

To detect and respond to anomalous activity, ensure audit logging is enabled and monitored across your cloud service providers and version control systems. This includes off-by-default logs such as cloud storage logs and IP logging in GitHub audit logs.

To identify the post supply chain attack compromise, hunt for the following:

Any logs source with the known IOCs detailed below, including IP addresses and User agents.

Unexpected usage of VPN providers

Keys or tokens usage from new/anomalous Autonomous System Organizations (ASOs)

Unusual Enumeration Activity, Ex: “ListUsers”, “ListRoles” “DescribeInstances”

Unusual Secret Access and Validation, Ex: ”ListSecrets”, “GetCallerIdentity”

Many  “GetSecretValue”, or “GetObject” events in a short period of time by a token or a key

Anomalous execution of “ExecuteCommand” by a token or a key

Anomalous execution on workloads from SSM processes

Many “git.clone” events in a short period of time by a token or a key

Deletion of a Workflow log by a token or a key

Wiz customers can find a copy of this update in the threat centerhere.

If you are a Wiz Defend customer, you can search for the below Detections:

For hardening and remediation recommendations, please see Wiz blog posts onTrivy,KICS, andLiteLLMsupply chain attacks.

If you suspect you are under attack,reach out to Wiz CIRT.

Kudelski Security:Investigating Two Variants of the Trivy Supply-Chain Compromise

Accelerate your SecOps team with the Blue Agent for threat investigation, now Generally Available

Verified by Microsoft. Built for Azure. Secured by Wiz.

Accelerate your path to Zero Criticals with AI that investigates, assigns, and guides cloud remediation for you

Get a personalized demo

©2026Wiz, Inc.

StatusPrivacy PolicyTerms of UseModern Slavery StatementCookie Settings