FBI Hunts TeamPCP Supply Chain Hackers

FBI Issues Urgent Warning on TeamPCP Hackers After Massive Supply Chain Cyberattacks

• FBI Warns of TeamPCP Hackers Behind Massive Supply Chain Cyberattacks
• FBI Issues Urgent Alert as TeamPCP Targets Thousands of Cloud Environments
• FBI Sounds Alarm Over TeamPCP Malware Stealing Cloud Credentials
• New FBI Warning Reveals How TeamPCP Is Hacking Trusted Software
• TeamPCP Cyberattacks Escalate as FBI Urges Immediate Security Checks

The Federal Bureau of Investigation (FBI) has issued an urgent cybersecurity alert warning organizations worldwide about TeamPCP, a sophisticated cybercriminal group linked to large-scale software supply chain attacks that have compromised more than 1,000 cloud environments and stolen highly sensitive credentials.

The warning comes as TeamPCP continues to target trusted developer and security tools, allowing hackers to infiltrate organizations through legitimate software updates instead of attacking victims directly. Security experts say the group’s tactics make these attacks particularly dangerous because they exploit software that businesses already trust.

FBI: TeamPCP Is Targeting the Software Supply Chain

According to the FBI’s FLASH advisory, TeamPCP has carried out widespread compromises by injecting malicious code into popular developer packages and security tools used across cloud environments and CI/CD pipelines.

Once installed, the malware silently harvests valuable information, including:

• Cloud access tokens
• SSH keys
• API credentials
• Kubernetes secrets
• Environment variables
• Cryptocurrency wallet data

The stolen credentials can give attackers deep access to corporate infrastructure, enabling data theft, lateral movement, and long-term persistence inside victim networks.

Thousands of Organizations Potentially Affected

Investigators believe TeamPCP’s campaigns have already impacted more than 1,000 cloud environments, making it one of the most significant software supply chain threats of the year.

The group has reportedly compromised widely used developer tools and repositories by distributing trojanized software packages that appeared legitimate. Because organizations routinely trust these updates, many victims may have unknowingly installed the malware during normal development operations.

Malware Designed to Steal Critical Secrets

The FBI attributes several malware families to TeamPCP, including CanisterWorm, SANDCLOCK, and Mini Shai-Hulud.

These tools are designed to collect cloud credentials, authentication tokens, sensitive configuration files, and other secrets that attackers can later use to expand access across enterprise environments.

Officials also warned that TeamPCP has engaged in extortion, threatening to publish stolen information if victims refuse to cooperate.

FBI Urges Immediate Action

The FBI is advising organizations to immediately review their software supply chains and strengthen defenses around development infrastructure.

Recommended actions include:

• Secure CI/CD pipelines
• Implement least-privilege access controls
• Rotate exposed credentials immediately
• Monitor for unauthorized package updates
• Audit cloud environments for suspicious activity
• Review indicators of compromise (IOCs) provided by the FBI

Organizations that suspect they have been affected are encouraged to report incidents to the FBI to assist ongoing investigations.

Why This Attack Matters

Unlike traditional cyberattacks that focus on individual victims, software supply chain attacks compromise trusted software first, allowing malware to spread automatically to thousands of downstream users.

As businesses increasingly rely on cloud-native development and open-source ecosystems, attacks like those attributed to TeamPCP demonstrate how a single compromised package can trigger widespread security incidents across multiple organizations.

The FBI’s latest warning serves as another reminder that protecting software development pipelines has become just as critical as securing corporate networks themselves. Organizations that fail to monitor trusted dependencies may unknowingly hand attackers the keys to their most valuable digital assets.