A threat actor is systematically targeting misconfigured and exposed cloud management services and control interfaces to hijack infrastructure, expand its operations, and monetize compromised systems in multiple ways.
The campaign appears to have started in late December and has already compromised at least 60,000 servers worldwide via a worm-like attack where each infected system scans for and infects the next vulnerable target. According to an analysis published this week by cybersecurity firm Flare, the operation, tracked as TeamPCP and operating under several aliases including PCPcat and ShellForce, represents a troubling evolution in cloud-native cybercrime.
"TeamPCP's strength does not come from novel exploits or original malware, but from the large-scale automation and integration of well-known attack techniques," Flare researcher Assaf Morag, wrote in a recent blog post. "The group industrializes existing vulnerabilities, misconfigurations, and recycled tooling into a cloud-native exploitation platform that turns exposed infrastructure into a self-propagating criminal ecosystem."
Related:'Encrypt It Already' Campaign Pushes Big Tech to Prioritize E2E Encryption
TeamPCP's Large Scale Automation
The threat actor's playbook involves scanning broad IP ranges for exposed Docker APIs, Kubernetes clusters, Redis servers, Ray dashboards, and systems containing the widely abused React2Shell vulnerability in React Server Components. Once it gains access to a system, TeamPCP deploys malicious Python and Shell scripts that pull down additional payloads to install proxies, tunneling software, and components that enable persistence even after server reboots.
Flare observed the attackers using a dedicated script for Kubernetes (kube.py) environments to harvest credentials and to push malicious containers across all accessible pods using administrative level APIs. The approach, according to Morag, lets the threat actor turn an initial foothold into cluster-wide control.
"This effectively converts the entire cluster into a self-propagating scanning fabric," Morag noted. The script for exploiting the infamous React2Shell vulnerability, tracked as CVE-2025-29927, allows the attackers to run remote commands on vulnerable applications and to siphon out sensitive data, environments and cloud credentials.
More than 60% of the attacks that Flare analyzed involved cloud infrastructure hosted on Azure; 37% were AWS-hosted. TeamPCP has also been actively targeting servers in Google and Oracle cloud environments.
Multiple Revenue Streams
... continue reading