TeamPCP Threat Actor Linked to Years of Redis Exploits

Introduction

A comprehensive threat intelligence report has pulled back the curtain on TeamPCP, a cybercrime group whose operational history stretches back to at least 2020. What initially appeared as isolated incidents targeting exposed Redis instances now reveals itself as the early chapter of a calculated evolution toward software supply chain attacks. By mapping shared infrastructure, recurring deployment patterns, and persistent staging techniques, researchers have stitched together a timeline that shows how this actor matured from opportunistic scanning to strategic compromise.

Tracing the Digital Footprints Back to 2020

The investigation began with a cluster of compromised Redis servers observed in early 2020. At the time, these intrusions looked like routine cryptojacking or ransomware deployment — common outcomes for misconfigured, internet-facing databases. However, deeper forensic analysis of the malicious payloads, command-and-control (C2) domains, and post-exploitation scripts uncovered consistent artifacts that reappeared in later, more sophisticated campaigns.

Key indicators include:

• Identical domain registration patterns using privacy-protected registrars and algorithmically generated subdomains
• Reused staging servers hosting identical malware variants with only minor version increments
• Consistent use of specific obfuscation routines in deployment scripts across multiple years
• Shared infrastructure IP ranges hosted across bulletproof hosting providers in Eastern Europe

These overlaps are not coincidental. They reflect a disciplined operational security posture where the actor reuses proven infrastructure rather than building anew for each campaign — a hallmark of mature threat groups.

From Opportunistic Scanning to Strategic Targeting

TeamPCP's early activity focused on mass scanning for Redis instances binding to 0.0.0.0 without authentication — a widespread misconfiguration. The group automated exploitation using publicly available proof-of-concept code, deploying coin miners and establishing persistent access via cron jobs and SSH key injection. These were volume-based operations: low effort, moderate reward.

Around 2022, a noticeable shift occurred. The same infrastructure began delivering payloads designed for lateral movement within developer environments — SSH key harvesting, Git credential theft, and CI/CD token extraction. The targeting became selective. Instead of spraying exploits across the internet, the actor focused on organizations with mature DevOps pipelines, particularly those using container registries and artifact repositories.

This progression mirrors a known threat actor lifecycle: validate tooling on soft targets, refine tradecraft, then pivot to high-value objectives. The Redis compromises were not the goal — they were the training ground.

Supply Chain Campaigns: The Endgame Emerges

By 2023, TeamPCP was linked to a confirmed software supply chain incident involving a compromised build pipeline at a mid-sized SaaS provider. The intrusion chain began with a stolen developer credential — likely harvested from a previously compromised Redis-backed session store — which granted access to a private npm registry. From there, the actor published a typosquatted package containing a backdoored post-install script.

The malicious package was downloaded over 12,000 times before detection. Downstream victims included several fintech startups and a healthcare analytics platform. Forensic analysis of the package's C2 communications revealed direct connections to domains first observed in the 2020 Redis campaigns.

This confirms a direct lineage: the same actor, same infrastructure, same operational discipline — now applied to a far more impactful objective.

Conclusion

The TeamPCP investigation rewrites the narrative around this threat actor — not as a newcomer to supply chain attacks, but as a veteran operator who spent years honing their craft on the periphery. The connective tissue between 2020 Redis compromises and 2023 pipeline infiltration is undeniable: shared infrastructure, consistent tradecraft, and a clear trajectory toward higher-value targets. For defenders, the lesson is clear. Early-stage intrusions are rarely the final objective. They are reconnaissance, validation, and preparation. Detecting and disrupting them requires visibility that spans years, not just alerts that span hours. Grivyonx Cloud's AI-driven threat correlation engine is built to connect these long-tail signals — linking seemingly unrelated events across time and infrastructure to reveal the hidden campaigns shaping your risk landscape.