Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account

hunt.io | research | #supply-chain | #threat-intelligence | #malware | #credential-theft | #github | #python | #c2 | #dead-drop

Summary

Hunt.io analyzes the 13-file Python toolkit TeamPCP deploys post-compromise, documenting the FIRESCALE GitHub dead-drop, three-tier exfiltration and infrastructure pivots prior reporting missed.
Published
Collected

original ↗

Related coverage

blog · hunt.io
SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central Asia
Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.
blog · hunt.io
Redis Cryptomining Botnet Compromised 3,562 Servers, Exposed by the Operator's Own Files
Hunt.io parsed a Redis cryptomining botnet's own exposed logs: 3,562 servers compromised, rogue replication as the only technique that scaled, and 72.6% success against a no-auth target list.
blog · aikido.dev
Novel supplychain.local Go worm appears
On 23 September 2026, a threat actor published a novel supply chain worm to the following packages:
blog · crowdstrike.com
PhantomRaven: An LLM-Generated Information Stealer Developed for Bug Bounty Hunting
CrowdStrike identified a financially motivated threat actor who works as a bug bounty hunter and who developed and distributed the JavaScript-based information stealer PhantomRaven.
blog · wiz.io
durabletask: TeamPCP's Latest PyPi Compromise
TeamPCP hit durabletask 1.4.1-1.4.3, Microsoft's Durable Task client: a hijacked account dumped a GitHub-stored PyPI token to push malware that steals credentials, spreading via AWS SSM.
blog · wiz.io
The Worm That Keeps on Digging: TeamPCP Hits @antv in Latest Wave
Wiz attributes the cross-ecosystem campaign to TeamPCP: @antv npm packages, actions-cool/issues-helper GitHub Action, and a VS Code extension steal credentials and drop a GitHub-polled backdoor.
back