---
id: 6181
title: "How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account"
source_domain: hunt.io
source_url: "https://hunt.io/blog/teampcp-python-toolkit-firescale-github-c2-takedown"
published_at: "2026-05-14T00:00:00Z"
tags: ["supply-chain", "threat-intelligence", "malware", "credential-theft", "github", "python", "c2", "dead-drop"]
phying_url: "https://phying.com/item/6181"
lang: en
---

# How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account

## Summary

Hunt.io analyzes the 13-file Python toolkit TeamPCP deploys post-compromise, documenting the FIRESCALE GitHub dead-drop, three-tier exfiltration and infrastructure pivots prior reporting missed.

## Intelligence Metadata

- **Sources:** hunt.io
- **Published:** 2026-05-14T00:00:00Z
- **Original:** https://hunt.io/blog/teampcp-python-toolkit-firescale-github-c2-takedown
- **Phying News:** https://phying.com/item/6181