---
id: 6876
title: "Tracking TeamPCP: Investigating Post-Compromise Attacks Seen in the Wild"
source_domain: wiz.io
source_url: "https://www.wiz.io/blog/tracking-teampcp-investigating-post-compromise-attacks-seen-in-the-wild"
published_at: "2026-03-30T23:54:14Z"
tags: ["cloud", "supply-chain", "cloud-security", "incident-response", "credential-theft", "trivy", "litellm", "teampcp"]
phying_url: "https://phying.com/item/6876"
lang: en
---

# Tracking TeamPCP: Investigating Post-Compromise Attacks Seen in the Wild

## Summary

Wiz CIRT tracked how TeamPCP turned secrets stolen in the Trivy, KICS, and LiteLLM attacks into cloud intrusions — validating credentials with TruffleHog and exploring environments within hours.

## Intelligence Metadata

- **Sources:** wiz.io
- **Published:** 2026-03-30T23:54:14Z
- **Original:** https://www.wiz.io/blog/tracking-teampcp-investigating-post-compromise-attacks-seen-in-the-wild
- **Phying News:** https://phying.com/item/6876