TeamPCP Poisoned Trivy, KICS, and LiteLLM to Harvest 500,000 Credentials — Now Vect Ransomware Is Cashing In

Imagine hiring a locksmith to secure your home, only to discover the locksmith’s toolkit was already wired to hand your keys to a burglar the moment you ran the installation wizard. That is precisely what happened across thousands of enterprise development environments between March and April 2026, when a threat actor called TeamPCP weaponised the very tools security and DevOps teams trust most — and handed the resulting loot to the Vect ransomware-as-a-service (RaaS) operation to monetise. The result: 500,000 stolen credential sets, 300+ GB of exfiltrated data, and a new blueprint for the ransomware kill chain that turns defenders into unwitting accomplices.

The Kill Chain Reversed: Supply Chain First, Ransomware Second

Classical ransomware groups spend weeks — sometimes months — performing initial access, reconnaissance, lateral movement, and privilege escalation before deploying their payload. TeamPCP and Vect inverted this model. Rather than targeting victim networks directly, TeamPCP poisoned the tools organisations pulled into their own pipelines, pre-positioning credentials at massive scale before a single ransom note was ever written.

Analysts at Palo Alto Networks Unit 42 describe TeamPCP as a structured threat actor whose operations date to September 2025. The group gained wider notoriety in December 2025 through the React2Shell campaign (CVE-2025-55182), which demonstrated a willingness to target security infrastructure specifically. The Vect RaaS operation launched the same month, with its first victims appearing in January 2026.

By late March 2026, the two groups formalised their partnership — and the campaign scale jumped dramatically.

Seven Waves, Six Weeks: The Attack Timeline

Researchers at Trend Micro and Unit 42 jointly identified seven discrete attack waves. The table below summarises the confirmed compromises:

Date (2026)	Target	Exposure Window / Scale
19 March	Aqua Security Trivy	76 of 77 version tags overwritten with malicious commits
21–23 March	Checkmarx KICS	Docker Hub, GitHub Actions, and two VS Code extensions compromised
23–24 March	BerriAI LiteLLM	96 million monthly downloads; PyPI pipeline poisoned
27 March	Telnyx Python SDK	Payload hidden inside valid WAV audio files (steganography)
22 April	Checkmarx KICS (second wave)	83-minute exposure window; VS Code/OpenVSX extensions re-targeted
23 April	Bitwarden CLI	~334 downloads in a 93-minute window before detection
24 April	elementary-data	1.1 million monthly downloads; injected via open PR comment

Of the seven waves, the most technically sophisticated targeted Trivy — the open-source vulnerability scanner embedded in thousands of enterprise Kubernetes and container CI pipelines. Sophos notes that malicious force-pushed commits replaced nearly all published version tags, ensuring that any pipeline pulling “the latest stable release” of Trivy instead downloaded a credential harvester.

Technical Deep Dive: Four Novel Techniques in One Campaign

What makes this campaign instructive for defenders is the breadth of evasion methods deployed simultaneously. Unit 42’s full technical report identifies four distinct mechanisms:

1. CanisterWorm — Self-Replicating Docker Propagation

The third-generation Trivy payload introduced CanisterWorm, a self-replicating worm that scanned Docker APIs exposed on port 2375 across victim networks, harvested SSH keys from running containers, and attempted to spread laterally to adjacent hosts — all without any command from TeamPCP’s own infrastructure.

2. .pth File Persistence in Python Environments

The LiteLLM attack used a file called litellm_init.pth — a Python path configuration file that the interpreter processes automatically at startup, regardless of whether LiteLLM itself is imported. This technique ensured the credential-harvesting payload executed in any Python process on the compromised system, not just those that explicitly use LiteLLM, making detection far harder.

3. WAV Steganography for Payload Delivery

The Telnyx SDK compromise hid AES-256-CBC-encrypted second-stage payloads inside structurally valid WAV audio files. Network security appliances that inspect file types by magic bytes — rather than entropy analysis — would see legitimate audio traffic. This is an uncommon technique at scale and signals a deliberate effort to evade network-layer DLP controls.

4. Decentralised Internet Computer Protocol (ICP) C2

Rather than using conventional command-and-control infrastructure that law enforcement can seize or registrars can take down, TeamPCP routed exfiltrated data through Internet Computer Protocol (ICP) canisters — blockchain-hosted containers that have no central owner and no registrar to contact for takedown. This architecture makes disruption of the C2 layer extremely difficult. Stolen credentials were encrypted with 4096-bit RSA public keys before exfiltration, so even intercepted traffic is unreadable without the actor’s private key.

Vect’s Hidden Sting: Paying the Ransom May Not Restore Your Data

Here is the detail that should alarm every organisation currently assessing whether to pay: Vect ransomware contains a critical encryption defect. Researchers at Check Point and JUMPSEC independently confirmed that files larger than 128 KB are permanently destroyed rather than reversibly encrypted. Victims paying the ransom may receive a decryptor that restores small configuration files while leaving databases, VM images, and document archives completely unrecoverable.

The irony compounds further: even after 154 confirmed attacks and tens of successful ransom payments, Vect’s operators knew about this defect yet continued recruiting affiliates and expanding operations. This mirrors the GodDamn ransomware campaign we covered earlier this month, where “successful” payment by victims produced little actual restoration. The lesson is consistent: immutable backups, not ransom payments, are the only reliable recovery path.

What You Should Do Right Now — Sanjay Seth’s Defensive Recommendations

As someone who has hardened CI/CD pipelines and cloud environments for Indian enterprises for three decades, I want to be direct: this campaign is not a theoretical risk. Indian IT and financial services organisations running DevSecOps workflows — especially those using containerisation, Kubernetes, or AI APIs — are in the direct blast radius. Here is my prioritised action list:

1. Audit your pipeline tool inventory immediately. Confirm which versions of Trivy, KICS, LiteLLM, Telnyx SDK, Bitwarden CLI, and elementary-data are deployed. Cross-reference against TeamPCP’s known malicious version tags. If you pulled Trivy between 19 March and early April 2026 without a verified hash check, assume compromise.
2. Rotate all credentials harvested from CI/CD environments. This means AWS IAM keys, GCP service accounts, Azure managed identity tokens, Kubernetes service account tokens, SSH deploy keys, GitHub and GitLab PATs, npm tokens, PyPI API keys, and database credentials. All of them. Treat pre-rotation credentials as burned.
3. Lock down Docker API exposure. Port 2375 (unauthenticated Docker API) must not be reachable from any non-trusted network segment. CanisterWorm exploited this heavily. This is a basic hardening step that many containerised environments still miss.
4. Implement cryptographic verification for open-source dependencies. Pin dependencies to verified commit SHAs, not floating version tags. Tags can be force-pushed — SHAs cannot. This single control would have neutralised the Trivy and KICS attacks.
5. Segment CI/CD networks from production. A Zero Trust architecture that treats the build pipeline as an untrusted zone limits what credentials a compromised build agent can access. The breadth of credentials stolen in this campaign reflects flat network topologies where CI runners had broad access.
6. Review .pth files and Python startup hooks. Audit all Python environments for unexpected .pth files in site-packages. Run python -c "import site; print(site.getsitepackages())" to locate the directories, then inspect for unauthorised files.
7. Test your backups — and test them again. Given Vect’s encryption defect, any organisation that relies on paying a ransom as a recovery strategy has already lost. Immutable, offline backups tested for restoration integrity are non-negotiable.

If your organisation uses any of the compromised tools and you are uncertain about your exposure, this is precisely the kind of incident that warrants an emergency security assessment — not a two-week scheduled review.

For context on how attackers are further evolving their ransomware tooling through AI-driven automation, also see our recent coverage of JadePuffer, the first fully autonomous AI ransomware. The convergence of supply-chain access and autonomous deployment is the trajectory we are on.

Why This Story Matters for Indian Enterprises

India’s technology sector is the world’s largest consumer of open-source DevOps tooling relative to its software industry size. Trivy is installed in virtually every Kubernetes-based pipeline, KICS is a standard IaC scanner for multi-cloud environments, and LiteLLM has become the default AI gateway for teams building on multiple LLM providers simultaneously — a pattern exploding in Bengaluru, Hyderabad, Pune, and Delhi NCR right now.

The TeamPCP campaign should be read as a direct targeting of the Indian DevOps community, not a distant Western incident. The credential categories stolen — cloud tokens, Kubernetes secrets, database credentials — map directly to the data assets held by Indian BFSI, healthtech, and SaaS organisations running on AWS, Azure, and GCP.

Frequently Asked Questions

How do I know if my Trivy installation was compromised?

Check the Trivy version tag your pipeline pulls and verify it against the cryptographic SHA published by Aqua Security for that release. If you were pulling a floating latest or numbered tag (not a verified SHA) between 19 March and approximately 10 April 2026, assume compromise and rotate all credentials accessible from that build environment. Aqua Security’s official advisory provides the list of affected tags.

If we pay Vect’s ransom, will we get our files back?

Not reliably. Check Point and JUMPSEC both confirmed that Vect’s encryption implementation permanently destroys files larger than 128 KB rather than encrypting them reversibly. A decryptor, even if provided, cannot restore data that has been overwritten rather than encrypted. Do not count on payment as a recovery strategy. Engage a professional incident response team and restore from verified backups.

Does this affect cloud-only environments, or only on-premise pipelines?

Both. TeamPCP’s payloads specifically targeted cloud credentials — AWS, Azure, and GCP access tokens were primary targets, alongside Kubernetes secrets. CanisterWorm actively scanned for exposed Docker APIs regardless of whether the underlying infrastructure was on-premise or cloud-hosted. Cloud-native environments are at full risk if CI/CD tooling was compromised.

Is a Zero Trust architecture sufficient protection against this type of attack?

A mature Zero Trust implementation significantly limits the blast radius. When CI/CD runners operate in isolated network segments with minimal-privilege identities, a compromised build tool can only access credentials scoped to that specific job — not the entire cloud account. That said, Zero Trust must be complemented by supply-chain integrity controls (SHA pinning, SBOM verification, signed packages) to prevent the initial compromise in the first place. Neither control alone is sufficient; both together are.

---