A new hacking group, TeamPCP, has launched a sophisticated and rapidly evolving malware campaign targeting open-source software, including the widely used Trivy vulnerability scanner.
By Epoch AI Consulting · 27 March 2026
A new hacking group, TeamPCP, has launched a sophisticated and rapidly evolving malware campaign targeting open-source software, including the widely used Trivy vulnerability scanner. The campaign involves a self-propagating worm with the alarming potential to wipe machines specifically in Iran, raising significant security concerns and highlighting the risks of supply-chain attacks in software development.
Trivy compromise - A Scanner Became a Weapon. The Attacker Won't Leave deep dive in TeamPHP attack
The digital landscape is constantly evolving, and with it, the sophistication of cyber threats. Businesses today rely heavily on open-source software for its flexibility and cost-effectiveness, but this reliance also introduces vulnerabilities. A recent and alarming example of this is the emergence of a new hacking group known as TeamPCP, which has launched a relentless campaign using self-propagating malware to compromise systems. This incident serves as a stark reminder of the need for robust security measures and a proactive approach to threat detection and response, particularly within the software development lifecycle. The attack underscores the importance of securing CI/CD pipelines and highlights the potential for devastating supply-chain attacks.
TeamPCP first came to the attention of security researchers in December 2025. Their initial focus was on compromising poorly secured cloud-hosted platforms to build a distributed proxy and scanning infrastructure. This infrastructure was then used for various malicious activities, including data exfiltration, ransomware deployment, extortion, and cryptocurrency mining. The group quickly gained notoriety for its proficiency in large-scale automation and its ability to integrate established attack techniques effectively.
More recently, TeamPCP executed a supply-chain attack that compromised virtually all versions of the Trivy vulnerability scanner. This was achieved through privileged access to the GitHub account of Aqua Security, Trivy's creator. The compromise allowed TeamPCP to inject malicious code into the widely used scanner, impacting a vast number of users and systems.
Following the Trivy compromise, researchers observed TeamPCP spreading a potent worm dubbed CanisterWorm. This worm is designed to spread automatically to new machines without requiring user interaction. Once a machine is infected, CanisterWorm searches for npm repository access tokens and compromises publishable packages by creating new versions laced with malicious code. The worm's control mechanism is particularly noteworthy. It utilises an Internet Computer Protocol-based canister, a tamper-proof smart contract designed to be resilient to takedown attempts. This canister points to dynamically changing URLs for servers hosting malicious binaries, allowing the attackers to constantly update the worm's control servers.
As the attack evolved, CanisterWorm was updated to include an additional payload: a wiper specifically targeting machines in Iran. This wiper, named Kamikaze, is triggered when the infected machine is in the Iranian timezone or configured for use in that country. The wiper's "decision tree" is alarmingly straightforward: on Kubernetes systems in Iran, it deploys a DaemonSet that wipes every node in the cluster. On non-Kubernetes systems in Iran, it executes rm -rf / --no-preserve-root, effectively wiping the entire file system. While there's no confirmed evidence of actual damage to Iranian machines, the potential for large-scale impact is significant.
This attack has several critical implications for businesses:
This incident highlights the growing complexity and sophistication of cyber threats, and the need for a proactive, intelligence-driven approach to security. We, as an AI consultancy firm see opportunities where AI implementation can improve incident response. Businesses are at a turning point as they need to be able to move faster and improve their AI strategy to protect from quickly changing attacks.
As an AI consultant UK, Epoch AI Consulting recognises that AI can play a critical role in several areas. One is threat detection: AI-powered systems can analyse vast amounts of data to identify anomalous behaviour and detect malicious activity that might otherwise go unnoticed. Automation of incident response is crucial as well. AI can automate certain aspects of incident response, such as isolating infected systems, blocking malicious traffic, and remediating vulnerabilities. Another area is vulnerability management. AI can assist in identifying and prioritising vulnerabilities, helping organisations to focus their resources on the most critical risks.
But the technology alone is not enough. Organisations need to invest in AI training for their employees to ensure they have the skills and knowledge to effectively use AI-powered security tools and respond to cyber threats. This corporate AI training should cover topics such as threat intelligence, incident response, and vulnerability management. Bespoke AI workshops help organisations get the most value from their data and security products.
An AI roadmap is essential for successfully how to implement AI in business. Epoch AI Consulting can help businesses develop a comprehensive enterprise AI strategy that aligns with their specific needs and goals. From helping clients understand their AI maturity to providing guidance on AI training for employees, our team of experts can provide the support and guidance needed to navigate the complexities of AI adoption and achieve tangible business outcomes. We understand that AI adoption strategy needs to be a core part of all businesses as they move forward. Whether they hire an AI consultant, or work with an AI consulting firm, they need to move fast and work with the best AI consultancy for businesses UK. Epoch can help AI consulting for SMEs as well as enterprise, and we are well-regarded as the best AI consultancy UK.
The TeamPCP campaign serves as a wake-up call to organisations of all sizes. The threat landscape is constantly evolving, and businesses must adopt a proactive and intelligence-driven approach to security. Investing in robust security measures, securing CI/CD pipelines, providing AI training, and developing a comprehensive AI strategy are essential steps to mitigate the risks posed by sophisticated cyber threats. As attacks become more advanced, so must our defences. The future of cybersecurity lies in leveraging the power of AI to detect, prevent, and respond to threats more effectively.
Source: Self-propagating malware poisons open source software and wipes Iran-based machines