The Federal Bureau of Investigation (FBI) is releasing this FLASH to highlight the tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) associated with the cyber criminal group TeamPCP. TeamPCP actors have conducted large-scale software supply chain compromises by targeting widely used developers and security tools, gaining access to victim environments and extracting sensitive data, including but not limited to cloud access tokens, SSH keys, and Kubernetes secrets. The FBI encourages organizations to contact the FBI if they have been compromised, and to implement the actions in the Recommendations section to reduce the likelihood and impact of compromise by TeamPCP actors.
Read more…
Source: U.S. Federal Bureau of Investigation Cyber Division
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Hobbs and Whistles owner investigates hack that may have exposed customer data
October 13, 2026
The owner of Phase Eight, Hobbs and Whistles has said its websites and IT systems have been hit by a cyber-attack that may have compromised customers’ personal data. The South-African listed TFG London said it identified the “cybersecurity incident” at the three UK-based retail chains on Sunday. Its two other UK brands, Inside Story and White ...
- Hundreds of French supermarkets hit by cyberattack on refrigeration systems
October 12, 2026
Several supermarkets were forced to discard fresh and frozen food, Intermarché said, and have yet to estimate the losses. The Paris prosecutor has opened an investigation. Hundreds of French supermarkets belonging to the Intermarché and Coopérative U chains have fallen victim to a cyberattack targeting their refrigeration systems, the two retail giants said on Monday. Around 150 ...
- ‘123456’ password used in massive Danish CPR data breach
October 10, 2026
At least three accounts at the company linked to a major breach of Denmark’s CPR register reportedly used the password “123456”, including an administrator account. At least three user accounts at the Funen-based IT company Pays used the password “123456” when hackers gained access to Denmark’s CPR register, Politiken reports. One of them was the company’s administrator ...
- Shai-Hulud worm makes jump to AI infrastructure with Tensorlake compromise
October 8, 2026
The credential-hijacking Shai-Hulud worm has struck again, this time burrowing its way into a popular AI agent platform SDK. Multiple security researchers reported Thursday that they had detected Shai-Hulud infection in a recent release of the npm package for version 0.5.144 of Tensorlake’s SDK. That package has somewhere in the neighborhood of 12,000 downloads per week, ...
- UK and Germany launch joint-partnership to counter sabotage and cyber attacks
October 8, 2026
Prime Minister Andy Burnham will travel to Berlin today for talks with Chancellor Friedrich Merz, as the UK and Germany work together on technologies and industries that will drive growth in every UK postcode, and build resilience against shared threats. The UK and Germany are Europe’s two largest economies and biggest investors in defence and today ...
- Attackers uses poem to infect thousands of servers with malware
October 8, 2026
Somewhere in the trackless wastes of cyberspace, a digital Robert Langdon is decoding an ancient poem to find the location of his masters and receive instructions on his next steps. I might be exaggerating a bit, but this is the gist of a rather bizarre story on cyberattacks and cryptocurrency mining. Cybersecurity researchers from Lumen’s Black ...