The Federal Bureau of Investigation (FBI) is releasing this FLASH to highlight the tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) associated with the cyber criminal group TeamPCP. TeamPCP actors have conducted large-scale software supply chain compromises by targeting widely used developers and security tools, gaining access to victim environments and extracting sensitive data, including but not limited to cloud access tokens, SSH keys, and Kubernetes secrets. The FBI encourages organizations to contact the FBI if they have been compromised, and to implement the actions in the Recommendations section to reduce the likelihood and impact of compromise by TeamPCP actors.
Read more…
Source: U.S. Federal Bureau of Investigation Cyber Division
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Jamaica: Cyber attack on Office of Registrar General contained, but services impacted
August 27, 2025
The Office of the Registrar-General (ORG), formerly the Registrar General’s Department (RGD), says it was affected by a cyber incident detected on Sunday and is working to determine its full scope. “Our initial assessment indicates that this incident was primarily designed to disrupt the availability of our systems,” the ORG said Wednesday. “As investigations are still ...
- The first AI-powered proof of concept ransomware has been spotted
August 27, 2025
Security researchers from ESET have identified the first known AI-powered ransomware, which serves as a warning for security teams as generative AI has, and will, continue to make cyberattacks much more accessible for criminals. Peter Strycek and Anton Cherepanov discovered the proof of concept, which they dubbed ‘PromptLock’, which, ‘leverages Lua scripts generated from hard-coded prompts ...
- Nevada hit by cyber attack disrupting state services for thousands
August 27, 2025
A cyber attack targeting Nevada’s state technology systems has left thousands of residents without access to vital services for days, with many offices still struggling to restore full operations. The attack, which began early Sunday morning, forced the closure of numerous state agencies, including the DMV, State Police, and Attorney General’s offices on Monday and Tuesday. ...
- Deception in Depth: PRC-nexus espionage campaign hijacks web traffic to target diplomats
August 25, 2025
This blog post presents Google Threat Intelligence Group (GTIG) findings and analysis of this espionage campaign, as well as the evolution of the threat actor’s operational capabilities. GTIG examine how the malware is delivered, how the threat actor utilized social engineering and evasion techniques, and technical aspects of the multi-stage malware payloads. In this campaign, the ...
- A new security flaw in TheTruthSpy phone spyware is putting victims at risk
August 25, 2025
A stalkerware maker with a history of multiple data leaks and breaches now has a critical security vulnerability that allows anyone to take over any user account and steal their victim’s sensitive personal data, TechCrunch has confirmed. Independent security researcher Swarang Wade found the vulnerability, which allows anyone to reset the password of any user of ...
- The Resurgence of IoT Malware: Inside the Mirai-Based Botnet Campaign
August 22, 2025
Over the past year, FortiGuard Labs has been tracking a stealthy malware strain exploiting a range of vulnerabilities to infiltrate systems. Initially disclosed by a Chinese cybersecurity firm under the name “Gayfemboy.” The malware resurfaced this past July with new activity, this time targeting vulnerabilities in products from vendors such as DrayTek, TP-Link, Raisecom, and Cisco, ...