TeamPCP: How a Worm Is Industrializing Cloud Infrastructure Attacks
A massive, self-propagating attack campaign is turning exposed cloud infrastructure into a criminal ecosystem. And the scary part? There’s nothing novel about the techniques being used.
The Core Insight
Security researchers at Flare have documented what they call a “worm-driven” campaign that systematically targets cloud-native environments. The threat actor, known as TeamPCP (also called DeadCatx3, PCPcat, and ShellForce), doesn’t rely on zero-days or sophisticated malware. Instead, they’ve industrialized exploitation of well-known vulnerabilities and misconfigurations.
The attack chain targets:
– Exposed Docker APIs
– Kubernetes clusters
– Ray dashboards
– Redis servers
– React/Next.js applications with CVE-2025-55182 (React2Shell)
Once compromised, the infrastructure becomes part of a self-propagating criminal platform used for data theft, cryptocurrency mining, ransomware, and proxying further attacks.
Why This Matters
What makes TeamPCP dangerous isn’t technical sophistication—it’s operational integration and scale. They’ve built an automated pipeline that:
- Scans for vulnerable infrastructure across large IP ranges
- Exploits using known CVEs and misconfigurations
- Establishes persistence through malicious containers and backdoors
- Propagates automatically to find new targets
- Monetizes through multiple revenue streams (mining, extortion, proxying)
The researchers describe it as transforming exposed infrastructure into a “self-propagating criminal ecosystem.” One compromised server leads to scanning for more, which leads to more compromises, which leads to more scanning.
The Technical Details
The attack uses several coordinated payloads:
proxy.sh – The core component that:
– Installs proxy and tunneling utilities
– Deploys P2P networking tools
– Launches scanners to find new victims
– Detects Kubernetes environments and adapts behavior
scanner.py – Finds misconfigured Docker APIs and Ray dashboards by:
– Downloading CIDR lists from GitHub (account: DeadCatx3)
– Scanning IP ranges for exposed services
– Optionally deploying cryptocurrency miners
kube.py – Kubernetes-specific functionality:
– Harvests cluster credentials
– Discovers pods and namespaces
– Drops proxy.sh into accessible pods
– Deploys privileged pods with host mounts for persistence
react.py – Exploits CVE-2025-29927 for remote code execution at scale
pcpcat.py – Master coordination script that automates the entire pipeline
The Hybrid Monetization Model
TeamPCP doesn’t just mine crypto or demand ransoms—they do both, plus more:
- Cryptocurrency mining on compromised infrastructure
- Data hosting using stolen compute resources
- Proxy and C2 relays for other criminal operations
- Data theft and extortion through leaked databases
- Identity records sold through their ShellForce brand
This multi-revenue approach makes them resilient to takedowns. Losing one income stream doesn’t kill the operation.
Key Takeaways
No zero-days required. Everything in this campaign uses known vulnerabilities and documented misconfigurations. Basic hygiene would stop it.
Cloud-native ≠ secure. Modern cloud infrastructure has many exposed surfaces. Docker APIs, Kubernetes APIs, and managed services create attack vectors that traditional perimeter security doesn’t address.
Worm dynamics amplify impact. Once the campaign reaches critical mass, it becomes self-sustaining. Each compromise funds and enables more compromises.
AWS and Azure are primary targets. The attackers optimize for major cloud providers where valuable targets concentrate.
Collateral damage is the point. The campaign is opportunistic—anyone running vulnerable infrastructure becomes a victim, regardless of whether they were specifically targeted.
Looking Ahead
TeamPCP demonstrates a troubling evolution in cloud security threats. By combining automation, known exploits, and multi-stream monetization, they’ve built a sustainable criminal operation without needing breakthrough capabilities.
The defense playbook is straightforward but often unimplemented:
– Don’t expose Docker APIs to the internet
– Secure Kubernetes API endpoints
– Patch known vulnerabilities promptly
– Monitor for unexpected container deployments
– Segment networks to limit propagation
The challenge isn’t knowing what to do—it’s doing it consistently across complex cloud environments. TeamPCP is betting most organizations won’t.
Based on: “TeamPCP Worm Exploits Cloud Infrastructure to Build Criminal Infrastructure” (The Hacker News)