TeamPCP’s Supply Chain Attack Spree Continues

Over the past week, threat actors linked to TeamPCP have been on a supply chain tear. They hit open source vulnerability scanner Aqua Trivy before infiltrating Checkmarx GitHub Actions and OpenVSX extensions, then set their sights on open-source Python and proxy server LiteLLM, in many incidents vacuuming up credentials via infostealer malware.

On Friday, they struck again.

The group’s latest compromise was the Telnyx Python SDK on the Python Package Index (PyPl), which is the official software repository for Python where users can install third-party libraries. Telnyx Python SDK is one of these libraries, and provides interfaces for Python applications for interacting with the Telnyx REST API. The SDK has over 3.8 million downloads (and 790,000 monthly downloads).

PyPl versions 4.87.1 and 4.87.2 of Telnyx contained malicious code, which was published to PyPl on March 27 (PyPl has since quarantined both malicious versions). 

“Both versions ship a backdoored telnyx/_client.py that fires two platform-specific attack chains the moment you run import telnyx: on Windows, it drops a persistent binary disguised as msbuild.exe in the Startup folder; on Linux/macOS, it downloads a credential harvester hidden inside a WAV audio file,” according to Kiran Raj and Rachana Misal, researchers with Endor Labs in a Friday analysis. 

Raj and Misal said the attack vector in this latest compromise appears to be a stolen PyPl token, likely from a previous credential harvest of LiteLLM. This move is indicative of a broader tactic by the attackers over the past week: stealing credentials from one tool, using them to then skip over and poison other packages, and then repeating in order to increase access across CI/CD and developer environments. 

Who is TeamPCP? 

Researchers have been able to attribute the wave of attacks to TeamPCP based on the RSA-4096 public key embedded in the payloads used in attacks. In the Telnyx attack, for instance, the key is identical to the one used in the LiteLLM compromise. Similarly, the exfiltration pattern (using AES-256-CBC encryption and RSA OAEP key wrapping) also matches the prior compromise.

TeamPCP burst onto the scene with a bang in December (a good in-depth analysis of the attackers’ activities can be found here), launching a campaign that targeted things like misconfigured Docker APIs, Redis servers or vulnerable React/Next.js applications to then pivot into data theft and extortion. Notably, Flare researchers have said that TeamPCP is a cloud-native cybercrime platform rather than a “single-purpose malware gang.” 

In this latest attack, the group has been able to use a smash-and-grab approach across the supply chain. It’s not stealthy, and it doesn’t last long - but the sheer scale is enough for the threat actors before they move on. For instance, LiteLMM exists in 36 percent of all cloud environments, Wiz researchers have found.

For defenders, the glass-half-full side of this means early detection and warning for impacted victims - sometimes within hours of the compromised versions being pushed out. 

“The community has done a good job publicizing this,” Benjamin Read, director of strategic threat intelligence with Wiz, told Decipher. “The actors have prioritized quickly grabbing as much as they can, and they haven’t prioritized stealth. They’ve tried to run it right away, pull as much as you can before anyone notices. It meant that if you were waiting 24 hours before installing the newest version, this would have been notified in all of the cases.”

Supply Chain Attacks Continue  

Supply chain attacks are nothing new (throwback to the 2017 CCleaner incident and last year’s tj-actions attack) but their large-scale potential net of victims make them popular for threat actors - particularly in the open source ecosystem. Threat actors are also looking for ways to both move faster and increase that radius of impact. 

In September, a worrying campaign emerged where attackers compromised npm packages using malware with the ability to automatically add malicious code not only to one package, but also any other packages it has access to. The attack involved a self-replicating worm, called Shai-Hulud, and marked a turning point for this type of attack because it involved credential theft and data exfiltration, rather than cryptomining, said Dan Lorenc, CEO and co-founder of Chainguard. 

“Shai-Hulud was one of the first campaigns at this scale to steal cloud credentials, and that tried to do real damage to companies instead of just stealing crypto tokens or something,” Lorenc told Decipher.

Overall, a significant takeaway from this series of incidents is that security teams need to treat their CI/CD systems like production systems, Lorenc said. Impacted organizations should also audit workflows using pull_request_target, and rotate secrets, researchers have stressed. While some researchers have recommended pinning to a full commit SHA, others have pointed out that this may not be as effective as initially thought.

This article was updated on March 27 to add more context around security recommendations in response to TeamPCP's activity.