# TeamPCP: Institutional Infrastructure Compromise via CI/CD Supply Chain

- **Artifact ID:** CHQ-EX-2026-014
- **Public record:** https://record.cybersecurityhq.com/exhibits/chq-ex-2026-014
- **Machine-record SHA-256:** `4a2fdee70f9df5a0b576904ea8e8b024d0378130e0b006de1dbe8f4d540ea378`

## Complete structured record

```json
{
  "id": "CHQ-EX-2026-014",
  "title": "TeamPCP: Institutional Infrastructure Compromise via CI/CD Supply Chain",
  "subtitle": "Threat actor exploited a compromised open-source security scanner to harvest cloud credentials from a European Union institution, demonstrating that CI/CD-based credential extraction can traverse from developer tooling into sovereign government infrastructure without requiring elevated attacker capability at the target.",
  "classification_notice": [
    "This document is published as a CHQ Exhibit. It records historical conditions, breach events, and industry practices as they existed during the periods described. This Exhibit records observed conditions, exploitation mechanics, and structural patterns as documented in public disclosures, security research publications, and vendor advisories during the stated period.",
    "This document does not address present conditions and carries no current applicability. No evaluation of past practices is intended or implied.",
    "CHQ Exhibits are not superseded by later artifacts unless explicitly invalidated for factual error."
  ],
  "metadata": {
    "artifact_class": "EXHIBIT",
    "temporal_scope": "OPERATIONAL (FEBRUARY TO APRIL 2026)",
    "authority_level": "NON-JUDGMENTAL",
    "reliance_status": "EXHIBIT_ONLY",
    "update_policy": "ERRATA_ONLY",
    "temporal_start": "2026-02-01",
    "temporal_end": "2026-04-30"
  },
  "sections": [
    {
      "heading": "I. Factual Record",
      "content": [
        "Threat Actor: TeamPCP, also tracked as DeadCatx3, PCPcat, and ShellForce. Documented by CrowdStrike, Wiz, and SANS as a cloud-native threat actor. Linked to ransomware, data exfiltration, and cryptomining campaigns. Announced partnership with CipherForce ransomware group during this campaign.",
        "Campaign Origin: In February 2026, TeamPCP exploited a misconfiguration in Trivy’s GitHub Actions environment, identified as CVE-2026-33634, to establish a foothold via a privileged access token. Aqua Security rotated credentials following discovery, but TeamPCP retained access through the rotation window by stealing newly rotated credentials before they invalidated prior access.",
        "Cascade: Between March 19 and 27, 2026, TeamPCP conducted a systematic campaign against open-source security infrastructure. After Trivy, the group targeted Checkmarx KICS (March 21, force-pushing malicious commits to all 35 version tags), then LiteLLM (whose CI/CD pipeline used Trivy for scanning, allowing the poisoned trivy-action to harvest a PyPI publishing token). Each compromised tool became the entry point for the next.",
        "Mechanism: TeamPCP manipulated mutable GitHub Action version tags, forcing CI/CD pipelines to automatically pull credential-harvesting payloads on execution. Exfiltration channels included typosquatted domains, malicious GitHub repositories, and Cloudflare tunnels. Targeted credentials included AWS, GCP, Azure cloud credentials, Kubernetes tokens, Docker registry credentials, database passwords, TLS private keys, SSH keys, and cryptocurrency wallet files.",
        "European Commission Breach: The European Commission downloaded a compromised version of Trivy through normal software update channels on March 19, 2026. Trivy harvested an AWS API key with management rights over other EC AWS accounts. TeamPCP deployed TruffleHog to validate and expand credentials by calling the Security Token Service. A new access key was silently attached to an existing user account. Reconnaissance began. Approximately 92 gigabytes of compressed data (340 GB uncompressed) were staged for exfiltration. The breach affected 42 internal Commission clients and at least 29 additional Union entities.",
        "CERT-EU Response: CERT-EU was notified March 25, 2026, by the European Commission under Article 21 of Regulation (EU) 2023/2841. Official advisory published April 3, 2026, attributing initial access with high confidence to the Trivy supply chain compromise. CERT-EU confirmed no evidence of lateral movement to other AWS accounts despite TeamPCP holding management rights that would have permitted it.",
        "Attribution: CERT-EU and the European Commission assessed with high confidence that the initial access vector was the Trivy supply chain compromise attributed to TeamPCP by Aqua Security. Attribution based on timing of initial access, resources targeted, and confirmed use of compromised Trivy version during the relevant window."
      ]
    },
    {
      "heading": "II. Failure Pattern",
      "content": [
        "The campaign demonstrates that a security tool embedded in a CI/CD pipeline functions as a trust inheritance surface, not merely as a passive dependency. The European Commission did not execute attacker code through a user action or a misconfiguration. It executed attacker code through the standard operation of a security scanning tool it was supposed to trust.",
        "The mutable tag mechanism is the structural failure. GitHub Actions pinned to version tags rather than immutable SHA hashes automatically pull whatever code the tag points to at execution time. When an attacker controls the tag, they control what executes in every pipeline that trusts it, without any action required from the pipeline operator.",
        "Credential rotation failed as a containment mechanism. Aqua Security rotated credentials after discovering the February compromise. TeamPCP retained access because some credentials remain valid during the rotation process. Attested containment did not reflect actual revocation state. This is not a rotation failure in the procedural sense — the rotation occurred. It is a failure in the assumption that rotation terminates adversary access.",
        "The cross-institutional blast radius demonstrates the scaling property of management plane credential compromise. One AWS API key with management rights provided access to cloud environments across 42 internal Commission clients and 29 Union entities. The attacker did not need to compromise each organization individually. A single credential in a centralized management surface propagated authority across the full dependent set."
      ]
    },
    {
      "heading": "III. Referenced By",
      "content": [
        "CHQ-SM-2026-012 — Memoranda: The Developer Supply Chain Is Now Self-Propagating (updated v1.1).",
        "CHQ-SM-2026-013 — Memoranda: Exploitation Timing Is Structurally Independent of Disclosure Timing.",
        "CHQ-P-2026-004 — Position: Update Channels as Ungoverned Trust Execution Surfaces.",
        "CHQ-P-2026-015 — Position: Execution Pipelines Function as Control Planes Without Verification Primitives Capable of Validating the Authority They Execute.",
        "CHQ-ED-2026-016 — Evidence Docket: CHQ-P-2026-013 (Portable Developer Identity Cannot Contain Credential Compromise Across Registries).",
        "CHQ-ED-2026-018 — Evidence Docket: CHQ-P-2026-015 (Execution Pipelines as Control Planes, successor docket)."
      ]
    }
  ],
  "closing_statement": "This Exhibit records historical conditions. It carries no present applicability. No judgment is made about any organization, vendor, security posture, or attribution conclusion.\n\nTemporal scope: February to April 2026. Exhibit issuance date is April 7, 2026. This Exhibit records findings as reported by named security research organizations and official government advisories, not as established fact.\n\nSources: CERT-EU Advisory (April 3, 2026), Aqua Security, Palo Alto Networks Unit 42, CrowdStrike, Wiz, SANS.",
  "hash_scope": "Full exhibit content body",
  "hash_generated": "2026-04-07"
}
```