"The connection is supported by overlapping domains, malware deployment paths, staging techniques, backend infrastructure, and operational tradecraft," Oligo Security researchers Avi Lumelsky and Gal Elbaz said.
Long tail: links stretching back to 2020
New analysis from Oligo Security traces the activity of the group now known as TeamPCP to attacks as early as 2020, arguing that the actor compromised internet-facing infrastructure for years before moving into software supply chain operations. Oligo ties recent activity to an earlier campaign detailed by Trend Micro in April 2020 that targeted Redis servers to deploy malware, assessing TA-NATALSTATUS as an evolution of that prior Redis-focused effort.
Two distinct campaigns in 2025: ShadowRay 2.0 (IronErn) and TA-NATALSTATUS
Oligo documents two campaigns observed in the second half of 2025. ShadowRay 2.0, also called IronErn, involved hijacking artificial intelligence infrastructure and turning it into a self-propagating botnet. TA-NATALSTATUS targeted exposed Redis servers to deliver cryptocurrency miners. Oligo reports a direct operational bridge between ShadowRay 2.0 and the actor operating publicly as TeamPCP by correlating GitLab authentication logs, command-and-control infrastructure, reverse-shell activity, and malware staging.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadExploitation patterns: Ray, Docker, Redis, React and CI abuse
The group repeatedly abused known security flaws across multiple technologies — Ray, Docker, Redis, and React — using automated and wormable exploitation techniques to self-propagate. Details first surfaced toward the end of last year when the actor was linked to exploitation of security flaws in React Server Components and Next.js to extract credentials and sensitive data in an operation codenamed Operation PCPcat. Earlier this year, researcher Assaf Morag of Flare described a massive campaign in which the actor systematically targeted cloud-native environments to build malicious infrastructure for follow-on exploitation.
Oligo also documents that TeamPCP weaponized the software supply chain by poisoning popular open-source libraries and abusing GitHub Actions combined with token theft, using legitimate cloud infrastructure and CI/CD tooling as a vector to infect developer systems en masse.
Malware evolution: kube.py, Kamikaze, CanisterWorm, and poison_pill()
Oligo traces continuous updates to the group’s malware arsenal. A Python script named kube.py has been used after breaching Kubernetes environments. Early variants focused on propagation and persistence; variants observed as recently as March 2026 incorporated destructive, wiper-like functionality. That destructive path checked whether a victim system was configured for the Iran timezone; if so and the system was Kubernetes-based, the malware fired a DaemonSet that wiped every node in the cluster via a wiper named Kamikaze. On Kubernetes nodes outside Iran, the malware deployed the CanisterWorm backdoor. For non-Kubernetes Iranian systems, the payload executed a poison_pill() routine to erase the entire file system.
What this means for technologists, open-source maintainers, and cloud/Kubernetes operators
- Technologists and security teams: expect adversaries to reuse successful tooling and tradecraft across years and campaigns; Oligo’s findings link modern supply chain abuse back to long-standing Redis-targeting activity and automated wormable techniques.
- Open-source maintainers and CI/CD operators: the actor’s use of GitHub Actions and token theft to poison libraries underscores the risk of credential abuse and workflow-integrity failures in developer pipelines.
- Cloud-native and Kubernetes operators: the appearance of kube.py variants with explicit destructive routines (Kamikaze, poison_pill()) highlights both the dual-use risk of automated deployment tooling and the need to monitor for anomalous DaemonSet creation and unexpected CI-driven pushes.
Oligo cautions that the record does not prove a neat rebranding. "Whether this continuity reflects a direct rebrand, a shared operator set, or close collaboration between historically related actors cannot be determined with 100% certainty," the researchers said. What the evidence does demonstrate, Oligo added, is that TeamPCP represents the continuation of an existing operational ecosystem rather than an entirely new threat actor that appeared in late 2025.
The analytic line that runs from Redis miners in 2020 through AI-infrastructure hijacks in 2025 to supply-chain poisoning and destructive Kubernetes payloads in 2026 is clear in Oligo’s reconstruction: overlapping domains, shared staging paths, and reused backend infrastructure. For defenders, that continuity is both a warning and a roadmap — a set of tradecraft to hunt for and a set of abused services to harden.
