This Cybercrime Group Was Hiding in Plain Sight for Years Before the Big Heist

Robert Moore · 2026-08-07

You know how some stories only make sense in hindsight? That's exactly what's happening with a threat actor called TeamPCP. Security researchers just dropped a new analysis that connects this group to attacks going all the way back to 2020. And here's the kicker: they weren't just messing around with small fish. They were quietly compromising internet-facing infrastructure for years before they finally made their big move into the software supply chain. It's the kind of reveal that makes you rethink everything you thought you knew about how these groups operate. Because TeamPCP didn't just appear out of nowhere. They've been here the whole time, working in the shadows, perfecting their craft. ### The Long Game: How TeamPCP Stayed Under the Radar The new analysis is pretty damning. Researchers found clear connections between TeamPCP's old activity and their newer campaigns. We're talking overlapping domains, similar malware deployment paths, matching staging techniques, and the same backend infrastructure. It's like finding the same fingerprints at multiple crime scenes. This isn't a coincidence. It's a pattern. And it tells us something important about how sophisticated these actors really are. They're not impulsive. They're patient. They build their toolkit over years, test it on less valuable targets, and then wait for the perfect moment to strike something bigger. ### What This Means for Your Security Posture Here's the uncomfortable truth: if you're running internet-facing services, you've been in their crosshairs longer than you think. The fact that TeamPCP was active back in 2020 means they've had time to refine their methods. They know what works and what doesn't. They've probably got a playbook that's seen plenty of action. So what can you actually do about it? Let's break it down: - **Patch everything, and I mean everything.** Old vulnerabilities from 2020 are still being exploited today. If you've got legacy systems, they're a target. - **Watch your supply chain closely.** The shift to supply chain attacks means your vendors are now your weakest link. Vet them hard. - **Monitor your backend infrastructure for anomalies.** If something looks off, it probably is. Don't wait for a breach to take action. - **Use layered defenses.** One tool isn't enough. You need a combination of firewalls, intrusion detection, and endpoint protection. ### Why Supply Chain Attacks Are So Dangerous Supply chain attacks are terrifying because they bypass your defenses entirely. Instead of attacking you directly, the bad guys hit a trusted vendor or software provider. Then they ride that access right into your network. It's like someone breaking into your house by using a key your locksmith gave them. And that's exactly what TeamPCP did. They didn't just target one company. They went after the software that hundreds or thousands of companies rely on. One successful compromise, and they've got a backdoor into countless networks. ### The Takeaway: Assume You're a Target The biggest mistake you can make is thinking this doesn't apply to you. If you use any third-party software or services, you're part of the supply chain. And if you're part of the supply chain, you're a potential target. Look, I'm not saying you should panic. But I am saying you should take this seriously. Go back and audit your infrastructure. Check for any signs of compromise that might date back to 2020. Review your vendor agreements and security requirements. And most importantly, stay informed. These groups are always evolving, and the only way to stay ahead is to keep learning about their tactics. Because the truth is, TeamPCP wasn't hiding. They were just operating in a way that made it easy for us to miss them. And that's a lesson we all need to take to heart.