PCPJack Cloud Worm Targets TeamPCP Hacker Infrastructure, Raises Security Concerns
SentinelLabs researchers have identified a new malware, named PCPJack, which targets and removes malicious code previously planted by the TeamPCP supply chain hackers. Discovered on April 28 through Google's VirusTotal malware scanning service, PCPJack replaces the existing malicious code with its own. The malware is designed to steal credentials from various services, including cloud, container, developer, productivity, and financial services. It exhibits worm-like behavior, attempting to propagate itself across exposed cloud infrastructures and move laterally within victim environments. Targeted services include Docker, Kubernetes, Redis, MongoDB, RayML, and vulnerable web applications. Unlike other malware, PCPJack does not deploy cryptocurrency mining software but instead monetizes through activities such as resale of stolen access, credential theft, fraud, spam, and extortion. SentinelLabs suggests that the PCPJack attacker may be a former operator familiar with TeamPCP's tools. 
