SentinelOne Identifies New Threat Actor Targeting Discord and Cloud Services
SentinelOne has reported a new threat actor campaign targeting Discord and various cloud services. The campaign involves a malware framework named PCPJack, which aims to remove infections from systems compromised by the TeamPCP hacking group. PCPJack propagates across Kubernetes, Docker, Redis, RayML, and MongoDB deployments, using Telegram for command and control. The framework is designed to steal credentials from cloud services, including Anthropic, Digital Ocean, Discord, and Google API. SentinelOne also discovered a second toolset associated with the threat actor, featuring Sliver implants and credential theft capabilities. 
