← Back to Actors
TeamPCP
TeamPCPPCPCatShellForceDeadCatx3SHADOW-WATER-058UNC6780
[TeamPCP](https://attack.mitre.org/groups/G1056) is a financially-motivated, cloud-native threat group that has been active since at least September 2025. Initially focused on ransomware and cryptocurrency theft, [TeamPCP](https://attack.mitre.org/groups/G1056) shifted in early 2026 to systematic, worm-driven credential theft and software supply chain attacks targeting Continuous Integration and Continuous Delivery (CI/CD) workflows. [TeamPCP](https://attack.mitre.org/groups/G1056) has monetized access through extortion and through partnerships with ransomware actors including Vect and CipherF...
37
Techniques
31
Covered
6
Gaps
84%
Coverage
Coverage31/37
GAPS (6)
COVERED (31)
T1005Data from Local System51 det.T1027.003Steganography5 det.T1036.005Match Legitimate Resource Name or Location49 det.T1059.004Unix Shell177 det.T1059.006Python55 det.T1059.007JavaScript64 det.T1059.013Container CLI/API1 det.T1078Valid Accounts320 det.T1078.004Cloud Accounts200 det.T1098Account Manipulation258 det.T1105Ingress Tool Transfer199 det.T1190Exploit Public-Facing Application240 det.T1195.001Compromise Software Dependencies and Development Tools10 det.T1485Data Destruction100 det.T1486Data Encrypted for Impact400 det.T1528Steal Application Access Token61 det.T1543.002Systemd Service13 det.T1546.016Installer Packages9 det.T1547.001Registry Run Keys / Startup Folder53 det.T1550.001Application Access Token45 det.T1552.004Private Keys23 det.T1553.002Code Signing4 det.T1555.006Cloud Secrets Management Stores10 det.T1564.001Hidden Files and Directories26 det.T1583Acquire Infrastructure3 det.T1583.001Domains69 det.T1583.006Web Services1 det.T1587.001Malware10 det.T1608.001Upload Malware3 det.T1610Deploy Container25 det.T1657Financial Theft15 det.