TeamPCP Cloud Stealer
Software · ATTACK:enterprise:S9041
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S9041",
"title": "TeamPCP Cloud Stealer",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S9041",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--fe5b2f0f-8fdc-459d-85b7-dd45c0217a0c",
"external_id": "S9041",
"domain": "enterprise",
"created": "2026-07-01T21:11:27.530Z",
"modified": "2026-07-31T02:42:44.295Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "SANDCLOCK"
},
{
"source_name": "Aqua Security Trivy Compromise MAR 2026",
"url": "https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23"
},
{
"source_name": "Aqua Security Blog Trivy Compromise APR 2026",
"url": "https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"
},
{
"source_name": "FBI TeamPCP JUL 2026",
"url": "https://www.ic3.gov/CSA/2026/260702.pdf"
},
{
"source_name": "Google AI Threat Tracker MAY 2026",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access"
},
{
"source_name": "Wiz Trivy Compromise MAR 2026",
"url": "https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack"
},
{
"source_name": "Wiz TeamPCP KICS MAR 2026",
"url": "https://www.wiz.io/blog/teampcp-attack-kics-github-action"
},
{
"source_name": "Sysdig TeamPCP MAR 2026",
"url": "https://www.sysdig.com/blog/teampcp-expands-supply-chain-compromise-spreads-from-trivy-to-checkmarx-github-actions"
},
{
"source_name": "Palo Alto TeamPCP MAR 2026",
"url": "https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"
}
]
}Explicit source assertions (49)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--01354b67-5cc4-4701-9dbf-e750076c5d5d
Aqua Security Blog Trivy Compromise APR 2026 · Wiz Trivy Compromise MAR 2026 · Wiz TeamPCP KICS MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--063c1ea3-13a7-492c-8934-31886fbbecd8
Palo Alto TeamPCP MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1580
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0cc93ab3-094a-46f4-921c-486824dcf78f
Wiz TeamPCP KICS MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1213.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--106a3217-411d-4927-9023-b14750dc3fc3
Aqua Security Blog Trivy Compromise APR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1059.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--14b45c6e-c526-4715-b1f2-78c5e77bdbf2
Aqua Security Blog Trivy Compromise APR 2026 · Wiz Trivy Compromise MAR 2026 · Wiz TeamPCP KICS MAR 2026 · Palo Alto TeamPCP MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1546.018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1eb27c8d-d7fd-4f8e-ad9c-9d8f84ce6c33
Palo Alto TeamPCP MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1657
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--20770073-8c71-48cc-a152-759ee7a6e66b
Aqua Security Trivy Compromise MAR 2026 · Aqua Security Blog Trivy Compromise APR 2026 · Wiz Trivy Compromise MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1555
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--231b6e9d-314e-41af-a1aa-7f527f4c3351
Aqua Security Trivy Compromise MAR 2026 · Aqua Security Blog Trivy Compromise APR 2026 · FBI TeamPCP JUL 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--28aabd70-0158-42e3-8d2d-691b3abd5e8a
Wiz TeamPCP KICS MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--28bdfde8-ff79-44b9-a515-88d230f23aae
Aqua Security Blog Trivy Compromise APR 2026 · Wiz Trivy Compromise MAR 2026 · Wiz TeamPCP KICS MAR 2026 · Palo Alto TeamPCP MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1548.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2b9440c0-4993-4d90-bad5-e966981560b7
Aqua Security Blog Trivy Compromise APR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f5a0454-031c-49e0-979e-c38f4cc4bbcc
Aqua Security Trivy Compromise MAR 2026 · Aqua Security Blog Trivy Compromise APR 2026 · Wiz Trivy Compromise MAR 2026 · Wiz TeamPCP KICS MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1610
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--32fce5a7-7893-4da5-910d-5fd50d1a4248
Wiz TeamPCP KICS MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1613
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--45fa0f91-6a04-45e2-94fd-d058c57bcc7c
Aqua Security Blog Trivy Compromise APR 2026 · Wiz TeamPCP KICS MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1518
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--53e1f658-489e-41ac-849a-335998544cf5
Aqua Security Trivy Compromise MAR 2026 · Wiz Trivy Compromise MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--57388233-1b28-4ae4-b92b-f5eb7d47d6f0
Aqua Security Blog Trivy Compromise APR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1546.016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5eb8c9b7-a1c0-4d70-a84c-a9ff50253ed1
Palo Alto TeamPCP MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--60636234-2547-4139-8f91-e0b984ec5d06
Aqua Security Trivy Compromise MAR 2026 · Aqua Security Blog Trivy Compromise APR 2026 · Wiz Trivy Compromise MAR 2026 · Wiz TeamPCP KICS MAR 2026 · Palo Alto TeamPCP MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1552.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6a277850-d954-4a29-9c9e-aecd554d46ad
Wiz TeamPCP KICS MAR 2026 · Palo Alto TeamPCP MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--72694b2b-356f-4a4a-8475-3ed05e3430b9
Aqua Security Blog Trivy Compromise APR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--739291c0-44da-4d50-abcf-8b365c284289
Sysdig TeamPCP MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7a79128c-d9e3-4345-941f-05e434d99911
Aqua Security Trivy Compromise MAR 2026 · Aqua Security Blog Trivy Compromise APR 2026 · Wiz Trivy Compromise MAR 2026 · Wiz TeamPCP KICS MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1560.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7cad7951-1d39-4083-a394-37893df1fa3b
Aqua Security Blog Trivy Compromise APR 2026 · Wiz Trivy Compromise MAR 2026 · Wiz TeamPCP KICS MAR 2026 · Sysdig TeamPCP MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1552.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7caeaf0a-be0d-4436-96c5-e09056470efa
Aqua Security Blog Trivy Compromise APR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1573.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8707de5d-5fcf-4e1a-a794-27cc3c64e1bf
Aqua Security Trivy Compromise MAR 2026 · Wiz Trivy Compromise MAR 2026 · Wiz TeamPCP KICS MAR 2026 · Sysdig TeamPCP MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1003.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8775a470-084f-490e-8d8d-f21a8e2f8188
Aqua Security Trivy Compromise MAR 2026 · Aqua Security Blog Trivy Compromise APR 2026 · Wiz Trivy Compromise MAR 2026 · Wiz TeamPCP KICS MAR 2026 · Sysdig TeamPCP MAR 2026 · Palo Alto TeamPCP MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1528
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--89b67f65-a828-4786-89c3-9276564fa3ae
FBI TeamPCP JUL 2026 · Google AI Threat Tracker MAY 2026 · Wiz TeamPCP KICS MAR 2026 · Sysdig TeamPCP MAR 2026 · Palo Alto TeamPCP MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1213.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--91c1be4d-6031-4e86-a4af-192e345d836d
Aqua Security Blog Trivy Compromise APR 2026 · Wiz Trivy Compromise MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1567.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9374087b-bb02-47e1-ac3d-76e4886e73d8
Aqua Security Trivy Compromise MAR 2026 · Aqua Security Blog Trivy Compromise APR 2026 · Wiz Trivy Compromise MAR 2026 · Wiz TeamPCP KICS MAR 2026 · Sysdig TeamPCP MAR 2026 · Palo Alto TeamPCP MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1555.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a817761e-2772-4cc0-887b-cc539d6c616e
Aqua Security Trivy Compromise MAR 2026 · Aqua Security Blog Trivy Compromise APR 2026 · FBI TeamPCP JUL 2026 · Google AI Threat Tracker MAY 2026 · Wiz Trivy Compromise MAR 2026 · Wiz TeamPCP KICS MAR 2026 · Sysdig TeamPCP MAR 2026 · Palo Alto TeamPCP MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1609
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aad3b74f-bc6a-4662-9388-e44958c7ba10
Aqua Security Blog Trivy Compromise APR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1020
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ace245e2-6972-4247-9b08-4c6a375cfce7
Wiz Trivy Compromise MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b3e603f6-1c4d-45f6-a903-9b945a26c706
Aqua Security Blog Trivy Compromise APR 2026 · Wiz Trivy Compromise MAR 2026 · Wiz TeamPCP KICS MAR 2026 · Sysdig TeamPCP MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1552.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b5526d4d-5374-4642-ba95-bdd1bfe45849
Aqua Security Trivy Compromise MAR 2026 · Aqua Security Blog Trivy Compromise APR 2026 · FBI TeamPCP JUL 2026 · Google AI Threat Tracker MAY 2026 · Wiz Trivy Compromise MAR 2026 · Wiz TeamPCP KICS MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c6f05b16-bca5-421a-967c-711808f6fc8a
Aqua Security Trivy Compromise MAR 2026 · Wiz Trivy Compromise MAR 2026 · Palo Alto TeamPCP MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1543.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c8c9c0cf-1a77-43a4-bb4f-6cced5e6b418
Aqua Security Blog Trivy Compromise APR 2026 · Wiz Trivy Compromise MAR 2026 · Wiz TeamPCP KICS MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cb603900-4612-46fd-849e-f83db3157c8e
Aqua Security Blog Trivy Compromise APR 2026 · Wiz Trivy Compromise MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d08adc0f-5bf5-40cd-80ab-3c6ce1b46749
Aqua Security Blog Trivy Compromise APR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1059.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d586b2af-ad13-48f2-b7d6-126172d25f9a
Sysdig TeamPCP MAR 2026 · Palo Alto TeamPCP MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1119
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d7b8831f-948f-47a1-a751-01b5b81e13ea
Aqua Security Blog Trivy Compromise APR 2026 · Wiz Trivy Compromise MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--db908ada-4337-40a5-b84b-74053fdb1e7d
Aqua Security Trivy Compromise MAR 2026 · Wiz Trivy Compromise MAR 2026 · Wiz TeamPCP KICS MAR 2026 · Sysdig TeamPCP MAR 2026ATTACK:enterprise:G1056 → uses → ATTACK:enterprise:S9041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dcf4b2a4-22ed-451d-b0db-92fa4a11c3b7
Aqua Security Trivy Compromise MAR 2026 · Aqua Security Blog Trivy Compromise APR 2026 · Wiz Trivy Compromise MAR 2026 · Wiz TeamPCP KICS MAR 2026 · Sysdig TeamPCP MAR 2026 · Palo Alto TeamPCP MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1526
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e2eb45c9-a5ce-4513-91e0-c88a7f585805
Aqua Security Trivy Compromise MAR 2026 · Aqua Security Blog Trivy Compromise APR 2026 · Wiz Trivy Compromise MAR 2026 · Wiz TeamPCP KICS MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1564.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e74766a5-c049-455b-8500-77a71438c120
Wiz TeamPCP KICS MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1480
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f2da1e7c-d5c2-4f1b-b58a-3650c758858a
Aqua Security Blog Trivy Compromise APR 2026 · Wiz TeamPCP KICS MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f3586c05-e0be-4e55-b408-48b9a87c58f1
Wiz TeamPCP KICS MAR 2026 · Sysdig TeamPCP MAR 2026 · Palo Alto TeamPCP MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f99c66b5-df6f-4097-b72b-82bbe3f5fe02
Aqua Security Blog Trivy Compromise APR 2026 · Wiz Trivy Compromise MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1552.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fca4d85e-fb7b-4a71-ac47-68ea189b0932
Aqua Security Trivy Compromise MAR 2026 · Aqua Security Blog Trivy Compromise APR 2026 · Wiz Trivy Compromise MAR 2026 · Wiz TeamPCP KICS MAR 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ff1a526c-156a-410c-bd80-f8e2f86b6c3a
Wiz TeamPCP KICS MAR 2026