TeamPCP

Names and who uses them

• TeamPCPOur name
• UNC6780Google
• SHADOW-WATER-058MITRE ATT&CK
• DeadCatx3Palo Alto Networks
• PCPCatPalo Alto Networks
• ShellForcePalo Alto Networks

Targets

Sectors: Cryptocurrency

Known techniques

• T1005Data from Local System
• T1027.003Steganography
• T1036.005Match Legitimate Resource Name or Location
• T1059.004Unix Shell
• T1059.006Python
• T1059.007JavaScript
• T1059.013Container CLI/API
• T1078Valid Accounts
• T1078.004Cloud Accounts
• T1098Account Manipulation
• T1105Ingress Tool Transfer
• T1176.002IDE Extensions
• T1190Exploit Public-Facing Application
• T1195.001Compromise Software Dependencies and Development Tools
• T1485Data Destruction
• T1486Data Encrypted for Impact
• T1528Steal Application Access Token
• T1543.002Systemd Service
• T1546.016Installer Packages
• T1547.001Registry Run Keys / Startup Folder
• T1550.001Application Access Token
• T1552.004Private Keys
• T1553.002Code Signing
• T1555.006Cloud Secrets Management Stores
• T1564.001Hidden Files and Directories
• T1583Acquire Infrastructure
• T1583.001Domains
• T1583.004Server
• T1583.006Web Services
• T1585.001Social Media Accounts
• T1587.001Malware
• T1608.001Upload Malware
• T1610Deploy Container
• T1657Financial Theft
• T1677Poisoned Pipeline Execution
• T1683.001Written Content
• T1684.001Impersonation

Malware and tools used