The hacking crew behind a big supply-chain attack has been busy since 2020
New research links TeamPCP, the group behind a recent software supply-chain campaign, to years of quiet break-ins on exposed servers.
Key points
- Researchers have tied a hacking group called TeamPCP to online attacks going back to 2020, years before its recent software supply-chain campaign.
- The group targeted internet-facing servers, meaning computers left directly reachable from the public internet, including Redis database systems.
- Investigators matched the group's old and new activity through shared web domains, malware deployment paths and backend infrastructure.
- The findings suggest the same small crew quietly built infrastructure for years before moving to higher-profile attacks.
A hacking group known as TeamPCP has been breaking into internet-connected servers since at least 2020, well before it turned up in a recent software supply-chain attack, according to new analysis first reported by The Hacker News.
Supply-chain attacks, where criminals poison the software that other companies rely on, tend to be the loud, headline-grabbing end of a much longer story. This one appears to have started years earlier, on the quieter end of the internet.
Who is TeamPCP?
TeamPCP is the label researchers use for a cybercrime crew that's been hitting exposed servers for roughly five years. It's a tracking tag, not something the group calls itself. Their earlier work focused on machines left open to the public internet, particularly Redis, a popular piece of database software used by websites and apps to store information quickly. We first covered Redis vulnerabilities on 3 June 2026, and our 24 July report on four code-execution bugs found by an AI agent shows how attractive a target it remains.
When Redis is configured carelessly and left reachable from anywhere, attackers can walk in and run commands on the server. That's the sort of low-effort, high-volume target TeamPCP appears to have specialised in for years.
How did investigators connect the old attacks to the new one?
By matching fingerprints. Researchers found overlapping domains, malware deployment paths, staging techniques and backend infrastructure repeating across incidents years apart, according to The Hacker News.
The crew reused its tools and its plumbing. That's a common mistake among criminal groups, and it's how defenders stitch a scattered history into a single named actor. Think of a burglar who parks the same van outside every job: each job looks unrelated, but line them up and the pattern's obvious.
What changed with the supply-chain campaign?
The group moved upmarket. Instead of hunting individual exposed servers, they went after software that other organisations install and trust. That shift from opportunistic break-ins to poisoning the supply chain is a familiar path for crews that want bigger paydays or broader access. It also echoes what we reported on 15 July, when criminals hijacked developer credentials to slip malicious code into widely used JavaScript packages.
Many groups behind 2024 and 2025 incidents didn't appear from nowhere. They spent years grinding on unglamorous targets first.
What TeamPCP's history looks like
| Period | Main activity | Typical target |
|---|---|---|
| 2020 onward | Break-ins on exposed servers | Redis and similar internet-facing systems |
| Middle years | Reused domains and malware paths | Same backend servers across campaigns |
| Recent | Software supply-chain campaign | Software vendors and their downstream users |
Should ordinary people be worried?
Not directly, but the businesses they rely on should be. If you run a company that exposes databases to the internet, or installs third-party software without checking it, this is your problem. For everyday customers, keep software updated and treat unexpected password-reset emails with suspicion, in case a supplier up the chain has been hit.
The wider lesson is blunt. A crew that's been quietly compromising servers for five years won't stop because one campaign got named. Watching for repeated infrastructure, not just repeated malware, is how you catch the next chapter early.
