A recent analysis reveals that the cybercrime group known as TeamPCP has been operating on the dark web since 2020, indicating their presence for years before focusing on software supply chains This article explores reveals cybercrime group. . The research team at Oligo Security, led by Avi Lumelsky and Gal Elbaz, found evidence of overlapping domains, malware deployment paths, staging techniques, backend infrastructure, and operational tradecraft that supports this claim.
This includes two campaigns observed in the latter half of 2025: ShadowRay 2.0 (referred to as IronErn), which used AI infrastructure to create a self-propagating botnet, and TA-NATALSTATUS, targeting exposed Redis servers to deliver cryptocurrency miners.
The attackers' initial revelations came towards the end of last year when they were connected to exploiting vulnerabilities in React Server Components (RSC) and Next.js, enabling the extraction of credentials and sensitive data from compromised systems. This activity was dubbed Operation PCPcat. Since then, the group has expanded its activities into high-profile supply chain compromises, leveraging the interconnected nature of modern software to infect developer systems by poisoning popular open-source libraries through a combination of GitHub Actions and token theft abuse.
The overlap between IronErn GitHub and GitLab identities was observed, correlating with GitLab authentication logs, command-and-control infrastructure, reverse-shell activity, and malware staging to establish a direct link between the ShadowRay 2.0 campaign and the actor later operating publicly as TeamPCP.
