Defending Against Self-Propagating Malware: A Guide to Analyzing and Mitigating the TeamPCP Campaign

Introduction

In late 2024, cybersecurity researchers uncovered a relentless campaign by a hacking group known as TeamPCP. This group deployed a self-propagating backdoor and a data wiper that specifically targeted Iranian machines, while simultaneously compromising open-source software supply chains—including the widely used Trivy vulnerability scanner. This guide walks security professionals through the attack's lifecycle, from initial compromise to persistence and impact, providing actionable steps to detect, analyze, and defend against similar threats. Understanding how TeamPCP operates is crucial for hardening cloud-hosted platforms, securing CI/CD pipelines, and preventing supply-chain attacks.

What You Need

• Cloud platform access logs – review of authentication and misconfiguration events.
• Vulnerability scanner reports – especially for Trivy or similar tools.
• GitHub audit trails – for supply-chain incident detection.
• Endpoint detection and response (EDR) data – to identify self-propagating behaviors.
• Network traffic captures – for analyzing worm propagation patterns.
• Threat intelligence feeds – tracking TeamPCP indicators of compromise (IoCs).
• Sandbox environment – for safely detonating suspicious binaries.

Step-by-Step Guide

1. Step 1: Identify Initial Access Vectors

   TeamPCP first gained visibility in December 2024 by targeting cloud-hosted platforms that lacked proper security configurations. Focus your analysis on environments with exposed APIs, weak default credentials, or misconfigured identity and access management (IAM) roles. Check audit logs for unusual authentication spikes or activity from unexpected IP ranges.

2. Step 2: Detect Self-Propagating Worm Behavior

   The group deployed a worm that autonomously spreads across cloud platforms. Monitor for lateral movement using network flow data or EDR alerts. Look for processes that spawn duplicate copies on adjacent systems or attempt to reach internal scan endpoints. TeamPCP’s worm often builds a distributed proxy and scanning infrastructure as a foundation for later attacks.

3. Step 3: Recognize the Malware's Post-Exploitation Capabilities

   Once inside, the backdoor enables exfiltration of sensitive data, deployment of ransomware, extortion attempts, and cryptocurrency mining. Correlate any unusual outbound data transfers with new processes running in memory. Flag systems that show sudden CPU spikes (mining) or encrypted file extensions (ransomware).

4. Step 4: Investigate the Supply-Chain Attack on Trivy

   Late in the campaign, TeamPCP compromised the GitHub account of Aqua Security (Trivy creator) and pushed malicious updates to the Trivy vulnerability scanner across multiple versions. To detect this, compare hash values of recent Trivy releases against official checksums. Review commit histories on any internal mirrors. Immediately block downloads of any Trivy versions released within the compromise window.

   

5. Step 5: Identify the Data Wiper Targeting Iranian Systems

   A unique aspect of this campaign is a data wiper that specifically targets machines located in Iran. If your organization has Iranian infrastructure, check for unexpected disk erasure operations or boot failures. The wiper may be embedded within the same delivery mechanism as the backdoor, so focus on shared network segments or same software packages.

6. Step 6: Analyze Persistence and Evasion Techniques

   TeamPCP is known for relentless evolution—regularly updating malware to evade signatures. Examine scheduled tasks, registry run keys, or systemd services that appear out of place. Enable verbose logging on critical assets and use sandbox environments to detonate captured payloads without risking production systems.

7. Step 7: Implement Mitigation and Hardening

   Based on findings, immediately revoke compromised credentials, rotate API keys, and enforce multi-factor authentication (MFA). Segment cloud environments to limit worm propagation. For supply-chain security, implement code signing verification, use pinning for third-party container images, and audit GitHub organization privileges regularly.

Tips

• Proactive scanning: Regularly scan cloud-hosted platforms for misconfigurations using tools like AWS IAM Access Analyzer or Azure Advisor.
• Behavioral baselines: Establish normal traffic patterns for your environment so anomalous lateral movement triggers alerts.
• Supply-chain awareness: Subscribe to vulnerability alerts from your open-source dependencies and verify maintainer identity before updating.
• Incident response drills: Practice isolating a compromised host before the worm can spread—especially in CI/CD pipelines.
• Community intelligence: Share IoCs with threat-sharing platforms (e.g., MISP) to help others detect TeamPCP variants.