TeamPCP Linked To Redis Attacks Dating Back To 2020 And Later Supply Chain Campaign
- ID
- 11883
- Status
- summarized
- Published
- 07 Aug 2026, 2:50 PM
- Fetched
- 07 Aug 2026, 5:39 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/teampcp-linked-to-redis-attacks-dating.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 7.0
- Created
- 07 Aug 2026, 5:44 PM
- Tags
- Audience
- developersdatabase_learnersai_ml_learnerssaas_founders
What happened
Oligo Security researchers Avi Lumelsky and Gal Elbaz linked TeamPCP to Redis server attacks dating back to 2020, with two H2 2025 campaigns: ShadowRay 2.0 (hijacking AI/Ray infrastructure into a botnet) and TA-NATALSTATUS (targeting exposed Redis servers for crypto miners). The group has since moved to supply chain attacks, poisoning open-source libraries via GitHub Actions and stolen tokens, after earlier exploiting React Server Components and Next.js flaws for credential theft.
Why it matters
If you run internet-facing Redis, Docker, or Ray (AI infrastructure) without auth hardening, you are a direct target—TA-NATALSTATUS and ShadowRay 2.0 specifically exploit exposed instances. The supply chain angle means you should audit GitHub Actions workflows and token scopes in your repos, since TeamPCP poisons open-source packages through token theft and CI/CD abuse. Malaysian startups using Redis, Next.js, or Ray clusters should verify exposure and rotate any long-lived CI tokens.
Discussion angle
Walk through the attack chain from exposed Redis to supply chain poisoning—what concrete steps (Redis bind/auth config, GitHub token scope reduction, dependency provenance checks) would have blocked each stage.