Security Resilience

Threat actor · all actors

TeamPCPMISP-d3682137 criminal

aka TeamPCP, Altered Spider, PCPcat, ShellForce, DeadCatx3, CanisterWorm

Last updated: 2026-10-16

1attributed CVEs
0ATT&CK techniques
4.8IDF score (tooling uniqueness)
1exclusive CVEs
2026years active

About this actor

A cybercrime cluster behind the "Mini Shai-Hulud" software-supply-chain campaign first documented in March 2026. The operation chained compromises through developer and CI/CD tooling — reporting traces a path from Trivy and Checkmarx KICS through GitHub Actions into the npm registry — to publish malicious package versions that harvested credentials, cloud tokens and in-memory secrets from build environments. Independent vendor reporting (Cloud Security Alliance, Tenable, Palo Alto Unit 42, Phoenix Security) describes several hundred affected npm packages and thousands of compromised GitHub repositories, with a self-propagating (worm-like) payload; Tenable tracks an associated advisory as CVE-2026-45321. Named victims in public reporting include TanStack and Bitwarden npm packages. Attribution beyond the campaign cluster itself is not firmly established, and the "Mini Shai-Hulud" label reflects lineage from the earlier Shai-Hulud npm worm rather than a confirmed shared operator. Category 'criminal' reflects the credential/secret-theft objective; sponsorship is unassessed.

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

CrowdStrikenation-animal names

Altered Spider

Unclassifiedno scheme matched

TeamPCPPCPcatShellForceDeadCatx3CanisterWorm

How we know this

Data origin
MISP threat-actor galaxy Imported from the open-source MISP threat-actor galaxy.
Techniques
No ATT&CK techniques mapped.
Named victims
2 extracted from reporting.

Thin data: No ATT&CK techniques are mapped yet — the behavioural profile is empty.

See how actor data is built for the full pipeline.

Activity timeline

2026: 1 CVE published2026: 1 KEV added22026
CVE publishedKEV added

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2026-45321 KEV9.49.60.18242026-05-12see CVE

No techniques attributed.

Co-occurring actors

None.

Similar actors

Active in same years

Same category