The group behind March’s cascading supply chain attacks on open-source developer tools has been linked to infrastructure attacks dating back to 2020 and the first known self-propagating botnet built from hijacked AI infrastructure.
New research published by Oligo Security on August 5 showed that TeamPCP shares domains, malware deployment paths and backend infrastructure with activity previously tracked as TA-NATALSTATUS between 2020 and August 2025.
Oligo Security worked with Mandiant and GitLab on the investigation, and GitLab banned the accounts involved.
The firm also assessed that TeamPCP ran ShadowRay 2.0, the campaign it documented in November 2025 against exposed Ray clusters, which it had attributed at the time to an actor called IronErn440.
Read more on React2Shell: React.js Hit by Maximum-Severity React2Shell Vulnerability
A Deployment Framework Reused for Years
The strongest infrastructure link identified was masscan[.]cloud, which appears across TA-NATALSTATUS activity, ShadowRay 2.0 and later TeamPCP operations. Certificate transparency records date it to May 11, 2025, and TeamPCP’s own GitHub account later listed it as the group’s official website.
Alongside it, Oligo found the same deployment framework reused for years: a distinctive directory path and a set of staging scripts documented in earlier TA-NATALSTATUS campaigns turning up unchanged in TeamPCP payloads.
A compromised Ray cluster logged a download from that infrastructure on July 26, 2025, five months before the TeamPCP name surfaced publicly.
The most direct evidence came from GitLab. One IP address received reverse shells from a compromised Ray cluster between October 15 and November 2.
All shells terminated on November 2, and between November 2 and 4 the ironern440 account authenticated to GitLab from that same address, which hosted the campaign’s tooling.
From Cryptojacking to Wiper
Oligo’s timeline has the operators exploiting internet-facing infrastructure as early as 2020, often with automated and wormable techniques, before expanding into GitHub Actions abuse and token theft.
That progression ran through PCPcat, which peaked around Christmas 2025 against React2Shell targets and exposed Docker APIs, and into the March 2026 compromises of Trivy, Checkmarx’s KICS and LiteLLM. The infrastructure also broadened beyond exploitation, with subdomains observed supporting credential phishing, payment fraud and Zendesk impersonation.
In late March, a second-stage Kubernetes payload gained a destructive branch. The script checked whether the victim system was set to the Iran timezone and, if so, deployed a destructive workload that deleted filesystems and rebooted the machine. Oligo noted that Iranian connectivity was heavily disrupted at the time, limiting visibility into whether it ever executed.
Oligo was careful about how far the attribution extends. Whether the continuity reflects a direct rebrand, a shared operator set or close collaboration between related actors cannot be established with certainty, the firm said.
What the evidence shows is that TeamPCP continues an existing operational ecosystem rather than being a new group that appeared in late 2025.