TeamPCP and the Rise of Cloud-Native Cybercrime

Why It Matters

The attack marks a decisive shift from endpoint‑centric ransomware to cloud‑control‑plane exploitation, forcing enterprises to rethink security architectures around zero‑trust and continuous cloud visibility.

Key Takeaways

• TeamPCP exploits unauthenticated Docker and Kubernetes APIs
• Campaign automates payloads like proxy.sh and kube.py across clusters
• At least 185 servers compromised in Dec 2025 peak
• Uses React2Shell RCE to harvest credentials and deploy malware
• Emphasizes need for zero‑trust and control‑plane monitoring

Pulse Analysis

The rise of cloud‑native cybercrime reflects a broader industry trend where attackers abandon traditional desktop or server vectors in favor of the highly scalable control planes that power modern applications. By weaponizing AI and publicly disclosed vulnerabilities, groups like TeamPCP can automate the discovery of misconfigured services, launch mass exploitation campaigns, and monetize access through underground markets. This evolution reduces the need for sophisticated zero‑day exploits, instead relying on the sheer volume of exposed APIs to generate revenue at scale.

TeamPCP’s operational playbook demonstrates a layered approach to cloud compromise. Initial access is gained through unauthenticated Docker APIs, Kubernetes dashboards, Redis instances, or vulnerable React/Next.js applications. Once inside, the group drops lightweight scripts such as proxy.sh to establish tunneling, then deploys kube.py to enumerate pods, install privileged DaemonSets, and achieve persistent, cluster‑wide control. The resulting infrastructure serves multiple purposes—scanning for additional targets, cryptomining, and exfiltrating data—effectively turning each compromised node into a node of a larger botnet. The campaign’s rapid expansion, evidenced by over 185 servers seized in a single holiday week, underscores the potency of automated, misconfiguration‑driven attacks.

For security leaders, the implications are clear: traditional perimeter defenses are insufficient against control‑plane assaults. Organizations must adopt zero‑trust principles that enforce strict authentication, network segmentation, and least‑privilege access for all cloud identities and service accounts. Continuous monitoring of API activity, runtime behavior analytics, and automated scanning for publicly exposed orchestration endpoints are essential to detect early indicators of compromise. By integrating these controls with robust incident‑response playbooks and regular tabletop exercises, enterprises can limit lateral movement, reduce blast radius, and safeguard the critical infrastructure that underpins today’s digital services.