Full transcript
0:00In May of 2026 and some time leading up
0:03to it, the cybersecurity industry has
0:05seen an absolute rampage of software
0:08supply chain attacks. There was a recent
0:10news article and headline from Wired
0:12that says a hacker group is poisoning
0:15open source code at an unprecedented
0:18scale. And this hacker group is called
0:20Team PCP. One of their most recent
0:23attacks actually affected GitHub
0:25themself, but I'm sure you have seen the
0:27headlines. You've heard the news.
0:29Software supply chain attacks are super
0:32duper sinister because the threat actor
0:34is taking legitimate software,
0:36applications, and programs that you
0:38might already use or depend on for
0:40software that you write in your
0:41organization, and they inject their own
0:44malware. You can think of some very
0:46well-known incidents in the past, like
0:49SolarWinds or 3CX or Axios that we saw
0:52just recently, when there is a new
0:54version of some software application or
0:56even library or dependency, there's an
0:58update that's available that is actually
1:00backdoored with a payload. And
1:02traditionally, this didn't used to
1:04happen all that often, but Team PCP is
1:08turning this into a pretty constant
1:11fire. The most recent incident last
1:13month in May that got the most headlines
1:15and alarm bells and sirens going off was
1:17when the supply chain attack affected
1:20GitHub. An internal GitHub developer
1:23installed a poisoned or that backdoored
1:25and malicious VS Code extension or
1:28Visual Studio Code extension, and Team
1:30PCP, the threat actors behind it, said,
1:33"Hey, out of the 4,000 GitHub internal
1:36repositories, they've seen at least
1:393,800 compromised repositories." This
1:42specific instance of the NX Console VS
1:44Code extension was covered really well
1:47by Step Security, so we'll have links to
1:49all of these down below in the video
1:51description. But the gist is here. This
1:53compromise occurred due to a recent
1:55supply chain attack via Team PCP that
1:57scraped one of our contributors GitHub
2:00tokens. Now, this has a ripple effect,
2:02right? This is downstream. The dominoes
2:05can fall because this developer for the
2:07NX software package and library, now
2:10that they're compromised, maybe the
2:12adversary could make changes to other
2:14things like the VS Code extension that
2:17other individuals, like some internal
2:19worker at GitHub, could pull down,
2:21install, and now they're infected. Team
2:24PCP really likes to have some sort of
2:27worm effect where other packages are
2:29affected based off of other things that
2:31might be installed or available within
2:33their GitHub repositories or other
2:35libraries or packages that they
2:36maintain. So, whether you realize it or
2:38not, you probably have heard of Team PCP
2:41and their escapades. In the first half
2:44of the year, they compromised Trivy,
2:46they compromised KICS, they compromised
2:48light LLM, Telnyx, and they've been
2:51beating up NPM, the Node Package
2:53Manager, and PyPI, the Python Package
2:55Index. While there have been so many of
2:58these software supply chain attacks
2:59nearly every other week, it's hard to
3:02keep up with for the security teams
3:04fighting fires all the time, and you
3:06kind of have to wonder, how does Team
3:08PCP do this? And I have to think to some
3:12extent, it's really their style, like
3:16their tradecraft, but their persona,
3:18their mentality in all this. Look, you
3:21can see some comments here. They're
3:23definitely going for big exposure. They
3:25really care about getting big attention.
3:27They want to make a little bit of a
3:29storm. They want to make a stink. They
3:31want to toot their own horn in sort of
3:33this chest-thumping braggadocio way.
3:35They're leaning into the meme with like
3:37oh, Matrix-style cascading ones and
3:39zeros, a reggae fusion soundtrack, and
3:42Team PCP, a big banner, the cat's
3:45hijacking your supply chain. With that,
3:47Team PCP literally has been active on
3:50Twitter or X. Like they created an
3:52account and they want to hang out
3:53amongst us normies. Of course, profile
3:55picture is a cat, handle PCP Cats, and
3:59say this account follows the Twitter
4:00terms of service. I don't sell or
4:02advertise any services here. I'm just a
4:03silly cat having fun on the interwebs.
4:06And last month, while they were
4:08frolicking in the fields of the fire
4:10that they've set to the software supply
4:11chain, they went ahead and open-sourced
4:14their Shai Halud worm. Now, I'm sure
4:17you've heard the internet screaming and
4:18shouting about the Shai Halud worm
4:20because, right, I know the Dune joke
4:22there about this sandworm, but that's
4:24how they've been propagating across one
4:27infected package or library or
4:29dependency and now moving into to
4:31compromise other installed packages or
4:33dependencies that you might maintain
4:35over on NPM or in your GitHub account.
4:38The meme here is crazy. These GitHub
4:40packages that were out and about to
4:42include the Shai Halud malware and
4:45campaign, I guess the caption was Shai
4:47Halud open-sourcing the carnage. Is it
4:50vibe-coded? Yeah. And you got to give
4:52the devil his due here to a certain
4:53extent, right? Does it work? Let the
4:55results speak. Like, who cares if it's
4:58vibe-coded if the effect is
5:00accomplished? Love, Team PCP. Aux
5:03Security had covered this, again link
5:05below in the video description, but
5:06here's the write-up. Shai Halud worm
5:08goes open-source. Their malware, what
5:11they wrote, they've just shared now on
5:13the open internet. Accessible,
5:14open-source on GitHub, funny enough now
5:16a later victim of their escapades. But
5:19the thing is that now anyone, like
5:20whatever copycat or anyone that just
5:22wanted to pull this off the shelf, could
5:24do that same amount of damage. These
5:26were the repositories, they aren't now
5:28taken down. They're no longer online.
5:30Some folks might have had a backup or
5:31mirrored it, but here it is. Look, is it
5:33vibe-coded? Yeah. Does it work? Yeah.
5:36Who cares if it's AI slop? It gets the
5:38job done. And they go through more of
5:41the investigation, some more of the
5:42details here. They're leaning into the
5:44meme. Look, haha, heehee, all the folks.
5:46They're alluding to cats. Here's a meow
5:48for that user
7:24boards and threads for cracking or
7:25buying and selling services, hacker for
7:28hire, data breaches, leaks, passwords,
7:31blah blah blah. So, last month on Breach
7:34Forums, Team PCP had posted. And they
7:36say, "In a Team PCP partnership or forum
7:39co-ownership thread, hello again Breach.
7:41I hope everyone is well. We're proud to
7:43announce the new team role as co-owners
7:47of this platform. I guess they're
7:48becoming co-owner, right? It's a
7:50management and staff for Breach Forums.
7:54They sign off all cutsey, best regards
7:56to PCP Cats and Hassan Broker is going,
7:59"Hey, welcome aboard." I guess he's now
8:01exiled. We can chat a little bit more
8:02about that. Everyone's like, "Hell yeah,
8:04all right, brothers in arms,
8:06cybercrime." And hey, the way that I'm
8:08tracking down a lot of these dark web
8:10posts and cybercrime shenanigans is
8:11thanks to Flare. Flare is an
8:13identity-first cyber threat intelligence
8:15platform and solution, and they are
8:17collapsing the gap between detection and
8:20real remediation. They have a huge
8:22amount of insight in the dark web and
8:24the cybercrime ecosystem. Think
8:26ransomware leak sites or Telegram chats
8:28or infostealer malware logs. So, what
8:31I've done is super simple. Honestly,
8:33just logging into their platform,
8:34hopping over to the events tab, and the
8:36global search tab basically lets you
8:38search for anything across their entire
8:41data set. And here we can see some folks
8:42screaming and shouting in the Jacuzzi
8:44Telegram here. They give you the link
8:46and the onion URLs if they're looking at
8:48any of the dark websites. And while you
8:50don't need to fire up the Tor browser or
8:52actually connect to them, you could just
8:53see what other shenanigans they're
8:55sharing right in the platform. Oh, but
8:57here's some more of the cybercrime
8:58whining, right? Hassan says Team PCP has
9:01been reselling some of the GitHub data
9:03even after he said he sold it. He's
9:05actively scamming his customers, and the
9:07plot gets even worse. Picture here that
9:09they include of Okay, yeah, the
9:11authentic full GitHub Team PCP leak from
9:14May 2026. Starting to ruffle some
9:16feathers though with Hassan and Team PCP
9:19not getting along. That brings us to the
9:21today timeline. We're over on Breach
9:24Forums just this past weekend on
9:26Saturday, Team PCP posts another Oh,
9:29signs of life amidst rumors while
9:32they've seemingly been away. Hello,
9:33Breach. I hope everyone is as It looks
9:35like Team PCP will no longer be working
9:38with Hassoun and instead continue
9:40operating on this branch of the forums.
9:42We observed him treat his staff very
9:44badly and we watched him get fished,
9:46lol.
9:48Anyone who takes themselves seriously
9:50and cares about their partners being
9:52capable operators would think it's a
9:53complete joke. Maybe he buys his own
9:55database back, no hard feelings, but
9:57this is just a neutral end of the Look,
9:59okay, um this is just the threat actor
10:02bickering that tends to happen, but it
10:04has been difficult for me as facing
10:06spokesperson to come online. Some people
10:09have taken this leave of absence as a
10:10sign that I or the team have been feted,
10:12like arrested. This is simply untrue and
10:14I have already checked in with partners
10:16to resolve this. This is a sign of life
10:18and I guess my way of clearing things.
10:20So, they're still kicking. So, we got
10:22the old sign off T from the PCP cats
10:25says I should be much more capable of
10:27responding now. And you see them
10:29chirping, whatever they do. Hey, look
10:32sexy Team PCP. It's just whatever. So,
10:35here's the thing. You know I like to
10:37make light of this, oh I don't know,
10:39threat actors chirping, cybercrime high
10:41school drama, stupid pictures of cats
10:43doing whatever they do and their
10:44shenanigans, but there is real value
10:48amongst the noise for like genuine cyber
10:50threat intelligence. Here's the threat
10:53Oh, when they were selling the internal
10:54GitHub source code. Like being able to
10:56keep an eye on what these actors are up
10:59to is genuinely valuable. They're
11:01dropping these on LimeWire. What the
11:03heck? But like there's some tactical
11:05stuff here. A little bit of chest
11:06thumping bravado. Oh, hey, this is not a
11:09ransom. We don't care about extorting
11:11GitHub. One buyer and then we shred the
11:13data on our end. Apparently not
11:15according to Hassoun, hence the crap. It
11:17looks like our retirement is soon, so if
11:19no buyer will leak it for free. Turn
11:21offers like almost 100k, blah blah blah.
11:25I guess they kicked it over to Lapsus,
11:27so. Anyway, what I'm alluding to is that
11:30look, there is some signal in the noise
11:34about these threats, about these threat
11:36actors, about this activity, about these
11:38intrusions and malware that you probably
11:40want to be tracking. I'm not going to
11:42drag us down the rabbit hole of the step
11:44security article, but I feel like this
11:46is tactical and actionable because this
11:49includes the real indicators of
11:52compromise here. But between all the
11:54news headlines and advisories and
11:57reports and notifications and postmortem
12:00write-ups and CVE details. I don't know
12:02why they made a CVE for the supply chain
12:04attack. People screaming and shouting,
12:05regurgitating, rebroadcasting the same
12:07stuff on Twitter, LinkedIn, I don't
12:09know, cybercrime crap over on the dark
12:11web. Look, the reality is you don't need
12:14to care about all of the nonsense and
12:16you really should just be looking for
12:18like the signal to the noise, what
12:20actually matters to you and in your
12:22environment. And hey, Flare, you know I
12:25love them. Look, they've got this
12:26awesome setup with their threat flow
12:28where they could provide to you some
12:29sweet intelligence, tactical indicators
12:31of compromise, real TTPs, the MITRE
12:34attack mapping, the genuine signal to
12:36noise here. You could create your own if
12:38you ever wanted to based off of any sort
12:40of time period. But I wanted to pull up
12:41the one for Team PCP that they were
12:44tracking just some time ago. Look, this
12:46gives you I think the raw real facts.
12:50It's synthesizing across what they're
12:51tracking across those dark web locations
12:54and actually getting what matters for
12:57the domains, the IP addresses, the
12:59hashes, file system artifacts that you
13:01don't cover, MITRE attack techniques,
13:03and the things that arm you and your
13:05team to actually detect against the real
13:08threat. The coolest thing is that this
13:10is synthesizing all of these different
13:12reports so you don't have to. And a
13:15really awesome new thing that they've
13:17cooked up here is their intelligence
13:20solution. This basically lets you search
13:23for anything and everything in a much
13:25faster, better way. Let me go look for
13:27Team PCP here to get a little bit more
13:29tactical with what our conversation is.
13:31And here you can see the chatter on XSS
13:34when they open sourced the Shai Hulud.
13:36They're automatically analyzing this,
13:38getting the more tactical stuff like the
13:39GitHub repositories that are pertinent.
13:41And you can get a heck of a lot more
13:42granular with this given their filters
13:45where you can choose whether it's an
13:46actor, an attack pattern, a campaign,
13:48any specific thing like a vulnerability
13:50or CVE itself, the time that you're
13:52looking for, the metadata as to where
13:54you're pulling these from. And if I
13:55close out, I'll show you another one
13:57here like the Team PCP entry notes that,
13:59hey, we're actually synthesizing this
14:01article from Wiz with a grade of like,
14:04this is pretty reliable. These are all
14:05part of the STIX and TAXII sort of like
14:09protocols or standards or schemas that
14:10are used for threat intelligence.
14:13Pulling out some of the imagery, getting
14:15the threat context, these become
14:17actually actionable and valuable for
14:19you. One cool thing I wanted to be sure
14:21to mention is that they are partnering
14:23with Sequoia to be able to provide of
14:25these threat intelligence. So, big shout
14:27out and love to Sequoia just as well.
14:29Hey, Flare is the sponsor of this video,
14:31so huge shout out and thank you to them
14:33for their support. But hey, if you're
14:35interested to kick the tires, see this
14:37thing yourself, actually get access,
14:38they do have a two-week free trial and
14:41an awesome little exclusive here for us
14:44to be able for you to see Threat Flow
14:46and dive in and access all this just as
14:49well. And that is not included in the
14:50standard free trials. So, seriously,
14:52genuinely, thank you so much for your
14:54support, Flare. And I hope you go get a
14:56chance to play with it and see your
14:57organization's real exposure and their
15:00identity-first threat intelligence
15:02solution. Link below. With that, one
15:05last little tidbit here for you. While
15:07I'm on this train of actionable,
15:09actually valuable cyber threat
15:11intelligence, I know more often than not
15:14all those STIX and TAXII like protocols
15:16and things to collect indicators,
15:18artifacts, evidence, more often than not
15:21you funnel those into your tip or a
15:24threat intelligence platform. Just to
15:26see this all in action, I did stand up
15:27my own little local interface for
15:29OpenCTI or one open and accessible
15:33threat intelligence platform. And we can
15:34funnel in a lot of Flare's data there.
15:37Let me go ahead and log in here and I'm
15:38not going to spend too much time in
15:40OpenCTI, but I wanted to show it to you
15:42just because I know, look, this is very
15:44likely what you are really doing in your
15:47real environment. It doesn't have to be
15:49OpenCTI. It could be any sort of tip or
15:51threat intelligence platform, but look,
15:53I'll show you in the data and ingestion
15:56section here. Now, I'm able to go ahead
15:58and connect Flare as its own connector
16:00alongside Sekoya or any other connector
16:03that we might like, but this is pretty
16:05awesome because that will funnel in all
16:07of those artifacts and everything that
16:09Flare might give us. So, you don't have
16:10to always be in that platform, but
16:12realistically bring this into your own
16:14dashboard and environment. Here are some
16:16of those Sekoya entries. I want to track
16:19down maybe some of the events here. You
16:21can see incidents. Yeah, and a good many
16:22of these like look-alike domains for my
16:25own website. So, that's pretty cool to
16:26see my own indicators now in action and
16:29you could explore that for just about
16:31anything. I'm just pretty happy to see a
16:33actually centralized threat intelligence
16:35platform now that CTI is just so
16:38absolutely necessary for your security
16:40posture and your organization. All
16:42right, that's it. I've been rambling for
16:43way too long, but look, seriously, I
16:45hope there is some value in there in
16:46trying to like pull you out of the
16:49overwhelming sea of headlines and alerts
16:51and notifications and just finding truly
16:54the signal to noise for what matters to
16:57you. There are going to be more of
16:59these. There we saw a team PCP. Oh, the
17:01cats are back in action. Look, don't let
17:04yourself get caught up in the cycle.
17:05Just stay smart and ahead of it with
17:08real intel. Actionable, valuable that
17:11matters to you.
17:12Thanks so much for watching. See you in
17:14the next video.