A significant cybersecurity campaign has been identified targeting cloud native environments to establish malicious infrastructure for subsequent exploitation. This “worm-driven” activity, detected around December 25, 2025, exploited vulnerable Docker APIs, Kubernetes clusters, Ray dashboards, and Redis servers, along with the recently disclosed React2Shell vulnerability (CVE-2025-55182, CVSS score: 10.0). The campaign is attributed to a threat cluster called TeamPCP (also known as DeadCatx3, PCPcat, PersyPCP, and ShellForce).
TeamPCP has been active since at least November 2025, with the initial Telegram activity dating back to July 30, 2025. The group, with over 700 members on the TeamPCP Telegram channel, shares stolen data from victims in various countries such as Canada, Serbia, South Korea, the U.A.E., and the U.S. Details of the threat actor were first revealed by Beelzebub in December 2025 under the name Operation PCPcat.
The primary objective of the operation was to develop a distributed proxy and scanning infrastructure on a large scale, compromise servers for data exfiltration, ransomware deployment, extortion, and cryptocurrency mining. According to Flare security researcher Assaf Morag, TeamPCP functions as a cloud-native cybercrime platform, exploiting misconfigured Docker APIs, Kubernetes APIs, Ray dashboards, Redis servers, and vulnerable React/Next.js applications to breach modern cloud infrastructure for data theft and extortion.
Furthermore, the compromised infrastructure is utilized for various purposes, including cryptocurrency mining, data hosting, proxy services, and command-and-control relays.
Instead of using new techniques, TeamPCP relies on established attack methods, leveraging existing tools, known vulnerabilities, and common misconfigurations to create an exploitation platform that automates the process. This transforms exposed infrastructure into a self-propagating criminal ecosystem, as highlighted by Flare.
Successful exploitation allows for the deployment of subsequent payloads from external servers, including shell- and Python-based scripts that identify new targets for further expansion. One key component is “proxy.sh,” which installs proxy, peer-to-peer (P2P), and tunneling utilities, along with various scanners to search the internet continuously for vulnerable servers.
“Notably, proxy.sh conducts environment fingerprinting during execution,” Morag explained. “Upon detection of a Kubernetes environment, the script takes a separate execution path and deploys a cluster-specific secondary payload, indicating that TeamPCP has specific tools and techniques for cloud-native targets, rather than relying solely on generic Linux malware.”
The article goes on to describe various other payloads used by TeamPCP, such as scanner.py, kube.py, react.py, and pcpcat.py, each designed for specific functions within the cybercrime platform.
Flare also links a C2 server node to the operation of Sliver, an open-source C2 framework commonly exploited by threat actors for post-exploitation activities. Data from the cybersecurity company shows that the threat actors primarily target Amazon Web Services (AWS) and Microsoft Azure environments, with attacks being opportunistic in nature and focusing on infrastructure that supports their objectives rather than specific industries.
The PCPcat campaign demonstrates a comprehensive lifecycle of scanning, exploitation, persistence, data theft, and monetization tailored for modern cloud infrastructure. Despite not relying on technical innovation, TeamPCP’s integration and scale make them a significant threat. Their blend of infrastructure exploitation with data theft and extortion allows them to monetize both compute resources and information, providing multiple revenue streams and resilience against takedowns.
