public_cti_event new

PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale

Hunt Playbook Remediation Detections ⬇️ STIX 2.1

● HIGH Confidence: 85% · Version 1

Executive summary

Public reporting documents: PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale. This is public CTI and does not assess organizational exposure.

Technical analysis

The available public source describes PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale. Technical details are limited to the cited source text and deterministic extracted records; unsupported attribution is excluded.

IOCs

/var/tmp/apt-daily-upgrade

file_path 🔍

2cd2c5268e41cdece1b0506bcda3b9eba2998119

/var/lib/.spm/worm.py

file_path 🔍

worm.py

domain 🔍

/var/lib/.spm/monitor.py

file_path 🔍

https://cdn.cloudfront-js.com:8443/u

url 🔍

/run/secrets

file_path 🔍

CVEs and affected products

CVE-2026-1357

Public-source record for CVE-2026-1357 in PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale.

CVE-2025-29927

Public-source record for CVE-2025-29927 in PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale.

CVE-2025-55182

Public-source record for CVE-2025-55182 in PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale.

CVE-2025-9501

Public-source record for CVE-2025-9501 in PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale.

CVE-2025-48703

Public-source record for CVE-2025-48703 in PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale.

ATT&CK mapping

No ATT&CK mapping is available.

Detection content

Sigma rules, YARA rules, Splunk SPL, and KQL detection logic.

Open dedicated detections page →

Threat hunting

Hypothesis-driven hunt procedures and telemetry checklist.

Open dedicated hunt page →

Remediation

Containment actions, patching notes, and credential steps.

Open dedicated remediation page →

Historical relationships

No published historical relationship is available.

Timeline and change history

2026-05-07 10:00:17+00:00 Public source publication: PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale

Confidence and caveats

0.85

⚠️ Public CTI only; no claim about organizational exposure.

⚠️ Detection logic is generic triage and requires environment-specific tuning.

⚠️ Provider enrichment and ATT&CK mapping are not asserted where unavailable.

📄

Intelligence Sources & Advisory Feeds DFIR investigations, vendor research, advisory feeds & verified claims

5 references ▼

1 source document(s) and 5 evidence fragment(s) support this event; source publication and collection provenance are retained in the corpus.

Authoritative Source Advisories

📄 https://www.sentinelone.com/labs/cloud-worm-evicts-teampcp-and-steals-credentials-at-scale/ ↗

Verified Evidence Claims

PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale. Cloud attack framework skips cryptomining, harvests financial, messaging, and enterprise credentials for fraud, spam, and potential extortion.

100% Confidence Analysis 🔍