Hermes CTI

← Back to all reports

public_cti_event new

PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale

Hunt Playbook Remediation Detections
● HIGH Confidence: 85% · Version 1

Executive summary

Public reporting documents: PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale. This is public CTI and does not assess organizational exposure.

Technical analysis

The available public source describes PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale. Technical details are limited to the cited source text and deterministic extracted records; unsupported attribution is excluded.

Evidence and sources

1 source document(s) and 5 evidence fragment(s) support this event; source publication and collection provenance are retained in the corpus.

Authoritative Source Advisories
📄 https://www.sentinelone.com/labs/cloud-worm-evicts-teampcp-and-steals-credentials-at-scale/ ↗
Verified Evidence Claims

PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale. Cloud attack framework skips cryptomining, harvests financial, messaging, and enterprise credentials for fraud, spam, and potential extortion.

100% Confidence Analysis 🔍

IOCs

38.242.204.245
ipv4 🔍
38.242.245.147
ipv4 🔍
lateral.py
domain 🔍
update-386.bin
domain 🔍
parser.py
domain 🔍
193.187.129.143
ipv4 🔍
161.97.135.154
ipv4 🔍
/var/www
file_path 🔍
/.ssh/config
file_path 🔍
utils.py
domain 🔍
monitor.py
domain 🔍
/var/tmp/apt-daily-upgrade
file_path 🔍
2cd2c5268e41cdece1b0506bcda3b9eba2998119
sha1 🔍
213.136.80.73
ipv4 🔍
extractor.py
domain 🔍
/var/lib/.spm/worm.py
file_path 🔍
worm.py
domain 🔍
/var/lib/.spm/monitor.py
file_path 🔍
https://cdn.cloudfront-js.com:8443/u
url 🔍
/run/secrets
file_path 🔍

CVEs and affected products

CVE-2026-1357

Public-source record for CVE-2026-1357 in PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale.

CVE-2025-29927

Public-source record for CVE-2025-29927 in PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale.

CVE-2025-55182

Public-source record for CVE-2025-55182 in PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale.

CVE-2025-9501

Public-source record for CVE-2025-9501 in PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale.

CVE-2025-48703

Public-source record for CVE-2025-48703 in PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale.

ATT&CK mapping

No ATT&CK mapping is available.

Detection content

Sigma rules, YARA rules, Splunk SPL, and KQL detection logic.

Open dedicated detections page →

Threat hunting

Hypothesis-driven hunt procedures and telemetry checklist.

Open dedicated hunt page →

Remediation

Containment actions, patching notes, and credential steps.

Open dedicated remediation page →

Historical relationships

No published historical relationship is available.

Timeline and change history

Public source publication: PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale

Confidence and caveats

0.85

⚠️ Public CTI only; no claim about organizational exposure.

⚠️ Detection logic is generic triage and requires environment-specific tuning.

⚠️ Provider enrichment and ATT&CK mapping are not asserted where unavailable.