TeamPCP Threat Group Linked to 2020 Redis Attacks and Recent Kubernetes Wipers

Researchers trace threat actor TeamPCP back to 2020 infrastructure attacks. Oligo Security identified overlapping domains and backend infrastructure linking recent supply chain campaigns to Redis breaches from April 2020. The group ran the ShadowRay 2.0 campaign in late 2025 to hijack artificial intelligence infrastructure into a self-propagating botnet. March 2026 variants of the group's "kube.py" script added wiper functionality that erases Kubernetes cluster nodes. "What the evidence does demonstrate is that TeamPCP represents the continuation of an existing operational ecosystem rather than an entirely new threat actor that appeared in late 2025." — Oligo Security And security teams keep treating persistent threat groups like brand-new threats simply because unpatched server breaches sat unnoticed for six years.