VECT and TeamPCP: Unveiling the Ransomware Supply Chain Strategy

In a concerning development within cybersecurity, the ransomware entity known as VECT has teamed up with the threat group TeamPCP to exploit supply chain vulnerabilities. This partnership has enabled them to infiltrate thousands of organizations without immediate detection.

Unique Approach to Ransomware Deployment

Unlike traditional ransomware tactics, VECT does not initiate attacks by targeting specific vulnerabilities. Instead, they utilize stolen credentials acquired from compromised open source software, allowing them access without needing to scan networks for weaknesses. This method gives them a pool of potential victims to exploit, as reported by Vectra AI.

Throughout February and March 2026, TeamPCP manipulated several widely-used open source packages, gaining unauthorized access to critical systems. This strategy lets VECT choose its targets post-access, bypassing the need for reconnaissance.

Exploitation Techniques and Impact

The collaboration between VECT and TeamPCP was publicly disclosed on April 16, 2026, on BreachForums. The FBI’s advisory published on July 2, 2026, highlights how this campaign focuses on scale rather than precision. Sophos confirmed instances where VECT deployments were linked to TeamPCP-sourced credentials.

TeamPCP’s exploitation of CVE-2026-33634 allowed them to alter the Trivy scanning tool’s versions, using stolen credentials to gain write access. Similar tactics were employed against Checkmarx KICS and LiteLLM, impacting millions of downloads and installations.

Detection Challenges and Recommendations

The fragmented nature of logs creates challenges in detecting these breaches. Compromised package installations, workflow records, and authenticated API calls appear normal when viewed individually. This issue was similarly noted in the Anodot-Snowflake incident.

Despite the amateur coding found in VECT’s malware, their infrastructure boasts sophisticated features such as Monero escrow accounts and tiered commissions. Security teams are advised to treat pipeline credentials as compromised if they used affected software versions during the specified time frame. Rotation of credentials and thorough audit log reviews are recommended.

For proactive defense, integrating a live threat feed from numerous SOC teams is crucial to prevent such incidents and mitigate financial loss.