Cybersecurity experts have identified a significant campaign aimed at cloud-native environments, which has been orchestrated to establish a malicious infrastructure for subsequent exploitation. This activity, noted around December 25, 2025, is characterized by a ‘worm-driven’ approach targeting exposed Docker APIs, Kubernetes clusters, Ray dashboards, and Redis servers. Additionally, it exploits the recently disclosed React2Shell (CVE-2025-55182, CVSS score: 10.0) vulnerability. The threat actors behind this operation are identified as TeamPCP, also known by aliases such as DeadCatx3, PCPcat, PersyPCP, and ShellForce.
TeamPCP’s Emerging Threat
TeamPCP has been active since at least November 2025, with their Telegram channel being operational since July 2025. This channel, which currently has over 700 members, is used to disseminate stolen data from a variety of victims located in Canada, Serbia, South Korea, the U.A.E., and the U.S. The group was first documented by Beelzebub in December 2025 under the operation named PCPcat. The primary objectives of this operation include establishing a vast proxy and scanning infrastructure. This enables the group to compromise servers for data exfiltration, ransomware deployment, extortion, and cryptocurrency mining activities.
Cloud-Based Cybercrime Platform
Functioning as a cloud-native cybercrime platform, TeamPCP capitalizes on misconfigured Docker APIs, Kubernetes APIs, Ray dashboards, Redis servers, and vulnerable React/Next.js applications. These serve as principal infection vectors, allowing the group to breach modern cloud infrastructures. Their goal is to facilitate data theft and extortion. Furthermore, the compromised infrastructure is repurposed for a variety of illicit activities, including cryptocurrency mining, data hosting, and acting as proxy and command-and-control relays.
Rather than pioneering new attack techniques, TeamPCP relies on established methods, utilizing known vulnerabilities and common misconfigurations. This strategy transforms exposed infrastructures into a ‘self-propagating criminal ecosystem,’ as noted by Flare security researchers. Successful breaches allow the deployment of next-stage payloads from external servers, featuring shell- and Python-based scripts that target new vulnerabilities for further exploitation. A key component of this process is ‘proxy.sh,’ which installs utilities for proxy, peer-to-peer, and tunneling, and continuously scans for vulnerable servers.
Technical Exploits and Impact
Proxy.sh also performs environment fingerprinting during execution, checking if it is running within a Kubernetes cluster. If detected, it executes a cluster-specific secondary payload, indicating TeamPCP’s tailored approach for cloud-native targets. Other payloads include scanner.py, designed to identify misconfigured Docker APIs and Ray dashboards, and kube.py, which facilitates Kubernetes-specific attacks. React.py targets the React flaw (CVE-2025-29927) for remote command execution, while pcpcat.py discovers exposed Docker APIs and Ray dashboards, deploying malicious containers or jobs.
Flare reports that the C2 server node at 67.217.57[.]240 is linked to the Sliver framework, exploited by threat actors for post-exploitation activities. Data analysis reveals that these cybercriminals primarily target Amazon Web Services (AWS) and Microsoft Azure environments. The attacks are largely opportunistic, affecting infrastructures that support their goals, with organizations becoming collateral damage in the process.
The PCPcat campaign illustrates a comprehensive lifecycle of scanning, exploitation, persistence, tunneling, data theft, and monetization, specifically crafted for modern cloud infrastructures. TeamPCP’s danger lies not in their technical innovation but in their operational scale and integration. Despite relying on well-known vulnerabilities and slightly modified open-source tools, they manage to blend infrastructure exploitation with data theft and extortion. This hybrid model enables monetization through multiple revenue streams, safeguarding against takedowns and enhancing their cybercriminal resilience.
