G1056 TeamPCP
Enterprisealso known asTeamPCP · PCPCat · ShellForce · DeadCatx3 · SHADOW-WATER-058 · UNC6780
TeamPCP is a financially-motivated, cloud-native threat group that has been active since at least September 2025. Initially focused on ransomware and cryptocurrency theft, TeamPCP shifted in early 2026 to systematic, worm-driven credential theft and software supply chain attacks targeting Continuous Integration and Continuous Delivery (CI/CD) workflows. TeamPCP has monetized access through extortion and through partnerships with ransomware actors including Vect and CipherForce.
01
canonical actor
The group this is attributed to.
02
techniques used (37)
ATT&CK techniques this enables or maps to.
showing 20 of 37
03
software used (3)
Malware and tools associated with this.
04
source
Where this definition is published.