SUBJECT PROFILE
Newly tracked threat actor disclosed in Google/Mandiant's May 2026 GTIG report. In March 2026, TeamPCP (UNC6780) compromised multiple GitHub repositories including LiteLLM (a widely-used AI gateway library) and the Trivy vulnerability scanner, embedding a credential stealer called SANDCLOCK in affected build environments. Stolen AWS keys and GitHub tokens were then provided to ransomware affiliates, marking the first documented AI supply chain attack specifically targeting LLM infrastructure for downstream ransomware operations.
Financial gain via AI supply chain poisoning, cloud credential theft, and ransomware partnerships
OPERATIONAL HISTORY
GitHub repository poisoning, PyPI package supply chain compromise, SANDCLOCK credential stealer, cloud secret exfiltration (AWS keys, GitHub tokens), AI gateway library targeting (LiteLLM), ransomware affiliate partnerships
KNOWN INFRASTRUCTURE
Compromised GitHub repositories (LiteLLM, Trivy), poisoned PyPI packages, SANDCLOCK stealer implant in CI/CD build environments