Procedure examples

TeamPCP Cloud Stealer can scrape memory from the Runner.Worker process by reading `/proc/<pid>/mem` to extract secrets including plaintext tokens.

TeamPCP Cloud Stealer can compress and encrypt data and exfiltrate it via POST to an attacker-controlled domain. If that method fails it can use the victim's own GitHub account to create a public repository and uploads the encrypted data as a release asset.

TeamPCP Cloud Stealer has the ability to enumerate network interfaces.

TeamPCP Cloud Stealer can compress and encrypt data and exfiltrate it via POST to scan.aquasecurtiy[.]org. If that method fails it attempts to use a stolen GITHUB_TOKEN to create a repo and exfiltrate the data there.

TeamPCP Cloud Stealer has used multi-stage payloads with double Base64-encoded scripts to evade static analysis.

TeamPCP Cloud Stealer can use `whoami` on self-hosted runners to identify the current user.

TeamPCP Cloud Stealer has installed a backdoor named sysmon.py on targeted systems.

TeamPCP Cloud Stealer has exfiltrated collected data to typosquat C2 domains including scan.aquasecurtiy[.]org.

TeamPCP Cloud Stealer can search compromised systems for webhook URLs connecting to Slack and Discord.

TeamPCP Cloud Stealer can locate GitHub Actions runner processes.

TeamPCP Cloud Stealer has abused the shell script files entrypoint.sh (in trivy-action) and setup.sh (in ast-github-action/2.3.28) for discovery and credential harvesting.

TeamPCP Cloud Stealer has leveraged Python scripts to download additional payloads, engage in discovery, and to establish persistence.

TeamPCP Cloud Stealer has infected victims through malicious pre and post-install scripts within the package.json file.

TeamPCP Cloud Stealer has the ability to remove all staged files after exfiltration.

TeamPCP Cloud Stealer has used `curl` to upload stolen data to attacker controlled domains.

TeamPCP Cloud Stealer has created a staging file in `/tmp` for collected data.

TeamPCP Cloud Stealer has detected if it is on a developer machine by checking if the environmental variable  GITHUB_ACTIONS != “true”. TeamPCP Cloud Stealer has also identified readable memory regions on CI/CD runners and enumerated system information using `hostname` and `uname-a`.

TeamPCP Cloud Stealer can identify files containing environment variables, SSH keys, cloud credentials, access tokens, and cryptocurrency wallets.

TeamPCP Cloud Stealer has the ability to download additional payloads to targeted systems.

TeamPCP Cloud Stealer can identify and collect credentials across over 50 file paths in Cloud, CI/CD, developer tooling, and container enviornments.

TeamPCP Cloud Stealer can deobfuscate an encoded Python script prior to execution.

TeamPCP Cloud Stealer can target sensitive file paths in Git repos to extract credentials.

TeamPCP Cloud Stealer can extract credentials from multiple database configuration files including ~/.pgpass, ~/.my.cnf, ~/.mongorc.js, and /etc/mysql/my.cnf.

TeamPCP Cloud Stealer has checked if it is running on a developer machine (rather than GitHub Actions) before executing a Python script for persistence. The script has also polled C2 every 50 minutes for additional payloads and aborted if the returned value contained YouTube.

TeamPCP Cloud Stealer has searched for cryptocurrency wallets on targeted hosts.

TeamPCP Cloud Stealer can search GitHub for Actions runner processes.

TeamPCP Cloud Stealer can read runner.worker process memory to extract plaintext tokens.

TeamPCP Cloud Stealer can create a systemd unit to execute a python script for persistence.

TeamPCP Cloud Stealer can inject malicious pre or post-install scripts within package.json for payload execution.

TeamPCP Cloud Stealer has used .pth files to establish persistence on compromised hosts due to the Python interpreter's automatic processing of .pth files at startup.

TeamPCP Cloud Stealer can use `sudo` for code execution.

TeamPCP Cloud Stealer has the ability to check over 50 file paths for credentials stored in files across CI/CD, cloud, container, and other environments.

TeamPCP Cloud Stealer can target credentials in shell history on self-hosted runners.

TeamPCP Cloud Stealer has searched victim hosts for TLS and SSH keys.

TeamPCP Cloud Stealer can query the Kubernetes API for credentials.

TeamPCP Cloud Stealer can harvest credentials from cryptocurrency wallets and keystores such as Ethereum keystores, Cardano keys, Solana validator keypairs, Ledger device files, and Anchor deploy keys.

TeamPCP Cloud Stealer can enumerate multiple filesystem paths to extract credentials for AWS, GCP, and Azure including Identity Access Management (IAM) credentials.

TeamPCP Cloud Stealer has bundled collected data into a file named tpcp.tar.gz for exfiltration.

TeamPCP Cloud Stealer can create a hidden directory in the user's home folder on Linux hosts to write a python backdoor.

TeamPCP Cloud Stealer can create a repository in the victim's GitHub account using the victim's own GITHUB_TOKEN to upload stolen credentials.

TeamPCP Cloud Stealer has encrypted collected data using a hybrid AES-256 and RSA-4096 encryption prior to exfiltration over 'curl`.

TeamPCP Cloud Stealer has encrypted collected data using a hybrid RSA-4096 and AES-256-encryption prior to exfiltration over 'curl`.

TeamPCP Cloud Stealer has the ability to search for generic GitHub runners.

TeamPCP Cloud Stealer can use `kubectl get secrets` to extract credentials from Kubernetes.

TeamPCP Cloud Stealer can identify Docker and Kubernetes environments for credentials.

TeamPCP Cloud Stealer can search filesystems for cryptocurrency wallets such as Bitcoin, Litecoin, Dogecoin, Zcash, Dash, Ripple, and Monero.

TeamPCP Cloud Stealer has leveraged a persistence script that will sleep for five minutes before additional execution.