An unusual situation has been observed in the cybersecurity field: an unknown group of hackers has breached the systems of a major cybercriminal group known as TeamPCP. According to a report by SentinelOne, the attackers accessed servers previously compromised by TeamPCP, deleted all their tools, and took control. This is reported by Techcrunch.com reports .
As part of this new campaign, dubbed PCPJack, hackers are using malicious code that spreads to cloud infrastructures. Once they gain access, they steal various sensitive data and user credentials, sending them to their own servers. The TeamPCP group was recently known for attacks on the European Commission and major platforms like Trivvy.
SentinelOne researcher Alex Delamotte noted that it is difficult to identify who is behind this attack. In his opinion, it could be former members of TeamPCP, a rival group, or a third party that has adopted the TeamPCP style. The attackers are targeting not only TeamPCP remnants but also unsecured services like Docker and MongoDB.
The main goal of the PCPJack group is financial gain. They generate revenue by selling stolen data or selling access to systems to other cybercriminals. Interestingly, the hackers do not engage in cryptocurrency mining, as this process is more time-consuming and does not fit their strategy of quick profit.
Read “Zamin” on Telegram!
