TeamPCP

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves

Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and

Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or serv

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense

Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, an

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a bi

Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromi

Adversaries may abuse built-in CLI tools or API calls to execute malicious commands in containerized environments. The Docker CLI is used for managin

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and networ

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to

Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresse

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a

Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own fina

Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files

Adversaries may abuse an integrated development environment (IDE) extension to establish persistent access to victim systems.(Citation: Mnemonic misus

Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

Adversaries may establish persistence and elevate privileges by using an installer to trigger the execution of malicious content. Installer packages a

Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just

Adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of p

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is don

Adversaries may manipulate continuous integration / continuous development (CI/CD) processes by injecting malicious code into the build process. There

Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and cert

Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run key

Adversaries may buy, lease, rent, or obtain physical servers that can be used during targeting. Use of servers allows an adversary to stage, launch, a

Adversaries may create and cultivate social media accounts that can be used during targeting. Adversaries can create social media accounts that can be

Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources. Application access tokens

Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide da

[CanisterWorm](https://attack.mitre.org/software/S9042) is a self-propagating malware that has been used by [TeamPCP](https://attack.mitre.org/groups/

[Mini Shai-Hulud](https://attack.mitre.org/software/S9043) is a credential stealer and self-replicating supply chain worm, derived from [Shai-Hulud](h

The [TeamPCP Cloud Stealer](https://attack.mitre.org/software/S9041) is a comprehensive filesystem credential stealer that can harvest, encrypt, and e