Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure

Tuesday, March 31, 2026 at 09:00 PM UTC·Source: Unit 42 (Palo Alto)

Updated: Thursday, April 2, 2026 at 05:46 PM UTC

Executive Summary

TeamPCP continues its string of supply chain attacks, and announces a partnership with Vect ransomware group. The post Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure appeared first on Unit 42 .

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2025-55182

NVD MITRE CVE

Source Attribution

Originally published by Unit 42 (Palo Alto) on Mar 31, 2026.

Related Threats

CRITICALRansomware

Cisco fixes critical IMC auth bypass present in many products

Cisco has released patches for a critical vulnerability in its out-of-band management solution, present in many of its servers and appliances. The flaw allows unauthenticated remote attackers to gain admin access to the Cisco Integrated Management Controller (IMC), which gives administrators remote control over servers even when the main OS is shut down. The vulnerability, tracked as CVE-2026-2009

CVE-2026-20093

6h agoCSO Online

MEDIUMVulnerability

Not Toying Around: Hasbro Attack May Take 'Weeks' to Remediate

The company's 8-K filing notes "unauthorized access" and that it's activated business continuity plans and taken some systems offline.

8h agoDark Reading

MEDIUMVulnerability

Hackers Exploit CVE-2025-55182 to Breach 766 Next.js Hosts, Steal Credentials

A large-scale credential harvesting operation has been observed exploiting the React2Shell vulnerability as an initial infection vector to steal database credentials, SSH private keys, Amazon Web Services (AWS) secrets, shell command history, Stripe API keys, and GitHub tokens at scale. Cisco Talos has attributed the operation to a threat cluster it tracks as

CVE-2025-55182

9h agoThe Hacker News