TeamPCP Linked To Redis Attacks Dating Back To 2020 And Later Supply Chain Campaign

Researchers have attributed a years-long campaign targeting Redis instances and supply chain infrastructure to the threat actor TeamPCP, with evidence of activity extending back to 2020.

TeamPCP operated largely undetected for approximately four years before shifting focus toward software supply chain attacks. The group compromised internet-facing Redis databases and related infrastructure during the initial phase of operations, establishing persistent access through shared command-and-control domains, malware deployment patterns, and staging techniques.

The attribution relies on overlapping infrastructure indicators. Investigators identified matching domains, identical malware distribution pathways, staging methodologies, and backend server overlap between the earlier Redis targeting campaigns and the subsequent supply chain intrusions. This technical linkage demonstrates operational continuity across both attack phases.

Redis, an open-source in-memory data store commonly used for caching and session management, presents an attractive target for attackers seeking initial network access. Unsecured or poorly configured Redis instances expose organisations to credential theft, lateral movement opportunities, and data exfiltration. TeamPCP exploited these weaknesses to establish footholds across multiple victim networks.

The shift toward supply chain targeting indicates TeamPCP's evolution toward higher-value objectives. Rather than remaining confined to direct infrastructure compromise, the group began weaponising trusted software vendors and development pipelines to reach downstream customers at scale. This approach maximises impact by leveraging ecosystem trust relationships.

The extended operational timeline, spanning from 2020 through recent supply chain activities, suggests TeamPCP maintains adequate resources and operational security to sustain campaigns across multiple years. The group's persistence despite public attribution indicates either limited law enforcement pressure or deliberate acceptance of detection as an operational cost.

Organisations running Redis should audit network exposure, enforce strict access controls, and monitor authentication patterns. Teams managing software pipelines require heightened vigilance around dependency integrity and build environment security. The TeamPCP case demonstrates how threat actors mature