Vect and TeamPCP industrialize ransomware through a supply-chain credential-theft alliance
Threat Actor Meta
Summary
Hide ▲
Show ▼
Vect and TeamPCP formed a new ransomware-as-a-service partnership that combines supply-chain credential theft with extortion, expanding the risk of follow-on attacks against compromised developer environments. The alliance creates an industrialized ransomware pipeline that can turn stolen access into faster and broader victimization.
Related Happenings
Identity-based access becomes the leading ransomware initial-access trend in 2026
Trend
H score28
First: 15.07.2026 15:45
Last: 15.07.2026 15:45
Sources 1
About this happening:
Identity-based attacks became the leading ransomware initial-access trend, raising the risk of credential abuse and legitimate login misuse across affected networks. S...
Identity-based access becomes the leading ransomware initial-access trend in 2026
TrendAbout this happening: Identity-based attacks became the leading ransomware initial-access trend, raising the risk of credential abuse and legitimate login misuse across affected networks. S...
The Gentlemen ransomware group’s 90/10 RaaS model and rapid victim growth
Threat Actor Meta
H score26
First: 10.06.2026 17:03
Last: 10.06.2026 17:03
Sources 1
About this happening:
The Gentlemen ransomware group has become a high-volume RaaS operation, using a 90/10 affiliate split to attract operators and expand its reach. The group now ranks as...
The Gentlemen ransomware group’s 90/10 RaaS model and rapid victim growth
Threat Actor MetaAbout this happening: The Gentlemen ransomware group has become a high-volume RaaS operation, using a 90/10 affiliate split to attract operators and expand its reach. The group now ranks as...
Silent Ransom Group shifts from Conti-linked ransomware participation to standalone data-theft extortion
Threat Actor Meta
H score21
First: 07.06.2026 17:09
Last: 07.06.2026 17:09
Sources 1
About this happening:
Silent Ransom Group (UNC3753) is a standalone data-theft extortion actor that has operated separately since 2022 after the Conti shutdown, using stolen data and le...
Silent Ransom Group shifts from Conti-linked ransomware participation to standalone data-theft extortion
Threat Actor MetaAbout this happening: Silent Ransom Group (UNC3753) is a standalone data-theft extortion actor that has operated separately since 2022 after the Conti shutdown, using stolen data and le...
TeamPCP and Vect partner to turn supply-chain compromises into ransomware follow-on campaigns
Threat Actor Meta
H score11
First: 31.03.2026 15:15
Last: 31.03.2026 15:15
Sources 1
About this happening:
TeamPCP and Vect ransomware group are linking supply-chain compromises to follow-on ransomware campaigns, broadening extortion risk for affected organizations. The shi...
TeamPCP and Vect partner to turn supply-chain compromises into ransomware follow-on campaigns
Threat Actor MetaAbout this happening: TeamPCP and Vect ransomware group are linking supply-chain compromises to follow-on ransomware campaigns, broadening extortion risk for affected organizations. The shi...
TeamPCP supply-chain credential-exploitation campaign
Campaign
H score34
First: 31.03.2026 15:15
Last: 31.03.2026 15:15
Sources 1
About this happening:
TeamPCP was reported on March 30-31, 2026 to be monetizing secrets from supply-chain intrusions, including cloud credentials, SSH keys, and Kubernetes configurat...
TeamPCP supply-chain credential-exploitation campaign
CampaignAbout this happening: TeamPCP was reported on March 30-31, 2026 to be monetizing secrets from supply-chain intrusions, including cloud credentials, SSH keys, and Kubernetes configurat...
Latest development: 12.05.2026 01:03
TeamPCP compromised the Checkmarx Jenkins AST plugin by publishing a rogue version to repo.jenkins-ci.org on May 9, 2026, outside the official release pipeline. The malicious upload was tied to access to Checkmarx GitHub repositories and was used to deliver credential-stealing malware and malicious code to the affected organization.
Timeline
-
03.07.2026 14:30 2 articles · 13d ago
Vect and TeamPCP industrialize ransomware through a supply-chain credential-theft alliance
Initial DisclosureVect and TeamPCP moved from separate criminal specialties to a shared extortion pipeline. The partnership links stolen developer access with ransomware deployment, broadening downstream victim risk.
Show sources
- Warning Over “Industrialized” Cyber-Attacks After Ransomware Gang Partners With TeamPCP — www.infosecurity-magazine.com — 03.07.2026 14:30
- Warning Over “Industrialized” Cyber-Attacks After Ransomware Gang Partners With TeamPCP — www.infosecurity-magazine.com — 03.07.2026 14:30