wiz · Crawled Aug 6, 2026

Cloud Threat Highlights: H1 2026

7 IoCs 4 Actors 1 Malware

AI Summary

In H1 2026, a surge in cloud-based threats was driven by aggressive software supply-chain attacks, particularly by the group TeamPCP, which compromised developer toolchains across npm, PyPI, and VSCode extensions to steal credentials and propagate across cloud environments. TeamPCP's malware evolved to exploit CI misconfigurations, extract OIDC tokens, and deploy wipers with Dune-themed taunts. North Korea's UNC1069 conducted parallel campaigns, trojanizing the axios package and compromising over 140 @mastra-related packages. The open-sourced Shai-Hulud worm enabled follow-on attacks like IronWorm, which used Rust-based binaries and eBPF rootkits for stealth. A new extortion group, JINX-0163, emerged, targeting cloud identities across AWS, Azure, and GCP to steal secrets and enable ransom threats via the alias 'FulcrumSec'.

AI-extracted · verify before operational use

Extracted Entities 5 found

Threat Actor TeamPCP → Malware Shai-Hulud → Threat Actor FulcrumSec → Threat Actor UNC1069 → Threat Actor LAPSUS →

Indicators of Compromise 7 extracted

Type	Value	Detail
GitHub Repo	TeamPCP/Shai-Hulud	Details →
Filename	.claude/unicorn	Details →
Package	keyv	Details →
Package	cacheable	Details →
Package	left-pad@1.0.1	Details →
Package	@ctx/nightly-build	Details →
Package	@redhat-cloud-services/*	Details →

MITRE ATT&CK TTPs 37 techniques

T1005 Data from Local System · Collection T1021 Remote Services · Lateral Movement T1036.005 Match Legitimate Name or Location · Defense Evasion T1053.005 Scheduled Task · Execution T1055 Process Injection · Defense Evasion T1059.001 PowerShell · Execution T1059.004 Unix Shell · Execution T1070.004 File Deletion · Defense Evasion T1071 Application Layer Protocol · Command And Control T1071.001 Web Protocols · Command And Control T1078 Valid Accounts · Defense Evasion T1078.004 Cloud Accounts · Defense Evasion T1081 T1081 T1090 Proxy · Command And Control T1098 Account Manipulation · Persistence T1133 External Remote Services · Persistence T1195 Supply Chain Compromise · Initial Access T1195.001 Compromise Software Dependencies and Development Tools · Initial Access T1485 Data Destruction · Impact T1548.001 Setuid and Setgid · Privilege Escalation T1553 Subvert Trust Controls · Defense Evasion T1555 Credentials from Password Stores · Credential Access T1555.003 Credentials from Web Browsers · Credential Access T1566 Phishing · Initial Access T1021.003 Distributed Component Object Model · Lateral Movement T1059.007 JavaScript · Execution T1068 Exploitation for Privilege Escalation · Privilege Escalation T1071.003 Mail Protocols · Command And Control T1082 System Information Discovery · Discovery T1083 File and Directory Discovery · Discovery T1086 T1086 T1105 Ingress Tool Transfer · Command And Control T1195.002 Compromise Software Supply Chain · Initial Access T1528 Steal Application Access Token · Credential Access T1530 Data from Cloud Storage · Collection T1552 Unsecured Credentials · Credential Access T1102 Web Service · Command And Control