News Detail

TeamPCP Worm Exploits Cloud Infrastructure to Build Criminal Infrastructure

Cybersecurity researchers have identified a massive campaign targeting cloud native environments to establish malicious infrastructure for follow-on exploitation. The worm-driven activity, observed around December 25, 2025, has raised concerns about the security of cloud-based systems.

The TeamPCP worm has been found to leverage exposed Docker APIs, Kubernetes clusters, Ray dashboards, and Redis servers, along with recently disclosed vulnerabilities, to set up malicious infrastructure. This campaign highlights the importance of securing cloud-based systems and the need for robust security measures to prevent such exploits.

• Exposed Docker APIs and Kubernetes clusters are being exploited to gain unauthorized access to cloud infrastructure.
• Ray dashboards and Redis servers are also being targeted to further compromise cloud-based systems.
• Recently disclosed vulnerabilities are being leveraged to amplify the attack's impact and build malicious infrastructure.

Organizations must take immediate action to secure their cloud infrastructure, including implementing robust security measures such as authentication, authorization, and encryption. Regular security audits and penetration testing can also help identify vulnerabilities and prevent such exploits.

Security is a process, not a product.