Weekly Threat Bulletin – February 11th, 2026

TeamPCP Worm Exploits Cloud Infrastructure to Build Criminal Infrastructure

A massive, worm-driven campaign, attributed to the TeamPCP threat cluster (also known as DeadCatx3, PCPcat, PersyPCP, and ShellForce), has been systematically targeting cloud-native environments since at least November 2025, with significant activity observed around December 25, 2025. This operation aims to establish a distributed proxy and scanning infrastructure to compromise servers for data exfiltration, ransomware deployment, extortion, and cryptocurrency mining. TeamPCP leverages misconfigured Docker APIs, Kubernetes clusters, Ray dashboards, and Redis servers, alongside vulnerabilities such as React2Shell (CVE-2025-55182) and React flaw (CVE-2025-29927). The group employs various payloads, including `proxy.sh` for installing proxy and tunneling utilities with Kubernetes-specific logic, `scanner.py` to identify misconfigured Docker APIs and Ray dashboards and deploy cryptocurrency miners, `kube.py` for Kubernetes credential harvesting and persistent backdoor deployment, `react.py` for remote code execution via the React flaw, and `pcpcat.py` for automated deployment of malicious containers. The C2 server 67.217.57[.]240 has been linked to the Sliver framework. Primarily targeting Amazon Web Services (AWS) and Microsoft Azure, the attacks are opportunistic, focusing on infrastructure that facilitates their criminal ecosystem rather than specific industries, making affected organizations collateral victims. The danger of TeamPCP lies in its operational integration and scale, combining infrastructure exploitation with data theft and extortion for multiple revenue streams.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Add the IP address 67.217.57.240 to your network firewall, proxy, and EDR blocklists to prevent communication with the TeamPCP command and control server.
• Immediately patch all React and Next.js applications vulnerable to React2Shell (CVE-2025-55182).
• Immediately patch all React applications vulnerable to the authorization bypass flaw (CVE-2025-29927).
• Use external network scanning tools to identify and inventory any Docker APIs exposed to the public internet.
• Use external network scanning tools to identify and inventory any Kubernetes API servers or dashboards exposed to the public internet.
• Use external network scanning tools to identify and inventory any Ray dashboards exposed to the public internet.
• Use external network scanning tools to identify and inventory any Redis servers exposed to the public internet.

Compliance Best Practices

• Enforce a security baseline for all Docker deployments that requires authentication, uses TLS for the API endpoint, and avoids exposing the API to the internet.
• Implement and enforce strict Role-Based Access Control (RBAC) policies in Kubernetes, disable anonymous access, and use network policies to segment pods and namespaces.
• Establish a security policy for all Redis deployments that requires strong authentication and restricts network access to only trusted internal clients.
• Evaluate and deploy a Cloud Security Posture Management (CSPM) tool to continuously monitor AWS and Azure environments for misconfigurations like publicly exposed APIs, dashboards, and servers.
• Deploy a container runtime security tool to monitor for anomalous behavior within containers, such as the execution of unexpected processes, network scanners, or outbound connections.
• Implement a default-deny egress filtering policy on firewalls and cloud security groups to block all outbound traffic except for explicitly approved protocols and destinations.
• Mature the vulnerability management program to prioritize patching based on evidence of active exploitation and asset exposure, especially for internet-facing cloud services.

BeyondTrust Fixes Critical Pre-Auth RCE Vulnerability in Remote Support and PRA

A critical pre-authentication remote code execution (RCE) vulnerability, identified as CVE-2026-1731 with a CVSS score of 9.9, has been addressed in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) products. This operating system command injection flaw allows an unauthenticated remote attacker to execute arbitrary commands in the context of the site user by sending specially crafted requests, potentially leading to unauthorized access, data exfiltration, and service disruption. The vulnerability affects Remote Support versions 25.3.1 and prior, and Privileged Remote Access versions 24.3.4 and prior. Patches are available in Remote Support - Patch BT26-02-RS, version 25.3.2 and later, and Privileged Remote Access - Patch BT26-02-PRA, version 25.1.1 and later. Self-hosted customers are advised to manually apply these patches if not on automatic updates, and those on older versions (RS older than 21.3 or PRA older than 22.1) must upgrade to a newer base version before applying the patch. Discovered by security researcher Harsh Jaiswal on January 31, 2026, via AI-enabled variant analysis, approximately 11,000 instances were found exposed to the internet, with about 8,500 being on-prem deployments that remain vulnerable if not patched. Given past active exploitation of similar flaws, immediate updates are crucial for protection.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Immediately identify all BeyondTrust Remote Support and Privileged Remote Access instances on the network to determine if they are running vulnerable versions.
• For all identified BeyondTrust Remote Support instances, apply patch BT26-02-RS or upgrade to version 25.3.2 or later to remediate CVE-2026-1731.
• For all identified BeyondTrust Privileged Remote Access instances, apply patch BT26-02-PRA or upgrade to version 25.1.1 or later to remediate CVE-2026-1731.
• Review network and appliance logs for any anomalous or malformed requests to BeyondTrust appliances from untrusted IP addresses, which could indicate exploitation attempts of CVE-2026-1731.
• If running BeyondTrust Remote Support older than version 21.3 or Privileged Remote Access older than 22.1, prioritize upgrading to a supported version so the security patch for CVE-2026-1731 can be applied.

Compliance Best Practices

• Review and re-architect network access to all management appliances, including BeyondTrust, to ensure they are not exposed to the public internet. If external access is required, enforce it through a VPN or Zero Trust Network Access (ZTNA) solution.
• Implement a formal patch management policy that mandates enabling automatic updates for vendor appliances where available and establishes a regular cadence for reviewing and manually patching systems that do not support it.
• Implement or enhance an automated asset management program to maintain a continuous, real-time inventory of all software and hardware assets and their versions.
• Integrate logs from critical infrastructure appliances like BeyondTrust into a centralized Security Information and Event Management (SIEM) system to enable continuous monitoring and automated alerting for suspicious behavior.

CVE-2026-1868: Critical GitLab Gateway Flaw (CVSS 9.9) Allows RCE

A critical vulnerability, identified as CVE-2026-1868 with a CVSS score of 9.9, affects self-hosted versions of the GitLab AI Gateway. This flaw, an "Insecure Template expansion issue" within the Duo Workflow Service, allows an authenticated attacker to achieve remote code execution or cause a denial of service by submitting crafted Duo Agent Platform Flow definitions. The vulnerability was discovered internally by a GitLab team member. Affected versions include GitLab AI Gateway versions starting from 18.1.6, 18.2.6, and 18.3.1 that are older than the fixed releases. Immediate upgrade to patched versions 18.6.2, 18.7.1, or 18.8.1 is strongly recommended for all Self Managed customers with GitLab Duo Self-Hosted installations.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Immediately upgrade all self-hosted GitLab AI Gateway instances to a patched version: 18.6.2, 18.7.1, or 18.8.1.
• Conduct an immediate inventory of all GitLab instances to identify any self-hosted AI Gateway deployments and confirm their current version numbers.
• Review GitLab and server logs for unusual or suspicious activity related to the Duo Workflow Service, especially from authenticated user accounts.

Compliance Best Practices

• Evaluate migrating from self-hosted GitLab AI Gateway to a GitLab-managed cloud offering to reduce the administrative burden of security patching.
• Implement and enforce a quarterly user access review process for GitLab to ensure all accounts have the minimum necessary privileges.
• Implement network segmentation to isolate the GitLab AI Gateway server, restricting its network access to only essential systems and services.
• Develop and deploy custom detection rules in your SIEM or EDR solution to monitor for anomalous process execution or network connections originating from GitLab AI Gateway servers.

Cybercriminals Use Firebase Developer Accounts to Distribute Phishing Emails

Cybercriminals are exploiting legitimate Google Firebase developer accounts to launch phishing campaigns, leveraging the platform's free tier to host malicious content and send fraudulent emails. These emails originate from subdomains like `firebaseapp.com`, which possess a high domain reputation due to their association with Google's infrastructure, allowing them to bypass traditional spam filters and land directly in victims' inboxes. The attacks employ psychological tactics, including scare tactics (e.g., urgent alerts about "fraudulent account use") and high-value lures (e.g., promises of free items) to trick users into clicking malicious links and divulging sensitive information. Indicators of compromise include sender addresses with random alphanumeric strings preceding `firebaseapp.com` (e.g., `noreply@pr01-1f199.firebaseapp[.]com`) and redirect chains involving URLs such as `hxxps[:]//rebrand[.]ly/auj0ngh`. This "living off the land" technique necessitates that security teams monitor traffic from `firebaseapp.com` subdomains that do not align with known business applications, and users must remain vigilant against unsolicited emails demanding urgent action, even if the sender appears legitimate.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• In your email security gateway, create a rule to block or quarantine emails where the sender domain matches `*.firebaseapp.com` and does not correspond to a known, legitimate business service.
• Add the domains `rebrand.ly`, `clouud.thebatata.org`, and `www.servercrowdmanage.com` to your web proxy, DNS filter, and firewall blocklists.
• Create a detection rule in your SIEM to alert security personnel on all new or unapproved network connections to domains ending in `firebaseapp.com`.

Compliance Best Practices

• Implement a recurring security awareness training program that specifically educates employees on identifying phishing attempts that abuse trusted cloud services, using the tactics described in the article as examples.
• Evaluate and implement an advanced email security solution with features like URL sandboxing and dynamic analysis to inspect links and content from trusted sources like Google Firebase.
• Develop and enforce a formal policy for the use of third-party cloud services, maintaining an explicit allowlist of sanctioned applications and services to better detect anomalous traffic.

China-Linked DKnife AitM Framework Targets Routers for Traffic Hijacking, Malware Delivery

China-nexus threat actors have operated the DKnife gateway-monitoring and adversary-in-the-middle (AitM) framework since at least 2019, utilizing seven Linux-based implants to perform deep packet inspection, traffic manipulation, and malware delivery via routers and edge devices. This framework, discovered during monitoring of the Earth Minotaur threat cluster, primarily targets Chinese-speaking users, evidenced by credential harvesting phishing pages for Chinese email services, exfiltration modules for WeChat, and code references to Chinese media domains, though infrastructural links to TheWizards group suggest broader targeting across Asia and the Middle East. DKnife's modular architecture includes `dknife.bin` for deep packet inspection and hijacking, `postapi.bin` for data reporting, `sslmm.bin` for TLS termination and credential harvesting from POP3/IMAP connections, `mmdown.bin` for APK downloads, `yitiji.bin` for packet forwarding, `remote.bin` for P2P VPN communication, and `dkupdate.bin` for component updates and watchdog functions. The framework delivers ShadowPad and DarkNimbus backdoors by hijacking binary downloads and Android application updates, conducts DNS-based hijacking for domains like JD.com, and interferes with antivirus and PC-management products while monitoring user activity in real-time.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Immediately review and apply the latest firmware security patches to all company-managed routers and edge devices.
• Configure network monitoring and DNS security tools to detect and alert on DNS responses that redirect internal or high-traffic external domains to unauthorized IP addresses.
• Monitor network traffic logs for anomalous TLS certificates, such as self-signed certificates or certificates from unexpected issuers, particularly for email (POP3/IMAP) and internal services.
• Perform a targeted threat hunt on all Linux-based routers and edge devices for the presence of DKnife framework files, including dknife.bin, postapi.bin, sslmm.bin, mmdown.bin, yitiji.bin, remote.bin, and dkupdate.bin.
• Using your Endpoint Detection and Response (EDR) tool, run threat hunting queries for indicators of compromise (IOCs) associated with the ShadowPad and DarkNimbus backdoors on all managed endpoints.

Compliance Best Practices

• Develop and enforce a security hardening baseline for all network edge devices, including changing default administrator credentials, disabling unused services, and restricting management interface access to a dedicated, segmented network.
• Implement network segmentation to isolate IoT and network infrastructure devices from the corporate user and critical server networks, limiting the potential impact of a compromised edge device.
• Implement a Network Detection and Response (NDR) solution to continuously monitor network traffic for anomalies, including DNS hijacking, unauthorized TLS decryption, and malicious file transfers.
• Create a plan to migrate all users and applications from legacy email protocols like POP3 and IMAP to modern, secure alternatives that enforce transport encryption and multi-factor authentication.
• Implement application control policies on endpoints to prevent the execution of unauthorized applications and block common DLL side-loading techniques.