Post

Threat actors are in a turf war for ownership of your infrastructure. @sentinellabs.bsky.social has uncovered PCPJack, a predatory cloud credential worm that hunts its own kind. Its first move? A scorched-earth eviction of rival group TeamPCP.

This isn’t a theory—it’s in the code. PCPJack specifically kills TeamPCP processes and even reports a "PCP replaced" metric back to its C2.

What PCPJack does after it wins the turf war:

💀 Deploys Sliver C2 beacons via a second toolset, compiled with garble obfuscation to defeat signature detection 🚫 Zero cryptomining. None. In a world where every cloud worm drops XMRig eventually, this one doesn't. It's going straight for credential monetization, extortion, and fraud.