Home › Threat Actors › TeamPCP (Miasma variant)
← All Threat Actors
Cybercrime critical Unknown (tooling lineage: Eastern Europe)

TeamPCP (Miasma variant)

Criminal threat actor — derived from TeamPCP (UNC6780) tooling, assessed as semi-independent · Financial — supply chain compromise and credential theft

Reports 1
Active Since 2026
Last Reported 6 Jun 2026
Sectors Targeted finance, communications, critical-infrastructure

Tactics, Techniques & Procedures (TTPs)

  • Miasma self-replicating supply chain worm — derived from Mini Shai-Hulud, released as open-source by TeamPCP (UNC6780) on BreachForums
  • Targeting of GitHub repositories via retained developer credentials from the May 2026 TeamPCP compromise
  • Compromise of core Azure SDK repositories including durabletask, Azure Functions, and AI integration packages
  • Credential theft from compromised developer environments for subsequent repository access
  • Worm propagation across connected repository ecosystems without requiring direct exploitation

Known Targets

Microsoft GitHub organisations (Azure, Azure-Samples, Microsoft, MicrosoftDocs — 73 repositories in June 2026)Azure Durable Task ecosystemAzure Functions and Azure AI SDK componentsDeveloper tooling supply chain downstream consumers

Analyst Notes

The Miasma variant emerged after TeamPCP (UNC6780) publicly released the Mini Shai-Hulud worm source code on BreachForums in mid-May 2026, inviting copycat use. The June 2026 compromise of 73 Microsoft GitHub repositories — including core Azure SDK components — represents the proliferation risk that open-sourcing the worm created. The re-compromise of the durabletask repository (also affected in May) indicates Microsoft did not fully rotate credentials from the initial breach. Operating semi-independently of the original TeamPCP operation; the worm's open-source status means attribution to a specific actor becomes increasingly difficult as derivative campaigns multiply across PyPI, Go modules, and NuGet ecosystems.

Also Known As

Miasma (campaign designation)Mini Shai-Hulud derivative

MITRE ATT&CK Techniques

T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools T1552 Unsecured Credentials T1078 Valid Accounts T1059.006 Command and Scripting Interpreter: Python T1657 Financial Theft

Intelligence Reports

Briefing financecommunications

Miasma Worm Hits 73 Microsoft GitHub Repositories, Including Core Azure SDKs

The Miasma supply chain worm -- a variant of the Mini Shai-Hulud campaign -- has compromised 73 repositories across Microsoft's GitHub organisations today, including Azure Functions, Durable Task, and several developer tooling packages. GitHub has disabled access to affected repos; credentials from the May compromise appear not to have been fully rotated.

6 Jun 2026 · 4 min read