When the Security Scanner Became the Weapon: TeamPCP Supply Chain TTP Report

When the Security Scanner Became the Weapon: TeamPCP Supply Chain TTP Report (PDF, 0.59MB)Published: 25 Mar, 2026

Created by:

Kenneth G. Hartman & Eric Johnson

This campaign is ongoing. TeamPCP continues to expand to new targets and ecosystems. The information in this report reflects the state of the campaign as of March 25, 2026. Readers should monitor the cited sources for updates, and organizations should treat all indicators of compromise as active. This document will be revised as new developments emerge.

When the Security Scanner Became the Weapon: Inside the TeamPCP Supply Chain Attack

Related Webcast

Security tools are no longer just defenses, they’re targets. This sessions explores how attackers are weaponizing scanners, exploiting CI/CD pipelines, and turning trusted tooling into attack vectors.

Meet Your Experts

Kenneth G. Hartman

Certified Instructor

Ken owns Lucid Truth Technologies, a private investigation agency and forensic consulting firm specializing in computer, mobile, network, and cloud forensics. Ken’s mission is to “make the truth clear,” and that's reflected in his teaching style.

Learn more

Eric Johnson

Fellow

Eric is a co-founder and principal security engineer at Puma Security, focusing on cloud security, Kubernetes, and DevSecOps automation. A SANS Fellow, he is co-author and instructor for three SANS Cloud Security courses.