TeamPCP Supply Chain Campaign: Update 007 - Cisco Source Code Stolen via Trivy-Linked Breach, Google GTIG Tracks TeamPCP as UNC6780, and CISA KEV Deadline Arrives with No Standalone Advisory
This is the seventh update to the TeamPCP supply chain campaign threat intelligence report, "When the Security Scanner Became the Weapon" (v3.0, March 25, 2026). Update 006 covered developments through April 3...
The strongest version of this narrative presents TeamPCP as a sophisticated, financially motivated threat actor with a demonstrated ability to exploit supply chain vulnerabilities at scale. The designation of UNC6780 by Google GTIG lends credibility to the assessment that this is a persistent, organized campaign rather than a series of isolated incidents. The breach of Cisco—a high-profile technology company—underscores the campaign’s reach and the secondary risks posed to downstream organizatio...