ATT&CK

Threat actorsMITRE ATT&CK intrusion sets Malware & toolsSoftware families & tooling TechniquesTactics & techniques

ReportsPublished APT reporting SourcesEvery feed behind the archive

Developers

JSON APIFree CORS-enabled endpoints MCP serverModel Context Protocol access Source codeThis project on GitHub

Loading the archive…

Open Threat Intel Archive

Indicators are treated as facts and kept with their source_vendor, source URL, and dates; every feed is credited and redistribution-restricted feeds are flagged, not dropped. ATT&CK content is © MITRE, used under its terms. See NOTICE. The archive reports intelligence; it does not editorialize threat.

Indicators Actors Sources API GitHub

Open Threat Intel Archive

← Malware & tools

S9041malware

TeamPCP Cloud Stealer

a.k.a. SANDCLOCK

The TeamPCP Cloud Stealer is a comprehensive filesystem credential stealer that can harvest, encrypt, and exfiltrate credentials from over 50 sensitive file paths across CI/CD, cloud, developer tooling, and container environments. The TeamPCP Cloud Stealer was the primary payload used by TeamPCP in March 2026 during early stages of a cascading supply chain campaign targeting CI/CD workflows.

Platforms: Containers, Linux, macOS, SaaS, Windows

MITRE ATT&CK ↗

Linked entities · 24

usesT1020Automated Exfiltration usesT1548.003Sudo and Sudo Caching usesT1140Deobfuscate/Decode Files or Infor…usesT1552.003Shell History usesT1119Automated Collection usesT1657Financial Theft usesT1213.003Code Repositories usesT1033System Owner/User Discovery usesT1016System Network Configuration Disc…usesT1213.006Databases usesT1609Container Administration Command usesT1070.004File Deletion usesT1049System Network Connections Discov…usesT1041Exfiltration Over C2 Channel usesT1526Cloud Service Discovery usesT1580Cloud Infrastructure Discovery usesT1057Process Discovery usesT1083File and Directory Discovery usesT1573.001Symmetric Cryptography usesT1573.002Asymmetric Cryptography usesT1560.001Archive via Utility usesT1564.001Hidden Files and Directories usesT1543.002Systemd Service usesT1036.005Match Legitimate Resource Name or…