TeamPCP PyPI Supply Chain Attack & LofyStealer/GhostSocks Campaigns: OTX Pulse Analysis

title: Potential TeamPCP PyPI Supply Chain Attack
description: Detects suspicious child processes spawned by Python executable that may indicate the execution of the msbuild.exe stager or similar payload delivery mechanisms found in the TeamPCP telnyx package campaign.
status: experimental
date: 2026/05/02
author: Security Arsenal
references:
    - https://hexastrike.com/resources/blog/threat-intelligence/ringing-in-chaos-how-teampcp-weaponized-the-telnyx-python-sdk
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\python.exe'
        Image|endswith:
            - '\msbuild.exe'
            - '\cmd.exe'
    condition: selection
falsepositives:
    - Legitimate developer builds using Python scripts
level: high
---
title: LofyStealer Node.js Loader Activity
description: Detects Node.js processes accessing browser credential stores or spawning suspicious child processes, indicative of LofyStealer or GrabBot activity.
status: experimental
date: 2026/05/02
author: Security Arsenal
references:
    - https://zenox.ai/en/lofystealer-malware-mirando-jogadores-de-minecraft
tags:
    - attack.credential_access
    - attack.t1555.003
logsource:
    category: file_access
    product: windows
detection:
    selection:
        Image|endswith: '\node.exe'
        TargetFilename|contains:
            - '\Google\Chrome\User Data\Default\Cookies'
            - '\Mozilla\Firefox\Profiles'
    condition: selection
falsepositives:
    - Legitimate browser automation tools
level: high
---
title: GhostSocks Proxy Process Execution
description: Detects unsigned GoLang binaries establishing network connections or listening on ports, characteristic of GhostSocks proxy malware.
status: experimental
date: 2026/05/02
author: Security Arsenal
references:
    - https://www.darktrace.com/blog/phantom-footprints-tracking-ghostsocks-malware
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|contains:
            - '\AppData\Roaming\'
            - '\AppData\Local\Temp\'
        Initiated: 'true'
    filter:
        Image|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\edge.exe'
    condition: selection and not filter
falsepositives:
    - Other unsigned utilities
level: medium

// Hunt for TeamPCP and GhostSocks Network IOCs
let IOCs = dynamic(["scan.aquasecurtiy.org", "tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io", "aquasecurtiy.org", "retreaw.click", "w2.bruggebogeyed.site", "24.152.36.241"]);
DeviceNetworkEvents
| where RemoteUrl in~ IOCs or RemoteIP in~ IOCs
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| extend Timestamp = format_datetime(Timestamp, 'yyyy-MM-dd HH:mm:ss')
| sort by Timestamp desc

# IOC Hunt Script for TeamPCP and LofyStealer Artifacts
# Requires Admin Privileges

$MaliciousHashes = @(
    "6cf223aea68b0e8031ff68251e30b6017a0513fe152e235c26f248ba1e15c92a",
    "8395c3268d5c5dbae1c7c6d4bb3c318c752ba4608cfcd90eb97ffb94a910eac2",
    "d2a0d5f564628773b6af7b9c11f6b86531a875bd2d186d7081ab62748a800ebb",
    "293006cec43c663ccff331795d662c3b73b4d7af5f8584e2899e286c672c9881",
    "45d4040e76a0d357dd6e236e185aba2eb82420d78640bfd1f3dede32b33931f7",
    "59312a8d6663c9a404d0b5aa96b70be3946592e5c5489366e04114b11a722fa1"
)

Write-Host "[+] Scanning for malicious file hashes..." -ForegroundColor Cyan

# Get fixed drives
$Drives = Get-PSDrive -PSProvider FileSystem | Where-Object { $_.Used -gt 0 }

foreach ($Drive in $Drives) {
    Write-Host "[+] Scanning drive:" $Drive.Root -ForegroundColor Yellow
    try {
        $Files = Get-ChildItem -Path $Drive.Root -Recurse -ErrorAction SilentlyContinue -File | Where-Object { $_.Length -gt 1kb -and $_.Length -lt 100mb }
        
        foreach ($File in $Files) {
            $Hash = (Get-FileHash -Path $File.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($Hash -in $MaliciousHashes) {
                Write-Host "[!!!] MALICIOUS FILE FOUND: $($File.FullName)" -ForegroundColor Red
            }
        }
    } catch {
        Write-Host "[-] Error accessing drive:" $Drive.Root -ForegroundColor DarkGray
    }
}

Write-Host "[+] Scan complete." -ForegroundColor Green