TECHNOLOGY

Global cybercrime groups forge industrial ransomware alliance

PUBLISHED Jul 3, 2026, 8:23 AM ET

Read, Watch or Listen

London – On July 2, 2026, the Sophos Counter Threat Unit published a detailed threat intelligence report describing a formal operational partnership between the Vect ransomware group and the credential-harvesting collective TeamPCP, also known in criminal forums as PCPcat, ShellForce and DeadCatx3. Researchers state that the alliance creates an industrialized ransomware model by pairing TeamPCP’s large-scale supply chain credential theft operations with Vect’s automated ransomware deployment infrastructure. According to Sophos, this coordination allows attackers to move quickly from the compromise of software development environments to the mass delivery of ransomware, increasing both the speed and scale of extortion campaigns. London – The report highlights TeamPCP’s role in high-profile supply chain intrusions, including a March 2026 campaign that targeted Aqua Security’s Trivy vulnerability scanner. That attack led to the compromise of more than 10,000 continuous integration and continuous delivery workflows and the theft of over 500,000 login credentials, such as cloud tokens and API keys. Sophos notes that TeamPCP has also collaborated with other major extortion groups, including Lapsus$, and previously ran its own CipherForce ransomware. Vect, a rapidly growing ransomware-as-a-service operation that began recruiting affiliates on the Russian-language Rehub forum on December 31, 2025, claimed its first victims in January 2026 and released its Vect 2.0 variant in February.

By Michael Grant | JQJO News

Timeline of Events

Dec 31 2025 Vect begins recruiting ransomware affiliates
Jan 2026 Vect claims first ransomware victims
Feb 2026 Vect 2.0 ransomware version released
Mar 2026 TeamPCP targets Aqua Security Trivy
Mar 2026 Over 10,000 CI/CD workflows compromised
Mar 2026 More than 500,000 credentials reportedly stolen
Previously TeamPCP collaborates with Lapsus$ extortion group
Jul 2 2026 Sophos discloses Vect–TeamPCP partnership

News Intelligence

This new cybercrime alliance means faster, larger-scale ransomware attacks. Your personal or business data could be at risk. It's crucial to keep your software updated and use strong, unique passwords. Consider using a password manager.