TeamPCP Shows Why “Secure the App” Now Means “Secure the Pipeline”

The TeamPCP interview on Ransomware Interviews is a reminder that criminal hackers are not just looking for exposed servers anymore. They are looking for leverage through trusted developer tools and automated processes that let them turn access into payouts. Recent campaigns by TeamPCP have compromised trusted tools such as Trivy, KICS, LiteLLM, and the Telnyx Python SDK, and used them to inject credential-stealing payloads into developer workflows to harvest cloud access tokens, SSH keys, Kubernetes secrets, and CI/CD secrets.

These attacks do not stop at “dependency compromise.” Wiz reported that stolen secrets were validated and used quickly for cloud discovery and follow-on activity, while Socket reported claims that TeamPCP partnered with the Vect ransomware group to turn open-source supply-chain compromises into ransomware operations. In other words, once attackers have credentials, the next question is: what can they reach, exploit, exfiltrate, and encrypt?

Dynamic Application Security Testing, or DAST, helps reduce that blast radius by testing applications and APIs as they run. It is not a replacement for SCA, SBOM visibility, secret scanning, pinned GitHub Actions, or CI/CD hardening. Unit 42 recommends SBOM visibility and CI/CD policy hardening for TeamPCP-style attacks, but DAST is essential because attackers often chain stolen credentials with exploitable runtime bugs: broken access control, exposed admin paths, SQL injection, SSRF, auth bypasses, debug endpoints, and forgotten APIs.

NightVision DAST makes that testing practical for the kinds of environments TeamPCP-style actors target. Instead of only crawling whatever a scanner can find from the homepage, NightVision can scan public and private web apps, REST APIs, authenticated areas, staging environments, localhost services, Docker, Kubernetes, and internal data-center apps through its Smart Proxy. That means teams can test the same internal surfaces an attacker might reach after stealing a CI/CD token or cloud credential.

The biggest win is API coverage. Many organizations do not have complete OpenAPI documentation, which means large parts of their API surface never get tested. NightVision’s API Discovery analyzes source code to generate OpenAPI specs, surfaces undocumented endpoints, and feeds those endpoints into DAST so teams test what actually exists, not just what was documented last quarter.

For ransomware and data theft prevention, the benefits are concrete. Run NightVision DAST against every internet-facing app, every internal admin portal, and every API reachable from CI/CD or cloud environments. Use authenticated scans so the scanner tests protected workflows, not just anonymous pages. NightVision supports Playwright-based login recording plus header and cookie authentication, so scans can exercise real user paths and API scopes.

Then put it in the pipeline. NightVision’s GitHub Actions workflow extracts API documentation from code, starts the app, runs a scan, exports SARIF, and surfaces exploitable findings directly in GitHub Security Alerts. AppSec becomes a control that runs on pull requests and releases, rather than an annual audit that finds issues after attackers already have access.

A practical TeamPCP response plan should look like this: rotate exposed secrets, pin CI/CD actions to trusted SHAs, maintain SBOM/SCA visibility, and harden pipeline permissions, and also continuously attack-test your own apps and APIs. DAST closes the gap between “we patched the vulnerability” and “we prevented the exploit.” NightVision has you covered: discover the real API surface, scan it with authentication, test private and public targets, prove exploitability with request/response evidence, and trace findings back to code so developers can fix them quickly.