BreachForums and TeamPCP Promote “Shai Hulud” Supply Chain Attack Competition

Du'aine Davis

Observed in the wild

• In May, BreachForums and TeamPCP publicly promoted a “supply chain competition”, encouraging threat actors to conduct large‑scale compromises using “Shai‑Hulud” tooling. While not tied to a single named victim, the activity targets the broader software ecosystem, aiming to compromise dependencies, CI/CD pipelines, and third‑party services to achieve wide downstream impact across multiple organisations simultaneously.
• The activity is driven by BreachForums users and TeamPCP affiliates, using gamification to incentivise participation. Actors share tooling, techniques, and workflows publicly, enabling copycat attacks and lowering the barrier to entry. Key vectors include compromised packages, malicious updates, GitHub/CDN payload delivery, and CI/CD pipeline abuse. The “Shai‑Hulud” concept appears partially symbolic, but still provides operational patterns that can be reused across campaigns.
• Organisations are advised to closely monitor for anomalous package updates, unauthorised CI/CD pipeline changes, and suspicious external code dependencies. Defender teams should prioritise visibility across third‑party risk, flag unusual behaviour linked to developer workflows, and track indicators tied to TeamPCP or Shai‑Hulud narratives. Emphasis should be placed on detecting behavioural anomalies rather than relying solely on signatures, particularly in trusted software supply chains.

BreachForums & TeamPCP Promote Supply Chain Competition as Cybercrime Gets Gamified