New Cloud‑Focused Worm Discovered

Cybersecurity researchers have raised an alert about a worm‑like malware called TeamPCP that is targeting cloud infrastructure used by major services and businesses. The malicious campaign has been observed exploiting weaknesses in cloud systems to gain access and build a criminal network.

How the Worm Spreads

The malware exploits exposed cloud tools and misconfigurations — including Docker APIs, Kubernetes clusters, and other cloud control interfaces — to infect systems automatically. Once inside, it can move across multiple cloud systems and set up infrastructure for other attacks.

What the Worm Does After Infection

After gaining access, the TeamPCP worm sets up proxy and scanning networks that help it spread further and maintain control. Compromised servers are being used to:

• Steal data and credentials

• Mine cryptocurrency

• Support extortion and ransomware

• Run unauthorized network services
  This makes infected systems part of a larger criminal ecosystem.

Cloud Platforms Most Affected

Research shows that public cloud environments — especially those on large providers like AWS and Azure — are frequently targeted, often due to misconfigured cloud settings that leave control interfaces exposed online.

Why This Matters

This threat highlights the risks facing modern cloud systems when they are left with weak security. As businesses increasingly rely on cloud computing, experts say stronger protection and timely patching of exposed services are essential to prevent infrastructure compromise.