Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure
unit42.paloaltonetworks.com · 31 Mar 2026 · Licence: not cleared; local research copy only
CVEs this report names
1 CVE- CVE-2025-55182Meta React Server Components Remote Code Execution VulnerabilityMeta · React Server ComponentsKEVRansomwarePublic exploitCritical · 10.0T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter5 reports99.8%Top 0.04%95.0priority
Where it names them
CVE-2025-55182 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
Tags:CVE-2025-55182GitHubInfostealerPythonSupply chainWiper
CVE-2025-55182
That campaign exploited the React2Shell vulnerability (CVE-2025-55182), allowing the group to leverage remote code execution (RCE) within vulnerable cloud endpoints.
CVE-2025-55182
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.