New analysis reveals that the threat actor ‘TeamPCP’ has been active since 2020, initially compromising internet-facing infrastructure like Redis servers. The group later shifted its focus to software supply chain attacks. Overlapping domains, malware deployment paths, staging techniques, and backend infrastructure connect these long-running campaigns.