How TeamPCP's Python Toolkit Survives a C2 Takedown

Hunt.io researchers did a full static analysis of the second-stage payload deployed in the recent Mini Shai-Hulud supply chain campaign. 13 Python modules, none of which had been examined in full before this.

Key findings:

• Primary C2 (83.142.209[.]194) is hardcoded, not dynamic. FIRESCALE only kicks in when that address is unreachable
• FIRESCALE searches all public GitHub commit messages worldwide for a signed alternative C2 URL, verified against an embedded 4096-bit RSA key. No fixed repo to take down, any account can post a valid redirect
• Three-tier exfiltration: primary C2 → FIRESCALE redirect → victim's own GitHub account. Block one, two remain
• AWS module explicitly targets GovCloud regions (us-gov-east-1, us-gov-west-1), restricted to US gov agencies and defense contractors
• Kubernetes collector loads certs directly into kernel memory via memfd_create, nothing written to disk
• On Israeli or Iranian machines, a 1-in-6 gate triggers a wiper after playing audio at max volume. Russian-locale machines exit silently before any payload runs
• HTTP header fingerprint pivot surfaced a GCP node (35.192.220[.]222) sharing the same server config as the primary C2, absent from all existing blocklists

IOCs, all 13 SHA-256 hashes, MITRE ATT&CK mapping, and full malware analysis: https://hunt.io/blog/teampcp-python-toolkit-firescale-github-c2-takedown