An unidentified hacking group is systematically breaking into systems previously compromised by cybercrime outfit TeamPCP, evicting the rival group and removing its malware.
The unknown attackers are targeting victims already breached by TeamPCP, immediately displacing the established criminal group once they gain access. Upon entry, the new hackers remove TeamPCP's hacking tools from the compromised systems.
This represents a shift in ransomware and breach tactics, where competing criminal groups now actively target each other's existing footholds rather than identifying fresh victims. The behavior suggests the attackers either want to take over valuable compromised networks or are attempting to cover their tracks by eliminating rival infrastructure.
TeamPCP's victims face a concerning scenario: their systems remain compromised, but now by a different threat actor. The displacement tactic offers no security improvement, as the new group maintains the same unauthorized access.
Security researchers are investigating the identity and motives of the unknown hackers. Organizations previously hit by TeamPCP should assume their systems remain at risk and implement comprehensive security assessments.
A critical remote code execution vulnerability affecting all Chromium versions is currently being exploited in the wild. The flaw bypasses the browser's sandbox protection, allowing attackers to execute arbitrary code with full system access.
Mullvad is discontinuing its public encrypted DNS servers and redirecting resources to sponsor Quad9, an alternative privacy-focused DNS provider. The move consolidates the privacy DNS landscape.
Identity verification company IDScan faces multiple lawsuits after hackers allegedly accessed and attempted to sell driver's license data for over 153 million individuals.