Actor Profile

The campaign involves financially motivated threat actors leveraging autonomous AI agents and multi-agent attack frameworks to conduct large-scale credential harvesting operations. One unattributed financially motivated group compromised thousands of third-party credentials within six hours using AI coding chatbots and preconfigured markdown instruction sets as operational playbooks. Google Threat Intelligence Group has observed multiple threat actors with diverse motivations—including financially motivated groups, China-nexus espionage actors (UNC6508, Basin Castle/Mustang Panda), and supply chain threat actor TeamPCP (aka Altered Spider, UNC6780)—targeting proprietary AI systems, models, and infrastructure across healthcare, government, media, and technology sectors for espionage, extortion, and resource theft.

TTPs (Tactics, Techniques, Procedures)

Key TTPs include: autonomous AI-driven vulnerability scanning and credential harvesting using multi-agent frameworks; supply chain compromise targeting PyPI, npm, and Docker Hub repositories; deployment of credential stealers SANDCLOCK (Python-based, Kubernetes-focused, container escape capability) and DUSTMAKER (cross-platform JavaScript, CI/CD pipeline optimized); poisoning of AI assistant workspaces and prompt injection for defense evasion; exfiltration of API credentials, proprietary AI models, skills, prompts, and source code; cloud environment compromise to deploy unauthorized local LLM infrastructure using open-weight models; distillation attacks against commercial AI models targeting visual/audio understanding and generation capabilities; use of LLMs (Claude, Gemini, Codex) for custom exploit script development, spear-phishing lure generation, and debugging; automated IP rotation logic and real-time troubleshooting without human intervention; targeting of developers, AI coding assistants, and LLM security scanning tools.

Targets & Patterns

Primary targets include technology and AI/machine learning sectors, with specific focus on organizations deploying proprietary AI systems, cloud infrastructure, and AI development environments. Observed targeting spans healthcare, government, and media sectors for AI model theft and espionage. Supply chain attacks target software developers through compromised packages in PyPI, npm, and Docker Hub ecosystems. AI coding assistants and CI/CD pipelines are targeted for credential theft to facilitate extortion operations. The targeting pattern reflects both financial motivation (credential monetization, ransomware partnerships, resource theft for unauthorized AI workloads) and espionage objectives (proprietary AI research exfiltration, model distillation). China-nexus actors demonstrate particular interest in government entities and proprietary AI capabilities, while financially motivated actors focus on scalable credential harvesting and data theft extortion operations.

Historical Context

TeamPCP (Altered Spider/UNC6780) has conducted a series of large-scale software supply chain compromises since at least March 2026, evolving from SANDCLOCK credential stealer (March-April 2026, part of publicly reported CanisterWorm activity) to the more sophisticated DUSTMAKER payload (April 2026 onward). DUSTMAKER represents a tactical evolution with cross-platform JavaScript implementation, CI/CD optimization, and novel AI-targeting techniques including workspace poisoning and prompt injection—capabilities absent in earlier SANDCLOCK variants. Basin Castle (Mustang Panda) has a documented history of targeting government entities and has now integrated LLM assistance into operations. The observed activity represents an escalation in threat actor AI adoption, with Google GTIG assessing that all threat actors are now using AI in some capacity, creating faster and more scaled adversaries that can execute mass exploitation campaigns faster than defenders can respond.

Defensive Recommendations

  • Monitor for anomalous cloud resource consumption patterns indicative of unauthorized AI workload deployment, particularly local LLM infrastructure using open-weight models
  • Implement integrity monitoring and supply chain security controls for developer dependencies in PyPI, npm, and Docker Hub, with enhanced scrutiny of packages targeting AI coding assistants
  • Deploy behavioral detection for credential access patterns consistent with automated harvesting frameworks, including rapid-fire API authentication attempts and mass credential enumeration within compressed timeframes
  • Harden CI/CD pipeline security with runtime monitoring for JavaScript payloads exhibiting DUSTMAKER characteristics: cross-platform credential theft, AI assistant workspace interaction, and prompt injection attempts
  • Establish monitoring for distillation attacks against proprietary AI models by tracking abnormal query volumes, systematic probing of model capabilities, and exfiltration of model outputs, prompts, or training data