> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Extortion crews have their eyes on high-value AI data, Google warns - URL: https://f4n6.co.uk/security-feed/extortion-crews-have-their-eyes-on-high-value-ai-data-google-warns/ - Published: 2026-09-08T15:35:57.000Z - Updated: 2026-09-08T15:35:57.000Z - Author: Jeff Davies - Tags: #security-feed, TeamPCP, UNC6780 ## 1\. Executive summary Google's Threat Intelligence Group and Mandiant have disclosed, via their Q2-2026 AI Threat Tracker, a series of data-theft-and-extortion intrusions in which criminals exfiltrate proprietary AI assets — models, source code, prompts, model scripts, secrets and research data — and demand payment under threat of public leak. Two newly detailed breaches affected a healthcare company (corporate data, drug research and a proprietary AI model stolen) and an AI media-generation company (source code, prompts, skills, model scripts and secrets stolen). Affected sectors in the quarter were technology, healthcare, pharmaceutical, and media and entertainment, across North America and Europe. The actor Google tracks as UNC6780 — publicly referred to as "TeamPCP" — is identified as "extremely successful" in this space, running large-scale open-source supply-chain attacks against PyPI, npm and Docker Hub since March, deploying credential stealers against cloud and AI systems, and in one case creating a malicious GitHub Actions workflow to exfiltrate a copy of a victim's proprietary AI repository. The bottom-line risk for EMEA financial services: proprietary AI/ML assets, model repositories, prompts and the credentials that guard them are now a primary extortion target, and the attack path runs through the software supply chain and CI/CD infrastructure that banks and insurers increasingly depend on. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28: ICT third-party risk — general principles | TeamPCP's demonstrated access vector is compromise of third-party open-source ecosystems (PyPI, npm, Docker Hub) and CI/CD tooling (GitHub Actions) that sit inside clients' development supply chains | Clients should assess whether their AI/ML development pipelines consume packages from the affected registries and whether AI repositories are exposed to CI/CD workflow abuse; document this in third-party risk management | | NIS2 Art. 21(2)(d): supply chain security measures | Same fact, viewed from the supply-chain-security-measures angle: malicious packages and compromised registries are the delivery mechanism | Review supplier/dependency security requirements covering open-source component provenance and CI/CD pipeline integrity | No specific DORA/NIS2 article is directly engaged by the extortion incidents themselves beyond the above: the source does not state that any victim was a financial entity or an EU-regulated entity, and no incident classification or reporting trigger can be assessed from the material provided. UK NIS 2018 OES/RDSP duties are not engaged — no UK operator is identified. ## 3\. Technical analysis & attack chain This is a threat-campaign item. The attack chain below is reconstructed from Google/Mandiant's published findings as reported by The Register; no CVE, specific malware family, or initial-access exploit is named in the source material. ### Confirmed steps (as reported) 1. **Supply-chain access (TeamPCP / UNC6780):** Since March 2026, the actor has conducted several very large-scale open-source supply-chain attacks against the PyPI, npm and Docker Hub ecosystems, compromising open-source packages and registries. 2. **Credential theft:** Following compromise, UNC6780 typically deploys stealer malware to harvest cloud and AI system credentials from affected developers and environments. 3. **AI repository access:** Evidence indicates UNC6780 created a malicious GitHub Actions workflow targeting a victim company's proprietary AI repository, and the extortion actor exfiltrated a copy of that repository. 4. **Exfiltration of high-value AI assets:** In the two newly detailed intrusions — a healthcare company (corporate data, drug research, AI research and a proprietary AI model) and an AI media-generation company (source code, prompts, skills, model scripts, secrets) — attackers stole sensitive AI data. 5. **Extortion:** Attackers demanded payment and threatened to publish/dump the stolen AI assets publicly if the ransom was not paid. Note: this is data-theft extortion, not encryption-based ransomware; no encryption or locker payload is described in the source. ### Agentic AI escalation (same quarter, per Google) - Mandiant observed a compromise of an organisation's cloud infrastructure carried out as an autonomous, multi-agent credential-harvesting attack completing in under six hours. The agents autonomously scanned for vulnerabilities, performed real-time troubleshooting, and executed IP rotation logic without manual intervention. - Google Threat Intelligence observed a China-linked espionage group using Gemini to design a dynamic, automated penetration-testing framework capable of reasoning through actions, executing tasks and changing course in unpredictable environments. Google states it disabled the assets associated with this crew. - UNC6780 has implemented more than half a dozen distinct methods to target or exploit AI tools and open-source software development practices, beyond the GitHub Actions workflow described above. **Confidence caveats:** All technical detail above is single-sourced — it derives from Google's AI Threat Tracker as reported by The Register (one vendor's incident-response findings, shared in advance with one publication). No package names, malware names, hashes, domains or other atomic indicators are published in the source material, so none can be provided here. Attribution of UNC6780 to "TeamPCP" is Google's own tracking designation; the verified reference data confirms a MITRE ATT&CK profile exists for TeamPCP (G1056), so the naming is treated as established, but underlying state or criminal attribution is not asserted in the source and should not be assumed. The "China-linked espionage group" is not named and has no MITRE profile in the verified data — treat that attribution as unconfirmed. ## 4\. Mitigation & containment The source provides no vendor patches (no CVEs are involved) and no atomic indicators, so containment is architectural and procedural. Priorities below reflect the demonstrated attack paths. ### P1 — within 24 hours - Inventory proprietary AI assets: model repositories, training data, prompts, skills, model scripts, and any secrets embedded in repositories. Identify which are accessible from CI/CD systems and developer endpoints. - Audit GitHub Actions (and equivalent CI/CD) workflows across all repositories, prioritising AI/ML repositories, for workflows not created by your engineers; review third-party actions and `pull_request_target`\-style triggers. Remove or quarantine unrecognised workflows. - Hunt for credential-stealer exposure: assume any developer machine that consumed PyPI/npm/Docker Hub packages since March 2026 may have had cloud and AI credentials harvested. Rotate cloud credentials, API keys, model-registry tokens and AI service credentials for affected populations. - Confirm secrets are not stored in repositories: scan for keys, tokens and credentials in AI repos and purge/rotate anything found. ### P2 — within 72 hours - Enforce provenance controls on open-source consumption: pin dependencies, verify package signatures/publisher identity, and review newly published or recently transferred packages in PyPI/npm/Docker Hub before adoption — the actor's pattern is large-scale ecosystem compromise. - Restrict CI/CD identity permissions: GitHub Actions and pipeline runners should hold short-lived, narrowly scoped tokens; block them from reading AI model repositories unless a workflow explicitly requires it. - Review egress monitoring for bulk repository cloning and large data transfers from AI/ML storage — exfiltration of a full AI repository is the demonstrated objective. ### P3 — within 7 days - Prepare extortion playbooks for IP/data-leak scenarios (distinct from encryption ransomware): legal position on payment, disclosure assessment, and pre-drafted communications. The extortion demand here is publication of proprietary AI assets. - Exercise detection and response against autonomous/agentic attack patterns: the sub-six-hour cloud compromise demonstrates that agent-driven campaigns compress the traditional intrusion timeline; ensure alerting and containment can operate at that speed. - Feed this campaign into DORA Art. 28 third-party risk reviews of any AI/ML development tooling and open-source dependencies. ## 5\. Indicators of compromise No indicators of compromise available in the source material. ### Behavioural indicators | Behaviour | Where to observe | Confidence | | ------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- | --------------------------------------------------------------- | | Creation of GitHub Actions workflows in proprietary AI repositories not attributable to legitimate developers | GitHub audit log (workflow.create, workflow\_run events); repository commit history | High — directly evidenced in Google's report | | Credential stealer deployment following consumption of compromised PyPI/npm/Docker Hub packages | EDR on developer endpoints; cloud credential anomalous-use alerts | High — described as UNC6780's typical post-compromise behaviour | | Bulk exfiltration of AI repository contents (models, source, prompts, scripts, secrets) | Egress monitoring, git clone/git archive volume, cloud storage egress logs | High — evidenced in both detailed intrusions | | Autonomous multi-agent cloud intrusion: rapid vulnerability scanning, real-time troubleshooting, IP rotation, completing in under six hours | Cloud audit logs; anomalous sequential API calls; rapid source-IP rotation on authentication events | Medium — single observed case reported by Google | ## 6\. Detection Insufficient indicators to author detection rules. The source material contains no strings, command lines, file names, registry keys, mutexes or other threat artefacts from which a YARA or Sigma rule could be built without fabrication. The behavioural indicators in §5 should be operationalised as detection engineering against GitHub audit logs, EDR telemetry and cloud authentication logs, but no atomic artefacts exist to author rules from. ## Threat actor context **TeamPCP** · [G1056](https://attack.mitre.org/groups/G1056?ref=f4n6.co.uk) · aka PCPCat, ShellForce, DeadCatx3, SHADOW-WATER-058, UNC6780 [TeamPCP](https://attack.mitre.org/groups/G1056?ref=f4n6.co.uk) is a financially-motivated, cloud-native threat group that has been active since at least September 2025\. Initially focused on ransomware and cryptocurrency theft, [TeamPCP](https://attack.mitre.org/groups/G1056?ref=f4n6.co.uk) shifted in early 2026 to systematic, worm-driven credential theft and software supply chain attacks targeting Continuous Integration and Continuous Delivery (CI/CD) workflows. … ## 7\. Sources - The Register, "Extortion crews have their eyes on high-value AI data, Google warns", https://www.theregister.com/research/2026/09/08/extortion-crews-have-their-eyes-on-high-value-ai-data-google-warns/5294640, 2026-09-08 - Google Threat Intelligence / Mandiant, AI Threat Tracker (Q2 2026), as reported by the above; no direct URL provided in source material ## 8\. Adverse Trace position This is a credible, well-sourced trend disclosure from a tier-one vendor, but it is single-sourced: everything rests on Google's AI Threat Tracker as relayed by one publication, with no package names, malware families or atomic indicators published — verify against the underlying Google report before enforcing any control change attributed to this campaign. The severity for EMEA financial services is elevated but indirect: no financial-sector victim is identified, yet the attack pattern — supply-chain compromise of PyPI/npm/Docker Hub, credential theft, malicious GitHub Actions workflows, exfiltration of AI repositories, extortion under threat of publication — maps directly onto AI/ML development pipelines that banks and insurers are building now, and the sub-six-hour autonomous cloud intrusion shows the response timeline is compressing. Clients should treat proprietary AI assets as high-value IP subject to extortion, apply the P1 inventory and CI/CD audit actions immediately, and fold this campaign into DORA Art. 28 third-party risk assessments of development tooling. Adverse Trace will monitor for the underlying Google report and for any publication of package names or IOCs, and will reissue this advisory with detection content if atomic indicators emerge. --- [Read the original source →](https://www.theregister.com/research/2026/09/08/extortion-crews-have-their-eyes-on-high-value-ai-data-google-warns/5294640?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*