This report provides an update on the TeamPCP supply chain campaign, focusing on the theft of Cisco source code through a breach associated with the Trivy security scanner. The threat actor UNC6780, tracked by Google GTIG, continues to conduct supply chain attacks affecting multiple organizations and SaaS environments. The campaign has been documented through multiple updates, with this being the seventh, consolidating intelligence from early April 2026. Although the campaign involves remote code execution (RCE) tags, specific technical exploit details or affected software versions are not provided. No patch or remediation guidance is currently available, and no known exploits have been observed in the wild.

The primary impact is the unauthorized access and theft of Cisco source code, which could potentially aid attackers in developing targeted exploits or further supply chain compromises. The campaign has also resulted in widespread credential sharing and SaaS environment compromises. However, there is no evidence of active exploitation in the wild at this time. The absence of a standalone CISA advisory suggests that official mitigation guidance is pending or under development.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should monitor updates from Cisco, CISA, and other relevant vendors for official patches or mitigation instructions. Given the supply chain nature of the campaign, reviewing and securing software supply chain processes and access controls is advisable. No specific remediation actions are detailed in the current report.