The weight in this attribution sits on the two indicators an operator cannot retroactively clean. GitLab authentication records are server-side, and Oligo correlated them against ShadowRay 2.0 command-and-control traffic, reverse-shell activity and malware staging to build what it calls a direct operational bridge between the campaign and the actor later branded TeamPCP [8]. The hinge identity is IronErn, seen on both GitHub and GitLab during ShadowRay 2.0 and again in TeamPCP's later infrastructure [7]. Oligo had those identities in hand during the original ShadowRay 2.0 work but could not yet place them [17].
The rest of the case is the softer material: shared domains, malware deployment paths, staging techniques, backend infrastructure, operational tradecraft [4]. All of that is cheap for a competent crew to rotate. Oligo's argument is that it did not rotate. The same infrastructure families, staging patterns, malware path conventions and command-and-control held steady straight through the point where the operators started publishing under a name [5].
The span matters more than the name. Oligo places the IOC and infrastructure overlap with TA-NATALSTATUS between 2020 and August 2025 [3], which works out to somewhere between 56 and 68 months of continuous operation depending on where in 2020 it began [18]. Oligo also found TeamPCP activity months before the group branded itself [9]. The public identity therefore accounts for the tail end of a lineage running five years or more [19].
The exploitation cadence is the part worth internal circulation. Oligo describes repeated exploitation of 1-day vulnerabilities in React, Docker, Redis and Ray, frequently automated and wormable [11]. That is a crew whose business model is the gap between a disclosure and your patch window, applied to services somebody stood up and stopped owning. ShadowRay 2.0 added AI-assisted malware development and wormable payloads against exposed Ray clusters on top of the same habits [16]. The supply chain phase, GitHub Actions abuse, token theft and open-source project abuse, came later, and surfaced publicly through attacks on Trivy, Checkmarx and BerriAI/LiteLLM [10][12].
Oligo credits Mandiant and GitLab with independent review and investigative context, and GitLab banned the accounts named in the report [14][15]. TeamPCP has presented itself publicly as financially motivated [13]. On Oligo's timeline it was collecting for years before it wanted the credit.
