TeamPCP Masquerading pglog Binary Execution

Elgonad .@elgonad

•updated Mar 25, 2026•6•0•160

Detects the execution of processes from the '/tmp/pglog' path or where the binary is named 'pglog'. Threat actor TeamPCP utilizes this specific filename to masquerade their downloaded malicious secondary payload as a legitimate PostgreSQL process, following the compromise of the litellm PyPI package.