TeamPCP Telnyx PyPI Backdoor Indicators
This detection identifies activity related to the TeamPCP Telnyx PyPI backdoor. It specifically looks for the installation of compromised 'telnyx' package versions (4.87.1 or 4.87.2) via pip, command-line interactions with a known C2 server (83.142.209.203:8080 for 'ringtone' or 'hangup' WAV files), or the presence of 'msbuild.exe' in the Windows Startup folder, which is an indicator of persistence used by this threat.
Sigma
