A new hacking group, named TeamPCP, has been operating in a persistent campaign that spreads a self-propagating backdoor and a data wiper that targets Iranian machines. The group, which gained notoriety in December, has also compromised virtually all versions of the Trivy vulnerability scanner in a supply-chain attack after gaining privileged access to the GitHub account of its creator. The worm was controlled by an unusual mechanism designed to be tamper-proof and constantly changing URLs for servers hosting malicious binaries.