UNC6780
Financially motivated supply-chain cluster that stole Cisco AI Defense source code and breached LiteLLM in 36 hours.
Last refreshed: 20 May 2026
UNC6780 holds Cisco AI Defense source code; what does that unlock for the next exploit cycle?
Timeline for UNC6780
Cloned over 300 private Cisco GitHub repositories using SANDCLOCK-stolen credentials
Cybersecurity: Threats and Defences: UNC6780 takes Cisco AI Defense source codeExploited CVE-2026-42208 within 36 hours of KEV addition, using SANDCLOCK-stolen AWS keys and GitHub tokens
Cybersecurity: Threats and Defences: LiteLLM SQL injection hits in 36 hoursProvided the operational backdrop for CSIS paper published six days after the Axios compromise
Cybersecurity: Threats and Defences: CSIS calls for operational US-ROK cyber alliancePhished an Axios npm maintainer and planted WAVESHAPER.V2 in versions v1.14.1 and v0.30.4
Cybersecurity: Threats and Defences: UNC1069 planted WAVESHAPER.V2 in Axios via maintainer phishingMentioned in: Three supply-chain hits in thirteen days
Cybersecurity: Threats and Defences- Who is UNC6780 and what did they steal from Cisco?
- UNC6780 (also tracked as TeamPCP) is a financially motivated threat cluster that cloned over 300 private Cisco GitHub repositories on or around 11 May 2026, including the source code of Cisco AI Defense and Cisco AI Assistant, using credentials stolen via the SANDCLOCK malware from the Trivy supply-chain compromise.Source: Google Threat Intelligence Group
- What is the SANDCLOCK credential stealer?
- SANDCLOCK is the credential-stealing tool used by UNC6780 to harvest GitHub tokens and AWS keys from compromised developer environments, enabling the cluster's access to Cisco and LiteLLM infrastructure.Source: GTIG / SANS Internet Storm Center
- How did UNC6780 get into Cisco's GitHub?
- UNC6780 compromised the Trivy open-source vulnerability scanner (CVE-2026-33634, March 2026), which held CI/CD pipeline credentials for every project it audited, including Cisco's repositories. SANDCLOCK harvested those credentials and the cluster used them to clone over 300 private Cisco repos.Source: GTIG
- How quickly did UNC6780 exploit the LiteLLM vulnerability?
- UNC6780 exploited LiteLLM CVE-2026-42208 within 36 hours of CISA adding it to the Known Exploited Vulnerabilities catalogue on 8 May 2026, roughly 85 per cent faster than a typical enterprise patch cycle of five to ten days.Source: GTIG
Background
UNC6780, also tracked as TeamPCP, emerged as the central actor of the 11 May 2026 GTIG threat report. The cluster used the SANDCLOCK credential stealer to harvest GitHub tokens and AWS keys exfiltrated through the March 2026 Trivy supply-chain compromise (CVE-2026-33634), then cloned more than 300 private Cisco GitHub repositories, including the source code of Cisco AI Defense and Cisco AI Assistant. GitHub confirmed an investigation into the unauthorised access. UNC6780 also exploited LiteLLM CVE-2026-42208 within 36 hours of CISA's KEV addition on 8 May 2026, compressing the typical enterprise patch window by roughly 85 per cent and pulling credentials from BerriAI's commercial infrastructure.
The cluster operates the SANDCLOCK credential-stealer toolchain, which had previously been used in attacks on SAP npm packages. The Trivy pivot is a second-order supply-chain technique: rather than targeting developer endpoints directly, UNC6780 compromised the scanner tooling that audited those endpoints, yielding credentials across Cisco's entire CI/CD pipeline. The same SANDCLOCK-stolen credentials served three distinct targets in weeks: Trivy, LiteLLM and BerriAI, and Cisco's GitHub estate.
UNC6780's haul gives a financially motivated cluster the internal architecture of Cisco's LLM-security product portfolio. The blast radius in product-line breadth is roughly 30 times the SolarWinds Orion reference before per-customer downstream counts are known. The cluster is distinct from the state-attributed Flax Typhoon and FIRESTARTER campaigns against Cisco edge devices, though the coincidence of source-code visibility into Cisco's defensive products and the active CVE exploitation cycle on Cisco SD-WAN raises an unanswered forward question about the next exploit generation.
