Two Australians Charged in TeamPCP Supply Chain Attacks on Trivy, LiteLLM

Australian Federal Police (AFP) have charged two Western Australian men, Louis Michael Gaebler, 23, of Mandurah, and Ruben Ian Thomson, 21, of Cottesloe, with a combined 14 offences over their alleged roles as principal participants in TeamPCP, the cybercrime syndicate responsible for the March 2026 compromise of open-source security tools Trivy and Checkmarx KICS, along with the AI gateway LiteLLM. The pair appeared in Perth Magistrates Court on August 27, 2026, one day after AFP and Western Australia Police Force executed search warrants at properties in Cottesloe, Hamilton Hill, and Mandurah, seizing electronic devices for forensic analysis. Investigators allege the men received cryptocurrency payments, the value of which remains under investigation.

The syndicate's attack chain exploited publishing credentials stolen from trusted open-source projects, pushing poisoned releases through the projects' own legitimate release channels across five distribution ecosystems: GitHub Actions, Docker Hub, npm, PyPI, and OpenVSX. Compromising one project supplied the credentials used against the next in a cascade. Credentials harvested from the Trivy scanner compromise were weaponized against the Checkmarx KICS actions days later, while LiteLLM's own build pipeline installed Trivy without pinning it to a verified version, allowing the poisoned scanner to exfiltrate the project's publishing token. Organizations should immediately review whether their developers were exposed, and security teams can audit credential hygiene with a password checker and verify any leaked corporate emails through an email breach checker.

The charges are extensive: Thomson faces one count of possessing data with intent to commit a computer offence, four counts of unauthorized modification of data with intent to commit a serious offence, one count of supplying data with intent, one count of failing to comply with a section 3LA order, and one count of dealing with proceeds of crime worth $100,000 or more. Gaebler faces three counts, including unauthorized modification of data and supplying data with intent. The section 3LA count, brought under the Crimes Act 1914 (Cth), carries a maximum 10-year sentence, while the proceeds of crime count carries up to 20 years. None of the 14 charges names a specific compromised project.

In a July 2 advisory, the FBI warned that organizations impacted by the campaign should treat all exfiltrated data and credentials as a persistent risk, noting that affiliated threat actors are likely to weaponize stolen information long after the initial compromise. The bureau urged defenders to rotate all continuous integration and continuous delivery (CI/CD) secrets, publishing tokens, and cloud credentials accessible during the exposure windows. FBI Cyber Division Assistant Director Brett E. Leatherman said in a joint media release that the two men are allegedly members of TeamPCP, whose malicious code potentially compromised more than a thousand organizations worldwide. Defenders protecting distributed pipelines should also validate their external attack surface, running a SSL/TLS checker on build infrastructure and a WHOIS lookup on suspicious package registries to confirm ownership and certificate integrity.