Australia Arrests 2 Alleged TeamPCP Hackers Behind Major Supply Chain Attacks

Australian authorities have arrested and charged two men suspected of being members of the notorious cybercrime group TeamPCP, which is blamed for hundreds of millions of dollars in losses through large-scale software supply chain compromises. Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23, were taken into custody in Perth. Thomson faces five charges tied to computer hacking and money laundering, carrying potential sentences of 3 to 20 years per count, while Gaebler was charged with computer hacking offenses carrying up to 5 years on the most serious counts.

TeamPCP gained access to corporate environments by infiltrating automated build workflows and popular package registries, targeting developer security tools including Aqua Security's Trivy, Checkmarx's KICS, and PyPI's LiteLLM. From compromised CI/CD pipelines, the group siphoned more than 500,000 corporate credentials, including cloud access keys and infrastructure secrets, which were then handed off to extortion and ransomware affiliates. Investigators say the group deployed the self-propagating Mini Shai-Hulud worm — and likely the original Shai-Hulud variant — to automate credential theft across package registries at scale. Organizations worried about whether their credentials may have been exposed in similar incidents can quickly verify exposure using an email breach checker.

According to the Australian Federal Police, TeamPCP exfiltrated at least 300 GB of data from more than 1,000 organizations worldwide. Devices belonging to both suspects have been seized, and forensic examination is underway to quantify their financial gains. "A large volume of data seized is being forensically examined and the investigation remains ongoing. Further arrests and charges have not been ruled out," the AFP stated on Thursday. Defenders reviewing their own perimeter posture can use a port scanner to identify exposed services and reduce the attack surface that worm-style campaigns rely on.

The case underscores how supply chain intrusions turn trusted developer tooling into data-harvesting networks, amplifying the blast radius of a single compromise. Security teams are urged to audit pipeline secrets, rotate exposed credentials, and monitor package registry activity for unauthorized publishing. Admins can also validate certificate hygiene on build endpoints with an SSL/TLS checker to help detect tampering introduced during a supply chain compromise.