Two TeamPCP Hackers Arrested in Australia for Shai-Hulud Supply Chain Attacks
The Australian Federal Police (AFP) arrested two men from Western Australia, aged 21 and 23, in connection with TeamPCP, a prolific cybercrime and data extortion group blamed for the longest running spree of software supply chain attacks ever recorded. According to a statement released today, the suspects allegedly ran a "sophisticated cybercrime syndicate" that created malicious open-source software to compromise thousands of global businesses. KrebsOnSecurity identified the 21-year-old suspect's real identity in June and has been communicating with him since. The outlet also interviewed TeamPCP's self-described spokesperson and traced clues left by the group's leader that likely contributed to his apprehension.
TeamPCP emerged on the cybercrime scene in late 2025, embedding malicious code into hundreds of open-source software tools and extorting victims for profit. The group's signature weapon is a self-propagating worm dubbed "Shai-Hulud," which spreads through compromised corporate cloud environments. Shai-Hulud harvests developer credentials from public code repositories such as GitHub and NPM—often through phishing or direct theft—and uses them to publish poisoned updates to legitimate software development tools. As Wired journalist Andy Greenberg explained, the operation runs on a cyclical exploitation model: attackers plant malware in a popular tool, infect downstream developers, steal their credentials, and repeat the process across an ever-widening network. Developers and organizations can verify whether their credentials have been exposed using an email breach checker and audit authentication hygiene with a password checker to identify weak or compromised credentials before attackers exploit them.
The group also pioneered a form of cyclical recruitment. In May, the source code for the third iteration of Shai-Hulud was published online, and TeamPCP soon launched a contest offering $1,000 in Monero to whichever participant could execute the largest supply chain operation using the worm. Contestants were scored by weekly and monthly download counts of the packages they compromised—directly incentivizing attacks on the most widely used code libraries. Threat intelligence firm Dataminr noted that TeamPCP framed the competition as a recruitment opportunity, with the $1,000 prize described by the actor as merely a "participation trophy." The group reportedly intended to purchase all meaningful access harvested from participants' campaigns, effectively crowdsourcing a global supply chain attack force.
The arrests mark a significant win for law enforcement and underscore how supply chain compromises have become the attack vector of choice for financially motivated threat actors. By weaponizing the trust developers place in open-source ecosystems, TeamPCP demonstrated how a single phished credential can cascade into thousands of downstream intrusions. Security teams should audit their dependency chains, rotate any secrets stored in build environments, and review their DNS configurations with a DNS leak test to ensure attackers have not redirected internal traffic. The case also highlights the value of open-source intelligence: WHOIS records on suspicious packages, exposed GitHub tokens, and Telegram metadata ultimately helped investigators connect the dots between the group's public persona and its real-world operators.