Two Australians charged over TeamPCP supply chain cyberattacks targeting 1,000 organizations

Australian Federal Police have arrested two Western Australian men accused of being members of TeamPCP, a cybercrime group blamed for what authorities describe as one of the most prolific software supply chain attack campaigns on record. The pair face a combined 14 charges and appeared in Perth Magistrates Court on August 27.helpnetsecurity+1

The Arrests

The AFP, working with the FBI and Western Australia Police Force, arrested a 21-year-old from Cottesloe and a 23-year-old from Mandurah on August 26 after executing search warrants at properties in Cottesloe, Hamilton Hill, and Mandurah. The older man faces six computer-related offenses, while the younger faces eight charges including dealing with proceeds of crime worth $100,000 or more, which carries a maximum penalty of 20 years' imprisonment.australiancybersecuritymagazine+1

Cybersecurity journalist Brian Krebs reported that the 21-year-old is Ruben Thomson, who used the hacker handle "Ellis" and described himself as TeamPCP's leader until March 2026. ABC News Australia confirmed Thomson was denied bail. The 23-year-old was identified as Michael Gaebler, whose attorney did not request bail.krebsonsecurity

Scale of the Campaign

Authorities estimate TeamPCP's malicious code compromised more than 1,000 organizations globally, enabling the theft of over 500,000 credentials and at least 300 gigabytes of data. Global remediation costs are estimated in the hundreds of millions of dollars.helpnetsecurity+1

"These men are allegedly members of the cybercriminal group TeamPCP, whose malicious code potentially compromised more than a thousand organizations worldwide," FBI Cyber Division Assistant Director Brett E. Leatherman said.nationaltribune

The group's tactics involved inserting malicious code into open-source repositories that developers unknowingly pulled into their own projects. Targets included the vulnerability scanner Trivy, AI gateway LiteLLM, AI recruiting startup Mercor, and GitHub Microsoft Corporation ↗ 6.68% developer infrastructure, according to TechCrunch. The hackers are also suspected of breaching the European Commission's cloud infrastructure.techcrunch

Inside TeamPCP

Security researcher Charlie Eriksen of Aikido noted that TeamPCP cloned an earlier self-propagating worm called Shai-Hulud but was not behind its original creation. "They were also not especially sophisticated. What made them dangerous was their ability to take public exploits, techniques, research, and malware ideas and operationalize them quickly," Eriksen wrote.helpnetsecurity

Google Alphabet Inc. ↗ 3.25% Threat Intelligence Group principal analyst Austin Larsen described TeamPCP as "a peer community of individually-skilled actors, with one clear center of gravity" rather than a structured criminal crew.krebsonsecurity

Krebs reported that Thomson told him he had earned roughly $20,000 from his TeamPCP activities and that roughly two weeks before his arrest, he said he was ready to leave cybercrime behind. The investigation remains active, and authorities have not ruled out further arrests.helpnetsecurity+1