Australia Arrests 2 Alleged TeamPCP Hackers

TeamPCP is a cybercrime syndicate that compromised software supply chains and developer security tools such as Aqua Security’s Trivy, Checkmarx’s KICS, and PyPI’s LiteLLM to steal over 500,000 corporate credentials from CI/CD pipelines. By hijacking automated build workflows and package registries, TeamPCP transformed corporate software pipelines into data-harvesting networks, funneling stolen cloud access keys and infrastructure secrets to extortion and ransomware groups. They deployed malware including the Mini Shai-Hulud worm to automate credential theft and self-propagation across package registries. Australian and US authorities arrested two alleged members, Ruben Ian Thomson and Louis Michael Gaebler, charging them with multiple offenses related to hacking and money laundering. The group exfiltrated at least 300 GB of data from more than 1,000 organizations worldwide. Devices seized are under forensic examination, and the investigation remains ongoing.

The cybercrime group TeamPCP caused significant financial losses estimated in the hundreds of millions of dollars by stealing corporate credentials and cloud infrastructure secrets from over 1,000 organizations globally. Their compromise of major software supply chains and developer security tools enabled widespread credential theft and facilitated extortion and ransomware attacks. The scale of data exfiltration (at least 300 GB) and the use of automated malware to propagate across package registries indicate a large and sophisticated operation with broad impact on software supply chain security.

This report concerns law enforcement actions against alleged cybercriminals and does not provide specific remediation or patch information. Organizations should review their software supply chain security and CI/CD pipeline protections in light of these attack methods. Patch status is not applicable. No vendor advisory or official fix is indicated in this context.