Press play to start listening
Australian police have arrested two Western Australian men accused of being principal participants in TeamPCP, a cybercrime group linked to repeated attacks on open-source software, developer tools and corporate build systems.
The Australian Federal Police (AFP) charged the pair on August 26, 2026, after investigators searched properties in Cottesloe, Hamilton Hill and Mandurah. Authorities also seized electronic devices and other items for examination during the joint AFP and Western Australia Police Force operation, conducted with assistance from the FBI.
ABC News identified the accused as Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23. An FBI official described Thomson as the alleged leader of TeamPCP, while police allege both men received cryptocurrency payments for their roles. The value of those payments remains under investigation.
Two Men Face 14 Charges
According to AFP’s press release, Thomson faces eight charges, including possession and supply of data intended for use in computer offences, four counts of unauthorised data modification, dealing with criminal proceeds worth at least A$100,000 and failing to comply with an order requiring access to electronic data.
The proceeds-of-crime charge carries a maximum sentence of 20 years, while failure to comply with the data-access order carries up to 10 years. The four unauthorised modification counts each carry a maximum sentence of five years.
Gaebler faces six charges covering possession and supply of data intended for computer offences and four counts of unauthorised data modification. The two men appeared in Perth Magistrates Court on August 27.
During the hearing, Thomson’s lawyer withdrew a bail application after the magistrate expressed concern about interference with evidence. Gaebler did not apply for bail and was remanded in custody until his next appearance on September 18. The allegations have not been proven in court, and both men are presumed innocent.
Police told ABC that investigators had already extracted about 100 terabytes of data from devices seized at one address. The AFP said further arrests and charges remain possible.
Police Link TeamPCP to Global Supply Chain Attacks
The investigation began in April after cybersecurity companies provided the AFP and FBI with information about attackers placing malicious code inside trusted open-source software.
Once developers or automated build systems installed the affected software, the malware searched for cloud credentials, package-publishing tokens, SSH keys, Kubernetes secrets and other authentication material. Stolen credentials could then be used to access more projects, publish additional malicious releases or enter company networks.
Authorities estimate that TeamPCP’s code could have affected more than 1,000 organisations in government, academia and the private sector, enabling the theft of more than 500,000 credentials and at least 300GB of data. Remediation costs are estimated in the hundreds of millions of dollars.
Those numbers are investigative estimates and do not establish that every exposed organisation suffered a confirmed breach.
The Campaign From Trivy to LiteLLM
Hackread.com first covered TeamPCP’s interconnected attacks in March, when the group was linked to compromises involving Aqua Security’s Trivy scanner, Checkmarx KICS and LiteLLM.
The attackers compromised Trivy’s release process and GitHub Actions before using stolen credentials against other projects. LiteLLM’s build system installed Trivy without pinning it to a verified version, allowing the malicious scanner to obtain a PyPI publishing token. TeamPCP then used that token to distribute tainted LiteLLM versions 1.82.7 and 1.82.8.
Those releases installed the SANDCLOCK credential stealer, which searched affected systems for cloud keys, Kubernetes tokens, cryptocurrency wallet information, and credentials for AI services.
Later research connected the LiteLLM incident with possible exposure at more than 2,500 companies and approximately 434,000 CI/CD pipelines, although those figures did not prove every listed organisation executed the malware.
TeamPCP also uploaded malicious Telnyx Python SDK versions that downloaded disguised code through a file named ringtone.wav. Telnyx said its main platform and customer data were not accessed, but developers who installed versions 4.87.1 or 4.87.2 were advised to replace exposed credentials.
Shai-Hulud Spread Through Trusted Developer Tools
In April, researchers connected TeamPCP with an attack on the Bitwarden command-line package. A compromised Checkmarx KICS Docker image was automatically pulled by Dependabot inside a CI environment, giving Shai-Hulud access to repository secrets without requiring a developer to install the malware manually.
The worm used stolen GitHub tokens to create repositories containing encrypted credential dumps and instructions. It also searched for AI coding tools, including Claude Code, Gemini CLI and Codex CLI, before adding malicious commands to terminal startup files.
In May, a related worm called Mini Shai-Hulud poisoned more than 400 package versions associated with 172 npm and PyPI packages in about five hours. Projects connected with TanStack, Mistral AI, UiPath, OpenSearch and Guardrails AI were among those affected.
TeamPCP later claimed it was selling repositories associated with Mistral AI. Mistral confirmed that attackers temporarily compromised one of its code-management systems through a third-party software incident and accessed certain non-core repositories, although the company did not confirm every claim made by the seller.
The group also claimed responsibility for the theft of approximately 3,800 internal GitHub repositories after a developer’s computer was infected through a malicious VS Code extension. GitHub said it found no evidence that customer data or infrastructure outside its internal network was accessed.
The AFP charges do not publicly assign each count to a named project or incident, so the prosecution’s evidence linking the accused to individual TeamPCP operations has not yet been disclosed.
FBI Warns Stolen Credentials Remain Dangerous
A July FBI advisory (PDF) identified TeamPCP malware including CanisterWorm, SANDCLOCK, Mini Shai-Hulud and Miasma. It warned that credentials stolen during these attacks could remain useful long after malicious packages were removed.
Companies that used affected software should rotate CI/CD secrets, registry tokens and cloud credentials, review repositories for tpcp-docs or docs-tpcp, pin GitHub Actions to verified commit hashes and examine build logs for unauthorised package publication or outbound connections.
