Australia arrests two in TeamPCP supply-chain hack probe

Australian Federal Police arrested Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23, in Perth, the AFP announced on Thursday. Both men are accused of belonging to the cybercrime group known as TeamPCP.

Thomson faces five types of charges related to computer hacking and money laundering, with penalties of three to 20 years in prison for each count. Gaebler faces computer hacking charges, with the most serious counts carrying a maximum sentence of five years.

Authorities seized electronic devices from both men. Forensic teams are examining the material as part of a broader investigation that law enforcement attributes to hundreds of millions of dollars in losses worldwide.

Police allege TeamPCP targeted developer tools and build systems to capture credentials and secrets. Authorities say the group compromised security scanners and registries, including Trivy, KICS and LiteLLM, and inserted malicious code into automated build workflows and package registries.

According to the allegations, the campaign siphoned more than 500,000 corporate credentials from CI/CD pipelines and exfiltrated at least 300 gigabytes of data from over 1,000 organizations worldwide.

By hijacking automated build processes and package distribution channels, the suspects are accused of using corporate software pipelines to harvest cloud access keys and infrastructure secrets. Authorities allege the stolen credentials were then passed to extortion and ransomware groups.

Investigators linked the group to an automated worm called Mini Shai-Hulud and suspect use of the original Shai-Hulud to automate credential theft and self-propagation across package registries.

The Australian Federal Police announced: “A large volume of data seized is being forensically examined and the investigation remains ongoing. Further arrests and charges have not been ruled out.”

Authorities are working to quantify how much money the suspects may have realized from the alleged operations. The arrests in Perth form part of an international law enforcement effort targeting syndicates that exploit the software supply chain to gain access to corporate networks and cloud environments.