TeamPCP Hackers Arrested Over Global Supply Chain Attacks

TeamPCP Hackers Arrested After Supply Chain Attacks Target More Than 1,000 Organizations

Two Australians accused of being key members of the notorious TeamPCP cybercrime group have been arrested following an international investigation into a series of software supply chain attacks that allegedly compromised more than 1,000 organizations worldwide.

Australian authorities arrested Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23, in Perth after a joint investigation involving the Australian Federal Police and the FBI. The two men face multiple cybercrime charges over their alleged roles in distributing malicious software and stealing sensitive information.

Hackers allegedly stole more than 500,000 credentials

Authorities say the malware linked to the operation may have compromised more than 1,000 organizations, giving attackers access to more than 500,000 credentials and allowing them to extract at least 300GB of data.

The victims reportedly span businesses, government organizations and other institutions across multiple countries, highlighting the potentially global reach of the campaign.

Investigators allege that the attackers exploited trusted software and open-source development environments rather than simply attacking individual companies directly.

That approach makes supply chain attacks particularly dangerous because organizations can unknowingly install compromised software or updates that appear legitimate.

TeamPCP’s campaign spread through the software ecosystem

TeamPCP has been linked to a broader campaign targeting software development infrastructure, including GitHub, npm, PyPI, Docker Hub and other ecosystems.

The group has previously been associated with attacks involving widely used developer tools and libraries, including Trivy and LiteLLM. Security researchers say attackers used stolen credentials and compromised development environments to move from one target to another.

One of the most significant incidents connected to the group involved the LiteLLM supply chain, where researchers reported the theft of hundreds of gigabytes of information and credentials from compromised systems.

What the hackers are accused of doing

According to Australian authorities, Thomson and Gaebler allegedly distributed malicious code that could infiltrate systems and extract valuable information.

Thomson faces additional allegations involving hacking tools, unauthorized modification of computer data, distribution of hacking tools, failure to comply with a court order concerning electronic devices and handling more than $100,000 in suspected criminal proceeds.

Gaebler faces charges involving hacking tools, unauthorized computer-data modification and supplying hacking tools.

Both men could face years in prison if convicted, while Thomson could face a substantially longer sentence because of the additional allegations.

Why the arrests matter

The arrests represent a significant development in the fight against software supply chain attacks, which have become an increasingly attractive strategy for cybercriminals.

Instead of breaking into thousands of organizations individually, attackers can compromise a single trusted developer, software package or infrastructure provider and use that access to reach many downstream victims.

The TeamPCP campaign demonstrates how damaging that strategy can be. A successful compromise of a widely used tool can potentially put thousands of companies at risk before security teams even realize something is wrong.

Security researchers have warned that the campaign may not be limited to the attacks already discovered, with TeamPCP repeatedly using credentials obtained from one compromised environment to move toward additional targets.

Investigation continues

Australian authorities and the FBI are continuing to investigate the alleged cybercrime operation, and authorities have not ruled out further action.

For organizations, the arrests are also a reminder that software security cannot be separated from overall cybersecurity. Developers and security teams increasingly need to monitor third-party packages, protect developer credentials and investigate unexpected changes to source-code repositories and cloud environments.

The TeamPCP case shows why a single compromised software dependency can become a much larger security crisis — potentially turning trusted tools into a pathway into thousands of organizations.