Loading story…
The Australian Federal Police, Western Australia Police Force and FBI charged two Western Australian men in their early 20s over their alleged roles as principal participants in TeamPCP, a global cybercrime syndicate. Investigators allege the group injected malicious code into trusted open-source components, compromising software supply chains used by government, academic and private-sector organizations worldwide. The activity may have affected more than 1,000 organizations, exposed over 500,000 credentials and exfiltrated at least 300 GB of data, with global remediation costs estimated in the hundreds of millions of dollars.
Authorities searched properties in Cottesloe, Hamilton Hill and Mandurah and seized electronic devices; the investigation remains ongoing and further charges or arrests are possible. TeamPCP allegedly rapidly weaponized public exploits, research and malware techniques for financial, political, disruptive and attention-seeking purposes. Reporting also distinguishes the group from the original 2025 S1ngularity and Shai-Hulud incidents: TeamPCP allegedly cloned the Shai-Hulud worm, but attribution for the original attacks remains unresolved.
See the reporting duties and controls this puts on the clock.
22 events from the most recent confirmed update back to the earliest known activity.
Louis Michael Gaebler and Ruben Ian Thomson appeared in Perth Magistrates Court after the AFP charged them with a combined 14 offences over their alleged principal roles in TeamPCP.
The AFP, FBI, and Western Australia Police Force announced the arrests of two men in their early 20s alleged to have operated TeamPCP. The investigation remained ongoing, with authorities examining seized data and not ruling out further arrests or charges.
The AFP charged a 21-year-old Cottesloe man and a 23-year-old Mandurah man following warrant executions, alleging they were principal TeamPCP participants who received cryptocurrency payments. Police searched properties in Cottesloe, Hamilton Hill, and Mandurah and seized electronic devices and other items for forensic examination.
Splunk updated its "Python PTH File Creation During Package Installation" anomaly detection, motivated by TeamPCP's LiteLLM supply-chain compromise. The analytic correlates Windows Sysmon process-creation and file-creation events to identify .pth files created during package installation, which can execute code on later Python launches.
GitHub introduced a three-day cooldown for Dependabot updates, intended to provide more time to identify and remove compromised dependency releases amid widespread poisoned-package activity. Python and JavaScript package ecosystems also adopted similar cooldown-period support.
Dataminr reported that TeamPCP's May 2026 Mini Shai-Hulud campaign compromised 172 packages with 518 million cumulative downloads. The campaign reportedly targeted developer and cloud credentials and affected packages or organizations including TanStack, UiPath, Mistral AI, OpenSearch, Guardrails AI, and LiteLLM.
In May, TeamPCP claimed it had compromised at least 3,800 GitHub repositories after a GitHub developer installed an extension compromised by its malware. The group also published source code for a third Shai-Hulud iteration and reportedly offered 1,000 XMR for the largest supply-chain operation using it.
The AFP, FBI, and Western Australia Police Force began parallel investigations after the AFP and FBI received information from multiple cyber-threat assessment companies.
CISA added CVE-2026-33634, which the reporting associates with the TeamPCP supply-chain campaign, to its Known Exploited Vulnerabilities catalog.
While investigating an incident, the Aikido author encountered an attack linked to TeamPCP activity.
Investigators identified the European Commission and GitHub as downstream victims of TeamPCP's malicious Trivy release, which was distributed through automated build pipelines. They estimated the campaign exposed more than 500,000 credentials, exfiltrated at least 300 GB of data, and caused remediation costs in the hundreds of millions of dollars.
Flare reported that TeamPCP exploited a misconfigured GitHub Actions workflow in Aqua Security's Trivy project and published a malicious Trivy release that deployed credential-stealing code in CI/CD pipelines. It said LiteLLM subsequently ran the poisoned software, allowing TeamPCP to steal its PyPI token and publish two backdoored LiteLLM releases on March 24.
TeamPCP's alleged March compromise of LiteLLM packages on PyPI reportedly affected more than 2,500 organizations. Automated build systems reportedly downloaded and used the compromised packages tens of thousands of times.
Cybersecurity journalist Brian Krebs reported that arrested suspect Ruben Thomson was allegedly known online as “Ellis.” Ellis reportedly said he led TeamPCP until March 2026.
TeamPCP allegedly targeted Next.js applications in a React2Shell campaign and claimed to have compromised more than 59,000 servers in under 48 hours.
TeamPCP was first observed conducting attacks against software developers using the Shai-Hulud worm, which infects code repositories on platforms including GitHub.
Reporting linked TeamPCP's Trivy and LiteLLM supply-chain activity to a compromise of AI recruitment firm Mercor and to theft of data from OpenAI. The reference described these as additional impacts of the group's open-source package poisoning campaign.
The FBI identified the GitHub repository names "tpcp-docs" and "docs-tpcp" as TeamPCP data-exfiltration indicators, advising that their presence in an organization may indicate the worm created them using stolen credentials. The reporting also named KICS and the Telnyx Python SDK among modified tools and described the CanisterWorm, SANDCLOCK, Mini Shai-Hulud, and Miasma malware used in the campaign.
Police said they had extracted 100 terabytes of data from devices seized at one searched address and expected to extract substantially more as the TeamPCP investigation continued.
Ruben Thomson, the alleged TeamPCP leader charged alongside Michael Gaebler, was denied bail following the Western Australia cybercrime charges.
A reported Shai-Hulud wave on August 4 affected more than 400 npm packages, representing a new propagation event after the May Mini Shai-Hulud campaign.
Authorities allege that TeamPCP inserted malicious code into open-source repository software that developers unknowingly incorporated into downstream systems. The campaign potentially compromised more than 1,000 organizations, exposed more than 500,000 credentials, and exfiltrated at least 300 GB of data.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See what this changes for your reporting obligations and which controls it puts on the clock.
33 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcezdnet.fr
Open sourcecyberveille.ch
Open sourcereversinglabs.com
Open sourceabc.net.au
Open sourcecyberveille.ch
Open sourceresearch.splunk.com
Open sourcedataminr.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The FBI issued a FLASH warning that **TeamPCP** is carrying out large-scale software supply chain compromises by trojanizing trusted developer and security tools, including **Trivy**, **KICS**, **LiteLLM**, and the **Telnyx Python SDK**. The campaign is designed to infiltrate CI/CD pipelines, cloud infrastructure, and security workflows, then steal high-value secrets such as cloud access tokens, API keys, SSH keys, and Kubernetes secrets. Reporting tied to the alert describes TeamPCP as a financially motivated group whose operations show persistence and scale more commonly associated with advanced threat actors. Authorities and researchers said the activity is linked to malware families including **CanisterWorm**, **SANDCLOCK**, **Mini Shai-Hulud**, and **Miasma**, which were used to establish persistence, exfiltrate credentials, and spread access into downstream victim environments. The FBI said the group has also engaged in extortion, published victim names on a leak site, and collaborated with other threat actors, raising the risk that stolen credentials will be reused long after the initial compromise. Defenders were urged to rotate exposed secrets, pin GitHub Actions to verified commit SHAs, hunt for worm-created repositories, harden CI/CD environments, and review published indicators such as domains, IP addresses, hashes, and related CVEs.
Jul 9, 2026
Researchers have linked **TeamPCP** to a broader criminal operation spanning AI infrastructure hijacking and open-source software supply-chain compromise. Oligo Security said infrastructure overlaps tied TeamPCP to aliases including **IronErn** and **TA-NATALSTATUS**, and connected the group to the **ShadowRay 2.0** campaign, which abused Ray’s exposed Jobs API behavior tracked as `CVE-2023-48022` to achieve remote code execution on internet-facing Ray clusters. The campaign turned compromised AI systems into a self-propagating botnet used for CPU and GPU cryptomining, including targeting **NVIDIA A100** resources, while also enabling reverse shells, persistence, data theft, and DDoS activity. Separate threat intelligence reporting said TeamPCP evolved from cloud intrusions and **XMRig**-based Monero mining into a credential-theft-led supply-chain operation that allegedly compromised projects and distribution channels including **Trivy**, **Checkmarx KICS**, **LiteLLM**, the **Telnyx Python SDK**, **Bitwarden CLI**, **Xinference**, and **elementary-data**, and was also linked to an AWS breach affecting the **European Commission**. ThreatMon said the group’s March-April 2026 activity affected more than **1,000 SaaS environments**, exposed roughly **500,000 credentials**, and led to more than **300 GB** of data theft, while newer reporting suggests the actor has likely been active since **2020** and has accelerated its operations by exploiting AI adoption, automation, and trust in open-source ecosystems.
Sep 3, 2026
Palo Alto Networks Unit 42 reported that **TeamPCP** has conducted a multi-stage supply chain campaign aimed at security infrastructure providers, describing a pattern in which the actor compromises organizations that sit inside customer build, deployment, and protection workflows. The activity highlights the risk of attacking trusted security tooling and cloud-connected platforms to gain access to downstream environments, internal architecture, and sensitive operational data. A later dark web listing tied a campaign called **CanisterWorm** to the same actor set, with a seller using the name **xpl0itrs** claiming to offer data allegedly stolen from **RapidFort**, a container hardening and software supply chain security vendor, for **$40,000**. The unverified listing advertised **569GB** of data across **140,061 files** from **48 S3 buckets**, including hardening pipelines, vulnerability database pipelines, scanner backends, DevOps infrastructure, billing exports, plaintext cloud credentials, Kubernetes `kubeconfig` files, and private keys; if authentic, the exposure could create follow-on intrusion opportunities because RapidFort reportedly operates within customer CI/CD environments and may hold cross-account access into customer cloud estates.
Jul 30, 2026