Australian Authorities Arrest TeamPCP Hackers Following Global Supply Chain Campaign

The arrests of two men in Western Australia follow a campaign that compromised over 1,000 organizations by poisoning open-source tools like Trivy and LiteLLM.

August 27, 2026 · TeamPCP, Supply Chain Attack, Trivy, LiteLLM, Cybercrime

Organizations utilizing open-source software including Trivy, LiteLLM, TanStack, Telnyx, or SAP must treat all exfiltrated data and credentials as persistent risks. According to the FBI, these credentials are likely to be weaponized by affiliated threat actors long after the initial compromise. Defenders should immediately rotate all continuous integration and continuous delivery (CI/CD) secrets, publishing tokens, and cloud credentials that were accessible during the exposure windows.

The FBI further advises defenders to pin GitHub Actions workflows to verified commit SHA hashes rather than using floating version tags. This measure prevents the automated execution of malicious code when a project pulls a compromised update from a public repository.

Arrests and Legal Charges

The Australian Federal Police (AFP), in coordination with the Western Australia Police Force (WAPF) and the FBI, arrested two men from Western Australia on August 26, 2026. The suspects are identified as Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23. According to The Hacker News, both individuals appeared in Perth Magistrates Court on August 27, 2026, facing a combined total of 14 offenses.

Thomson faces eight charges, including unauthorized modification of data with intent to commit a serious offense, supplying and possessing data for computer offenses, dealing with proceeds of crime worth $100,000 or more, and failing to comply with an order to provide device passwords. Gaebler faces six related charges concerning computer hacking and unauthorized data modification. If convicted on all counts, the maximum combined prison sentence is 82 years (56 years for Thomson and 26 years for Gaebler), though sentences for multiple offenses are often served concurrently.

TeamPCP Operations and Supply Chain Tactics

The suspects were identified as principal participants in TeamPCP, a cybercrime syndicate responsible for one of the most significant software supply chain attacks of the past year. The group operated by stealing publishing credentials from trusted open-source projects to push poisoned versions through official release channels. This campaign targeted five major distribution ecosystems: GitHub Actions, Docker Hub, npm, PyPI, and OpenVSX.

The attack methodology functioned as a cyclical exploitation loop. According to Wired, TeamPCP gained access to networks where popular open-source tools were being developed, planted malware in those tools, and then used the resulting access to steal credentials for further projects. For example, attackers compromised the security scanner Trivy (maintained by Aqua Security) and Checkmarx KICS. Because LiteLLM—an AI gateway—installed Trivy without pinning it to a verified version, the poisoned scanner successfully harvested the project’s publishing token. TeamPCP then used that token to distribute backdoored LiteLLM releases in late March 2026.

The group utilized a self-propagating worm framework known as Shai-Hulud and its “Mini” iteration. In May 2026, the group open-sourced the Mini Shai-Hulud framework on GitHub. A subsequent npm wave using this toolkit poisoned keyv and cacheable packages on August 4, 2026.

Scope of Impact

The AFP reports that the campaign potentially compromised more than 1,000 organizations worldwide. The group is estimated to have stolen more than 500,000 credentials and exfiltrated at least 300 gigabytes of data. According to SecurityWeek, these actions resulted in global remediation costs reaching hundreds of millions of dollars.

Data regarding the breadth of the breach varies by source:

• CloudSEK reports that reconstructed exposure includes more than 2,500 organizations and approximately 434,000 CI/CD pipelines.
• Hudson Rock attributes 118,829 CI runner dumps to 2,488 corporate domains from a 153GB archive of exfiltrated data.
• StepSecurity analysis of the CloudSEK dataset identifies GitLab as the most affected platform with 1,064 organizations, followed by GitHub Actions (618), Azure DevOps (233), Jenkins (105), Bitbucket Pipelines (94), and CircleCI (15).

Group Structure and Infrastructure

Security experts describe TeamPCP not as a traditional structured criminal crew but as an amalgamation of threat actors from multiple gangs. According to Austin Larsen of the Google Threat Intelligence Group, it functions as a “peer community of individually-skilled actors” centered around George Prepakis (Twitter/X: @kernelstub).

Prepakis manages a Matrix chat server called “Cybercats,” which members use for daily communications and coordinating supply chain and data ransom attacks. The group has been linked to other entities, including Fulcrumsec (associated with the alias “SeesawSec”). Some TeamPCP-linked infrastructure has been traced back to 2020 by Oligo Security, who connected the activity to previous threat actors known as TA-NATALSTATUS and IronErn.

Next Steps

The AFP stated that further arrests and charges are possible as they continue to forensically examine a large volume of seized electronic devices. Defenders should monitor for the creation of repositories named “tpcp-docs” or “docs-tpcp,” which the FBI identifies as names the worm creates using stolen credentials.

Organizations should also audit their release histories; The Hacker News confirmed that while two malicious LiteLLM builds were removed from PyPI on August 27, they may still return HTTP 200 responses from the CDN at their direct URLs for some time.