Full Report
The Australian Federal Police (AFP) has charged two Western Australian men with a combined total of 14 offences over their alleged role in TeamPCP, the cybercrime group behind the March 2026 compromise of the open-source security scanners Trivy and Checkmarx KICS and the AI gateway LiteLLM. Louis Michael Gaebler, 23, and Ruben Ian Thomson, 21, appeared in Perth Magistrates Court on August 27,
Analysis Summary
# Threat Actor: TeamPCP
## Attribution & Identity
* **Identified Individuals:**
* **Louis Michael Gaebler** (23) of Mandurah, Western Australia.
* **Ruben Ian Thomson** (21) of Cottesloe, Western Australia.
* **Group Alias:** TeamPCP
* **Known Associations:** The group was the subject of a joint disruption operation involving the Australian Federal Police (AFP), Western Australia Police Force (WAPF), and the U.S. Federal Bureau of Investigation (FBI).
## Activity Summary
TeamPCP is a cybercrime syndicate responsible for a series of high-profile supply chain compromises in early 2026. Their primary operations focused on poisoning open-source security tools and AI gateways to harvest credentials and gain unauthorized access to downstream organizations. Significant events include:
* **March 2026:** Compromise of the Trivy security scanner ecosystem.
* **March 2026:** Compromise of Checkmarx KICS and AST GitHub Actions.
* **March 2026:** Poisoning of the LiteLLM (AI gateway) Python package.
## Tactics, Techniques & Procedures
* **Supply Chain Attack:** Poisoning widely used open-source security tools and CI/CD actions to infiltrate downstream users.
* **Credential Theft:** Using compromised credentials to gain initial access to repository publishing rights.
* **Force-Pushing Tags:** Overwriting existing GitHub version tags (e.g., 76 tags in `aquasecurity/trivy-action`) with malicious code to ensure users pulling "stable" versions were infected.
* **Malicious Container Images:** Publishing backdoored versions of software to Docker Hub.
* **Persistence via Startup Hooks:** In the LiteLLM attack, the actor used a Python startup hook (`litellm_init.pth`) to execute malicious code automatically whenever any Python process started on the host.
* **Token Hijacking:** Exploiting non-atomic credential rotation windows to maintain access.
* **MITRE ATT&CK IDs:**
* T1195.002 (Supply Chain Compromise: Compromise Software Dependencies and Development Tools)
* T1552 (Unsecured Credentials)
* T1059.006 (Command and Scripting Interpreter: Python)
* T1553.006 (Subvert Trust Controls: Code Signing)
## Targeting
* **Sectors:** Technology, Software Development, Cybersecurity, and AI Research.
* **Geography:** Global (more than 1,000 organizations worldwide potentially compromised).
* **Victims:**
* Aqua Security (Trivy)
* Checkmarx (KICS)
* BerriAI (LiteLLM)
## Tools & Infrastructure
* **Malware:** Custom credential-stealing malware embedded in GitHub Actions and Python packages.
* **Malicious Files:** `litellm_init.pth` (Python startup hook).
* **Platforms Used:** GitHub, Docker Hub, PyPI.
* **CVEs:** CVE-2026-33634 (Trivy ecosystem compromise).
## Implications
The TeamPCP campaign demonstrates the extreme fragility of the software supply chain, specifically targeting the very security tools (scanners) that organizations trust to protect them. By poisoning a security scanner, the actor gained access to the highly sensitive CI/CD environments and secrets of over a thousand organizations. This represents a strategic shift toward "meta-attacks" where the defense infrastructure itself is the vector for mass compromise.
## Mitigations
* **Pinning Actions/Dependencies:** Do not use mutable tags (e.g., `@v1`). Pin GitHub Actions and software dependencies to specific SHA-256 hashes.
* **Atomic Secret Rotation:** Ensure that when credentials are compromised, all tokens are revoked simultaneously to close "rotation windows."
* **Environment Isolation:** Restrict CI/CD runners' access to sensitive environment variables and publish tokens unless explicitly required for a specific step.
* **Monitor Registry Activity:** Audit logs for unauthorized "force-pushes" to repository tags or unexpected releases on Docker Hub and PyPI.