Full Report
Australian authorities have arrested and charged two young men accused of belonging to TeamPCP, a hacking group linked to a string of far-reaching developer supply chain attacks. [...]
Analysis Summary
# Incident Report: Operations of TeamPCP Hacking Collective
## Executive Summary
Australian authorities, in coordination with the FBI, have arrested two men linked to TeamPCP, a hacking collective responsible for a series of high-profile developer supply chain attacks. The group specialized in compromising open-source repositories and developer platforms to steal credentials and source code, impacting over 1,000 organizations globally. The operation resulted in the exfiltration of 300GB of data and estimated remediation costs in the hundreds of millions of dollars.
## Incident Details
- **Discovery Date:** April 2026 (Investigation launched)
- **Incident Date:** Ongoing through August 2026
- **Affected Organizations:** Multiple (including Trivy, LiteLLM, Telnyx, SAP, TanStack, European Commission, Mistral AI, OpenAI, and GitHub)
- **Sector:** Technology, Government, Academic, and Private Sector
- **Geography:** Global impact; Suspects based in Western Australia
## Timeline of Events
### Initial Access
- **Date/Time:** Various dates throughout late 2025 and 2026.
- **Vector:** Supply Chain Compromise / Repository Injection.
- **Details:** Attackers injected malicious code into popular open-source software packages (PyPI, npm) and exploited developer platform workflows (GitHub Actions).
### Lateral Movement
- **Details:** Upon successful execution of malicious packages by developers, the actors gained access to internal environments. They used stolen authentication secrets and credentials to move from developer workstations into internal code repositories and cloud environments.
### Data Exfiltration/Impact
- **Details:** The group exfiltrated at least 300GB of sensitive data, including internal source code and proprietary repositories. Approximately 500,000 credentials and authentication secrets were stolen during the campaign.
### Detection & Response
- **Discovery:** Cyber security firms provided key intelligence to the AFP and FBI in April 2026. Online traces, including Telegram activity and reused aliases, helped researchers link digital identities to real-world personas.
- **Response Actions:** A joint task force (AFP, FBI, and WAPF) executed search warrants and arrests on August 26, 2026, in Cottesloe and Mandurah, Australia. Electronic devices were seized for forensic analysis.
## Attack Methodology
- **Initial Access:** Supply chain attacks via malicious injections into open-source repositories (npm/PyPI).
- **Persistence:** Utilization of backdoored packages and stolen authentication tokens.
- **Privilege Escalation:** Not explicitly detailed, but involved the theft of high-level authentication secrets.
- **Defense Evasion:** Use of WAV audio files to hide malware (steganography) and operating through decentralized communication channels like Discord and Telegram.
- **Credential Access:** Infostealers pushed via GitHub Actions and backdoored packages to harvest developer credentials.
- **Discovery:** Reconnaissance of widely used open-source dependencies to identify high-value targets.
- **Lateral Movement:** Using compromised developer secrets to access internal corporate repositories.
- **Collection:** Automated harvesting of environment variables, secrets, and source code.
- **Exfiltration:** Transfer of stolen data to attacker-controlled infrastructure; monetization via cryptocurrency.
- **Impact:** Data theft, financial loss (remediation), and supply chain integrity compromise.
## Impact Assessment
- **Financial:** Estimated remediation costs exceeding hundreds of millions of dollars globally.
- **Data Breach:** 300GB of data stolen; 500,000 credentials compromised.
- **Operational:** Significant disruption to software development lifecycles and emergency patching requirements for affected organizations.
- **Reputational:** High-profile breaches of trusted entities like the European Commission and OpenAI.
## Indicators of Compromise
- **Network indicators:** Activity linked to known TeamPCP Telegram channels and Discord servers (e.g., communication with infrastructure used to host malicious scripts).
- **File indicators:** Backdoored versions of `litellm` (PyPI), `telnyx` (PyPI), and `SAP` (npm) packages.
- **Behavioral indicators:** Unusual outbound traffic from GitHub Actions runners; unauthorized access to internal repos using developer tokens.
## Response Actions
- **Containment:** Removal of malicious packages from public registries (npm, PyPI).
- **Eradication:** Law enforcement seizure of electronic devices and disruption of the primary threat actors in Australia.
- **Recovery:** Global remediation efforts by affected organizations to rotate credentials and audit source code integrity.
## Lessons Learned
- **Supply Chain Vulnerability:** The heavy reliance on unvetted open-source dependencies remains a critical failure point for modern enterprises.
- **OpSec Failures:** The attackers were identified through the reuse of aliases and traces left on social messaging platforms (Telegram/Discord).
- **Developer Targeting:** Developers are high-value targets because their credentials often provide a "keys to the kingdom" path to internal infrastructure.
## Recommendations
- **Software Composition Analysis (SCA):** Implement strict automated scanning of all third-party dependencies for known vulnerabilities and malicious patterns.
- **Secrets Management:** Use short-lived tokens and implement robust secrets scanning to ensure no credentials are hardcoded or leaked in repositories.
- **Environment Isolation:** Use isolated, ephemeral environments for building and testing code to prevent infostealers from accessing local developer machine secrets.
- **Zero Trust:** Implement strict access controls for internal repositories, requiring MFA and verifying the health of the device requesting access.