Full Report
In other news: Qilin hits US firearms agency; US seizes two more Chinese botnets; CISA says most cyber activity is opportunistic.
Analysis Summary
# Incident Report: TeamPCP Software Supply-Chain Compromise
## Executive Summary
TeamPCP, a sophisticated hacking group, executed a series of high-impact software supply-chain attacks targeting open-source libraries to infect developers and downstream corporate environments. The campaign resulted in the theft of over 500,000 credentials and compromised approximately 2,200 organizations worldwide. The incident concluded with the arrest of two primary suspects in Western Australia following a joint investigation by the AFP and FBI.
## Incident Details
- **Discovery Date:** April 2026 (Official investigation launch)
- **Incident Date:** Ongoing activity since 2020; primary supply-chain campaign early 2026.
- **Affected Organization:** Multiple (including users of Trivy, KICS, LiteLLM, and Telnyx)
- **Sector:** Technology / Open-Source Software
- **Geography:** Global (Suspects based in Australia/South Africa)
## Timeline of Events
### Initial Access
- **Date/Time:** Early 2026
- **Vector:** Compromise of open-source repository maintainer accounts.
- **Details:** Attackers gained unauthorized access to coding libraries (Trivy, KICS, etc.) to inject malicious code.
### Lateral Movement
- **Mechanism:** Self-spreading worm.
- **Details:** Once a developer installed a compromised library, the worm activated on the local machine to harvest credentials and identify other open-source libraries managed by that developer for further propagation.
### Data Exfiltration/Impact
- **Data Stolen:** 500,000+ credentials, including 78,000 specific tokens/secrets from 2,200 organizations.
- **Downstream Impact:** Stolen credentials were used for ransomware deployment, extortion, and unauthorized access to government and corporate networks.
### Detection & Response
- **Detection:** Identified through threat research by firms like Oligo and StepSecurity; traced by Google to South African residential IPs.
- **Response Actions:** Joint operation between Australian Federal Police (AFP) and the FBI; suspects Ruben Thomson and Louis Gaebler arrested in August 2026.
## Attack Methodology
- **Initial Access:** Software Supply Chain (Compromised open-source libraries).
- **Persistence:** Worm-based propagation across developer workstations.
- **Privilege Escalation:** Harvesting high-privilege CI/CD tokens and cloud secrets.
- **Defense Evasion:** Use of self-spreading worms that remain dormant until installation; data dumping to "muddle tracks."
- **Credential Access:** Extraction of stored secrets from developer environments.
- **Discovery:** Automated scanning for cloud and development environment configurations.
- **Lateral Movement:** Automated infection of other managed libraries via the developer's local access.
- **Collection:** Automated gathering of API keys, tokens, and environmental variables.
- **Exfiltration:** Exfiltration to attacker-controlled infrastructure; later dumping data online.
- **Impact:** Ransomware, extortion, and large-scale data leaks.
## Impact Assessment
- **Financial:** Significant (Ransomware payments and remediation costs).
- **Data Breach:** High; 500k+ credentials and thousands of corporate secrets.
- **Operational:** Disruption to open-source project integrity and corporate network security.
- **Reputational:** Massive erosion of trust in the open-source software supply chain.
## Indicators of Compromise
- **Network Indicators:** Traffic to residential/mobile IP addresses in South Africa (Historical).
- **File Indicators:** Malicious self-spreading worm code injected into `Trivy`, `KICS`, `LiteLLM`, and `Telnyx` libraries.
- **Behavioral Indicators:** Unauthorized modifications to open-source repositories; anomalous usage of developer tokens.
## Response Actions
- **Containment:** Removal of malicious code from affected libraries (Trivy, Telnyx, etc.).
- **Eradication:** Revocation of compromised secrets and tokens by affected organizations.
- **Recovery:** Law enforcement intervention resulting in the arrest of group leadership.
## Lessons Learned
- **Key Takeaways:** Developers are high-value targets; a single compromised developer can facilitate a massive supply-chain "force multiplier" effect.
- **Failures:** The long-term activity (since 2020) suggests a need for earlier detection of cloud-based botnets and credential harvesting patterns.
## Recommendations
- **MFA Implementation:** Mandatory Multi-Factor Authentication for all open-source repository maintainers.
- **Secret Scanning:** Implement automated secret scanning to detect and rotate leaked tokens immediately.
- **Environment Isolation:** Use ephemeral, isolated build environments for developers to prevent worms from accessing local credential stores.
- **Software Bill of Materials (SBOM):** Rigorous tracking of third-party dependencies to identify compromised versions quickly.