Full Report
The two men face 14 charges combined. Private researchers traced one suspect through leaked passwords and a decade-old gaming profile. The post Two alleged TeamPCP members arrested and charged after months of software supply-chain chaos appeared first on CyberScoop.
Analysis Summary
# Incident Report: Software Supply-Chain Compromise by TeamPCP
## Executive Summary
Two Australian nationals, Ruben Ian Thomson and Louis Michael Gaebler, were arrested for their alleged roles in "TeamPCP," a cybercriminal syndicate responsible for high-profile software supply-chain attacks. The group injected malicious code into widely used open-source libraries and vulnerability scanners, compromising over 1,000 organizations globally. The campaign resulted in the theft of 500,000 credentials and caused hundreds of millions of dollars in cleanup costs.
## Incident Details
- **Discovery Date:** August 26, 2026 (Arrest Date); Investigative leads surfaced early August 2026.
- **Incident Date:** Active from 2020 through August 2026.
- **Affected Organization:** Multiple (Trivy/Aqua Security, TanStack, UiPath, MistralAI, European Commission, GitHub).
- **Sector:** Software Development, Technology, Government.
- **Geography:** Global impact; suspects based in Perth, Western Australia.
## Timeline of Events
### Initial Access
- **Date/Time:** February 2026 (Trivy incident); Activity dates back to 2020.
- **Vector:** Exploitation of misconfigured workflows and credential theft.
- **Details:** TeamPCP exploited a misconfigured workflow in Aqua Security’s "Trivy" scanner to steal service-account tokens.
### Lateral Movement
- **Details:** After obtaining service tokens, attackers moved within CI/CD pipelines to modify release channels, allowing them to push malicious code to downstream users.
### Data Exfiltration/Impact
- **Details:**
- Exfiltrated over 300 GB of data.
- Stole approximately 500,000 credentials.
- Distributed "mini Shai-Hulud" malware via libraries downloaded millions of times per week.
### Detection & Response
- **Detection:** Private researchers at Flare and Oligo Security traced the group via leaked passwords, a GitHub alias ("DeadCatx3"), and a decade-old gaming profile (Steam).
- **Response Actions:** Joint operation between the Australian Federal Police (AFP), WAPF, and the FBI. Search warrants executed in Perth; electronic devices seized.
## Attack Methodology
- **Initial Access:** Exploiting misconfigured CI/CD workflows; stealing service-account tokens.
- **Persistence:** Maintaining access to software distribution channels and automated build pipelines.
- **Defense Evasion:** Using self-replicating malware ("mini Shai-Hulud") embedded in legitimate development tools.
- **Credential Access:** Theft of service-account tokens and large-scale harvesting of user credentials (500k+).
- **Lateral Movement:** Pivoting from compromised service accounts to downstream software libraries.
- **Exfiltration:** Transferring stolen data to command servers (e.g., masscan[.]cloud).
- **Impact:** Supply-chain contamination causing global operational disruption and financial loss.
## Impact Assessment
- **Financial:** Estimated global cleanup costs in the hundreds of millions of dollars; $100,000+ in criminal proceeds identified for one suspect.
- **Data Breach:** 300 GB of data; 500,000 credentials exposed.
- **Operational:** Disruption to automated build pipelines and software distribution for thousands of organizations.
- **Reputational:** High-profile compromise of trusted open-source tools and government entities (European Commission).
## Indicators of Compromise
- **Network Indicators:** masscan[.]cloud (Defanged: masscan[dot]cloud)
- **Behavioral Indicators:** Unauthorized modifications to GitHub releases; inclusion of "mini Shai-Hulud" malware in library updates.
- **User Personas:** DeadCatx3 (GitHub alias).
## Response Actions
- **Containment:** Aqua Security rotated credentials (though initially incomplete).
- **Eradication:** Law enforcement seizure of command-and-control infrastructure and arrest of primary operators.
- **Recovery:** Forensic testing of seized devices to identify further compromised entities.
## Lessons Learned
- **Credential Hygiene:** Rotating credentials after a breach is insufficient if the audit is not exhaustive (Aqua Security missed some credentials).
- **OPSEC Failures:** The lead suspect was identified through the reuse of passwords across school emails, gaming profiles, and criminal infrastructure.
- **Supply Chain Fragility:** A single misconfigured workflow in a popular tool can have massive downstream consequences.
## Recommendations
- **CI/CD Security:** Implement strict secret management and audit all GitHub Action/Workflow configurations.
- **Open-Source Monitoring:** Use Software Bill of Materials (SBOM) and automated tools to detect unexpected code changes in dependencies.
- **MFA/Password Policy:** Enforce hardware-based MFA to mitigate the impact of credential theft.