Australia arrests two TeamPCP members after months of supply-chain attacks

Australian Federal Police arrested two men in Western Australia on Wednesday and charged them for their alleged roles in TeamPCP, the cybercrime group that spent most of 2026 injecting malicious code into widely used open-source packages. Australian media identified the men as Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23. Thomson faces eight charges, including four counts of unauthorized data modification, dealing in criminal proceeds worth $100,000 or more, and refusal to comply with an order to hand over device passwords. Gaebler faces six related counts. The arrests were coordinated with the FBI and the Western Australia Police Force. "These men are allegedly members of the cybercriminal group TeamPCP, whose malicious code potentially compromised more than a thousand organizations worldwide," said Brett Leatherman, assistant director of the FBI's Cyber Division.

That's what makes Wednesday's action significant: arrests of supply-chain operators are rare to the point of nonexistent. In February, TeamPCP exploited a misconfigured workflow in Trivy, Aqua Security's vulnerability scanner, and stole a service-account token. Aqua replaced its credentials but missed some. On March 19, the group pushed a malicious Trivy release through every distribution channel at once, planting malware inside thousands of automated build pipelines. Downstream victims included the European Commission and GitHub. Investigators estimate the campaign exposed more than 500,000 credentials and removed at least 300 gigabytes of data; global cleanup costs run into the hundreds of millions of dollars. A May campaign using self-replicating "mini Shai-Hulud" malware compromised prominent libraries including TanStack's React Router, which clocks 12 million weekly downloads. Oligo Security later published research tracing TeamPCP's activity back to 2020.

The break in the case came from old-fashioned OSINT. Researchers at Canadian threat intelligence firm Flare traced Thomson through a GitHub alias, DeadCatx3, to a bug-bounty account, a domain that served as command server for mini Shai-Hulud, and, through a password tied to a school email, to a personal Google account and a Steam profile featuring a cat seated before several monitors. The same cat image appeared on a TeamPCP Telegram identity. Flare assessed with high confidence that Thomson ran the group and confirmed its findings with law enforcement.

The arrests won't make supply-chain attacks disappear. "The conditions that produced them haven't gone away, so there will be another TeamPCP," Charlie Eriksen, lead malware researcher at Aikido Security, told CyberScoop. "We just don't know their name yet." But coordinated international enforcement against active operators, rather than after-the-fact indictments of groups already beyond reach, changes the cost calculation for anyone running software-dependency attacks. The open question now is whether Australian courts will allow extradition to the US or EU, and whether asset seizure can offset even a fraction of the cleanup costs TeamPCP allegedly inflicted.