Australian Federal Police have charged two Western Australian men with 14 offences tied to TeamPCP, a cybercrime operation that allegedly compromised more than 1,000 organizations globally. Louis Michael Gaebler, 23, and Ruben Ian Thomson, 21, appeared in Perth Magistrates Court on August 27, 2026, a day after authorities raided homes in Cottesloe, Hamilton Hill, and Mandurah and confiscated electronic equipment for analysis. Police say the pair were key members of the group and accepted cryptocurrency payments, the total worth of which remains under review.
The syndicate allegedly stole more than 500,000 credentials and extracted at least 300 gigabytes of information, according to the AFP's statement. The group operated by hijacking publishing credentials from trusted open-source projects and distributing poisoned software versions through the projects' own official channels. The campaign touched five distribution systems—GitHub Actions, Docker Hub, npm, PyPI, and OpenVSX—with each compromised project supplying the credentials used against the next. Credentials lifted during the March 2026 Trivy scanner breach were deployed against Checkmarx KICS actions days afterward, while LiteLLM's build pipeline installed Trivy without locking it to a verified version, allowing the poisoned scanner to capture the project's publishing token and push backdoored LiteLLM releases in late March. CloudSEK estimated that reconstructed exposure reached more than 2,500 organizations and roughly 434,000 CI/CD pipelines, while Hudson Rock tied 118,829 CI runner dumps to 2,488 corporate domains from a 153GB archive of the attackers' own stolen files.
FBI Cyber Division Assistant Director Brett E. Leatherman said the two men are allegedly part of TeamPCP, whose malicious code "potentially compromised more than a thousand organizations worldwide." The FBI issued a July 2 advisory warning that organizations hit by the operation should treat stolen data and credentials as an ongoing threat, since associated actors are "likely to weaponize them long after the initial compromise." The bureau recommended rotating all CI/CD secrets, publishing tokens, and cloud credentials accessible during the exposure windows. The Cottesloe man faces seven charges including possessing data with intent to commit a computer offence, four counts of unauthorized data modification with intent to commit a serious offence, and dealing with crime proceeds worth $100,000 or more, which carries a maximum 20-year sentence. The Mandurah man faces six charges including possessing data with intent and four counts of unauthorized data modification.
The operation worked because supply chain security for open-source software remains fragile—projects often trust floating version tags instead of verified commit hashes, and credential theft at one project creates a domino effect across the ecosystem. LiteLLM sits where an organization's large language model provider keys are consolidated, making it a high-value target for credential harvesting. TeamPCP-linked infrastructure has been traced back to 2020, with Oligo Security tying the group to activity previously tracked as TA-NATALSTATUS and IronErn through overlapping domains, malware deployment paths, and backend infrastructure, though whether that reflects a rebrand or close collaboration "cannot be determined with 100% certainty." The group open-sourced the worm framework used in the Mini Shai-Hulud campaign to GitHub on May 12, 2026, and a fresh npm wave using the same toolkit poisoned the keyv and cacheable packages on August 4, 2026. The FBI advisory instructs defenders to search for repositories named tpcp-docs and docs-tpcp, which the worm creates using stolen credentials, and to pin all GitHub Actions workflows to verified commit SHA hashes rather than floating version tags. CloudSEK noted that credential theft doesn't prove a company was successfully breached, and the confirmed victim count stands at 16 organizations TeamPCP published on its leak site as of late March. The arrests signal a rare enforcement success against supply chain attackers, but the sheer volume of exposed credentials means downstream risk will persist for years. Organizations that rely on open-source tooling face a choice between convenience and verification, and the TeamPCP case shows that skipping version pinning can hand attackers the keys to an entire infrastructure stack.