TeamPCP: Open-Source Software Supply Chain Campaign

A joint international operation led by the Australian Federal Police (AFP), the FBI, and the Western Australia Police Force (WAPF) has resulted in the arrest of two key members of the TeamPCP cybercrime group. The group specialized in high-impact supply chain attacks by injecting malicious code into widely utilized open-source software repositories. This technique facilitated large-scale credential theft, successfully exfiltrating over 500,000 user and organizational credentials from a global victim base. The arrests target Ruben Thomson, the alleged group leader, and Louis Gaebler, marking a significant disruption to a major global threat actor responsible for one of the most damaging hacking campaigns of the current year.

• Incident Overview: Multi-Agency Law Enforcement Action
  • Coordinated operation involving the AFP, FBI, and WAPF.
  • Targeted arrests executed in Cottesloe and Mandurah, Western Australia.
  • Focused on dismantling the operational capacity of the TeamPCP group.
• Attack Vector: Software Supply Chain Poisoning
  • Utilization of "poisoning" tactics within the open-source software ecosystem.
  • Injection of malicious code into legitimate software libraries to compromise downstream users.
  • Exploitation of trusted software update mechanisms to bypass organizational perimeters.
• Threat Group Profile: TeamPCP Capabilities
  • Alleged leadership by 21-year-old Ruben Thomson.
  • Identified as a high-scale threat actor responsible for massive global breaches.
  • Specialization in automated, high-volume credential harvesting.
• Impact Scale: Mass Credential Exfiltration
  • Successful exfiltration of over 500,000 sets of user and organizational credentials.
  • Global impact affecting diverse organizations through compromised dependencies.
  • Primary objective achieved through sophisticated malicious code injections.
• Conclusion: Defense and Strategic Implications
  • Highlights the critical systemic risk posed by unvetted open-source dependencies.
  • Demonstrates the necessity of international law enforcement and intelligence collaboration.
  • Underscores the requirement for enhanced Software Bill of Materials (SBOM) and dependency integrity auditing.