OSINT Investigation Links Team PCP’s Suspected Leader to Reuben Thompson
· 17:41 · Watch on YouTube ↗
Summary
The video recounts Team PCP’s cloud and software-supply-chain attacks and Flare’s OSINT investigation linking reused accounts and profile images to Reuben Thompson, whom the presenter identifies as the suspected leader and says was arrested.
Key points
- The presenter says Team PCP shifted from opportunistic cloud exploitation to software-supply-chain attacks in 2026.
- A misconfigured GitHub Actions workflow in Aqua Security’s Trivy exposed a service-account token. The video says incomplete credential rotation left attackers access, enabling malicious Trivy releases that poisoned CI/CD pipelines.
- The video says light LLM ran the poisoned Trivy in its build pipeline, exposing its PyPI publishing token; attackers then released two backdoored versions of a package reportedly downloaded about 95 million times monthly.
- Earlier, Team PCP reportedly exploited exposed cloud APIs and services, turning compromised hosts into scanning and proxy nodes and earning money through XMRig mining, proxy rentals, and stolen-data extortion.
- Flare reportedly identified masscan[.]cloud as command-and-control infrastructure during a Minishat worm infection.
- The OSINT walkthrough links Team PCP aliases and online accounts to Reuben Thompson using credential records and matching profile imagery; the presenter says law enforcement confirmed the identity through an arrest.
Article Details
- Topics
- [01:14] Team PCP’s software-supply-chain attacks and the stolen token behind compromises across multiple ecosystems.
- [03:23] The group’s earlier cloud exploitation, botnet activity, and monetization methods.
- [04:55] The Trivy workflow compromise, credential theft, and downstream poisoned releases.
- [05:57] Team PCP aliases and the OSINT process for tracing them.
- [07:02] Using DeadCatX3 to find and connect online accounts.
- [09:57] Searching leaked credentials and related accounts for further identity clues.
- [13:41] Matching Telegram activity and a Steam profile image to strengthen the identity link.
- [15:46] The presenter’s account of law enforcement confirming the identity and the reported arrest.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | masscan[.]cloud | Flare reportedly identified this domain as command-and-control infrastructure during a Minishat worm infection. |
MITRE ATT&CK
T1090 · ProxyCompromised hosts reportedly served as proxy nodes in Team PCP’s scanning and further-infection infrastructure.T1195.002 · Compromise Software Supply ChainThe video describes malicious Trivy releases and backdoored light LLM releases compromising software supply chains and downstream build pipelines.T1496 · Resource HijackingThe video says Team PCP ran XMRig crypto miners on compromised cloud hosts to generate revenue.
Malware
Vendors
Products
Flare platformUsed in the OSINT walkthrough to trace usernames, accounts, credentials, and infrastructure associated with Team PCP.TrivyA misconfigured GitHub Actions workflow associated with this Aqua Security vulnerability scanner exposed a service-account token; malicious releases later poisoned CI/CD pipelines.