Australia Arrests and Charges Two Suspected TeamPCP Members
Summary
Australian authorities arrested and charged two men suspected of TeamPCP involvement. Police say the group exfiltrated at least 300 GB of data from over 1,000 organizations; seized devices are under forensic examination.
Key points
- Ruben Ian Thomson and Louis Michael Gaebler were arrested in Perth and charged with offenses including computer hacking; Thomson also faces money-laundering charges.
- The FBI describes Thomson as the alleged leader of TeamPCP.
- The article says TeamPCP compromised software supply chains and developer tools, including Trivy, KICS and LiteLLM, to steal credentials from CI/CD pipelines.
- Australian police say the group exfiltrated at least 300 GB of data from more than 1,000 organizations; the investigation is ongoing.
- Police seized devices belonging to the suspects and are examining a large volume of data. Further arrests and charges have not been ruled out.
Article Details
- Event Type
- Australian authorities arrested and charged two men suspected of belonging to TeamPCP.
- Impact
- Australian police say TeamPCP exfiltrated at least 300 GB of data from more than 1,000 organizations worldwide. The group is also reported to have stolen over 500,000 corporate credentials from compromised CI/CD pipelines and caused financial losses believed to total hundreds of millions of dollars.
MITRE ATT&CK
People
Threat Actors
Malware
ChainDropTeamPCP deployed the Mini Shai-Hulud worm (and likely the original Shai-Hulud) to automate credential theft and self-propagation across package registries at scale.Shai-HuludTeamPCP deployed the Mini Shai-Hulud worm (and likely the original Shai-Hulud) to automate credential theft and self-propagation across package registries at scale.
Vendors
Aqua SecurityTeamPCP compromised major software supply chains and developer security tools, including Aqua Security’s Trivy, Checkmarx’s KICS, and PyPI’s LiteLLM, to siphon over 500,000 corporate credentials from compromised CI/CDCheckmarxcompromised major software supply chains and developer security tools, including Aqua Security’s Trivy, Checkmarx’s KICS, and PyPI’s LiteLLM, to siphon over 500,000 corporate credentials from compromised CI/CD
Products
KICSmajor software supply chains and developer security tools, including Aqua Security’s Trivy, Checkmarx’s KICS, and PyPI’s LiteLLM, to siphon over 500,000 corporate credentials from compromised CI/CD pipelines.LiteLLMchains and developer security tools, including Aqua Security’s Trivy, Checkmarx’s KICS, and PyPI’s LiteLLM, to siphon over 500,000 corporate credentials from compromised CI/CD pipelines.TrivyTeamPCP compromised major software supply chains and developer security tools, including Aqua Security’s Trivy, Checkmarx’s KICS, and PyPI’s LiteLLM, to siphon over 500,000 corporate credentials from compromised CI/CD