Two Australians Arrested and Charged Over Alleged TeamPCP Role
Summary
Australian authorities arrested and charged two men over alleged TeamPCP ties. The group is linked to malicious releases in Trivy and other open-source software; the campaign reportedly affected more than 1,000 organizations.
Key points
- Two men in Western Australia were arrested and charged; Australian authorities allege they were part of TeamPCP. Media identified them as Ruben Ian Thomson and Louis Michael Gaebler, but authorities did not formally name them.
- The charges include alleged unauthorized data modification, dealing in criminal proceeds, and refusal to provide device passwords.
- Investigators link TeamPCP to a malicious Trivy release that entered automated build pipelines after the group allegedly stole a service-account token.
- The campaign reportedly affected more than 1,000 organizations. Investigators estimate it exposed over 500,000 credentials and removed at least 300 GB of data.
- In May, self-replicating mini Shai-Hulud malware reportedly targeted software libraries including TanStack, UiPath, and MistralAI, embedding credential-stealing code in development tools.
- Flare assessed with high confidence that Thomson ran TeamPCP and said it confirmed its findings with law enforcement.
Article Details
- Event Type
- Arrests and criminal charges related to an alleged software supply-chain cybercrime campaign.
- Impact
- The campaign allegedly compromised more than 1,000 organizations worldwide. Investigators estimate it exposed more than 500,000 credentials, removed at least 300 gigabytes of data, and caused global cleanup costs in the hundreds of millions of dollars.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | masscan[.]cloud | Domain identified by researchers as a command server for mini Shai-Hulud. |
MITRE ATT&CK
People
Brett LeathermanAssistant director of the FBI’s Cyber Division; commented on the alleged TeamPCP members and the campaign’s potential impact.Charlie EriksenLead malware researcher at Aikido Security; commented on the arrests and the continuing risk to open-source software.Louis Michael GaeblerAustralian media identified him as an alleged TeamPCP member; he was arrested and charged.Ruben Ian ThomsonAustralian media identified him as an alleged TeamPCP member; Flare assessed with high confidence that he ran the group and linked him to the online alias DeadCatx3.
Threat Actors
Malware
Vendors
Products
MistralAIknown as “mini Shai-Hulud” targeted prominent software libraries, including TanStack, UiPath, and MistralAI, embedding credential-stealing code into development tools downloaded millions of times a week.TanStackof self-replicating malware known as “mini Shai-Hulud” targeted prominent software libraries, including TanStack, UiPath, and MistralAI, embedding credential-stealing code into development tools downloaded millions ofTrivyInvestigators say the campaign involved Trivy, mini Shai-Hulud, and stolen credentials, while law enforcement and researchers continue to trace the group’s infrastructure and online identities.UiPathmalware known as “mini Shai-Hulud” targeted prominent software libraries, including TanStack, UiPath, and MistralAI, embedding credential-stealing code into development tools downloaded millions of times a