Australia Charges Two Men Over Alleged TeamPCP Supply-Chain Campaign

Summary

Two men in Western Australia were charged after a joint investigation into alleged TeamPCP activity involving malicious open-source software. Authorities estimate the code potentially affected 1,000+ organizations and enabled theft of 500,000+ credentials.

Key points

AFP and Western Australia Police charged two men following an investigation conducted alongside the FBI; both are scheduled to appear in Perth Magistrates Court.
Police allege the men were principal participants in a syndicate linked to TeamPCP and received cryptocurrency payments.
Authorities allege malicious code was inserted into open-source software and then distributed to organizations across government, academia and the private sector.
Investigators estimate the code potentially compromised more than 1,000 organizations, with over 500,000 credentials stolen and at least 300 GB of data exfiltrated.
Global remediation costs are estimated in the hundreds of millions of dollars; these figures and the alleged activity have not been presented as independently confirmed.
Devices and other items were seized for forensic examination, and the investigation is ongoing.

Article Details

Event Type: Law-enforcement disruption and charges related to an alleged software supply-chain cybercrime operation.
Impact: Authorities allege malicious code inserted into open-source software was used to compromise more than 1,000 organizations worldwide. The release estimates more than 500,000 credentials were stolen, at least 300 GB of data was exfiltrated, and global remediation costs reached hundreds of millions of dollars. Two men were charged in Western Australia; investigators seized devices and are continuing forensic analysis.