Google reveals undercover analyst infiltrated TeamPCP supply chain hacking gang
This digest was compiled by AI from multiple sources — links to the originals are below.
Google's Threat Intelligence Group revealed that an undercover Mandiant analyst infiltrated the TeamPCP supply chain hacking gang from nearly its first day. The operation allowed Google to monitor the group's attacks, warn breach targets, and help disrupt exploitation attempts. The disclosure came as two alleged TeamPCP leaders were arrested in Australia last month.
Key Facts
- TeamPCP tainted hundreds of open-source programs and breached more than a thousand companies.
- Google's Mandiant subsidiary had an undercover analyst inside TeamPCP's inner circle from almost the beginning.
- Ruben Ian Thomson and Louis Michael Gaebler, Australians in their early 20s, were arrested last month and charged with hacking crimes.
- Google received intelligence from ShinyHunters, a cybercriminal group that later turned on TeamPCP.
Undercover Infiltration
Google Threat Intelligence Group researcher Austin Larsen presented details of the investigation at the LABScon security research conference. Larsen said one of Mandiant's personas had spent months building trust with an actor invited to join TeamPCP, and was added to the group. This allowed Mandiant to watch everything behind the scenes from almost day one of TeamPCP's activity. Google used the access to monitor the hacking spree, warn breach targets, and help disrupt the group's attempts to exploit victims.
TeamPCP's Supply Chain Attacks
TeamPCP repeatedly compromised open source software to hide its malware. The group then hijacked developer credentials to plant malicious code in other widely used tools, creating a repeating cycle. TeamPCP also released a Dune-themed self-spreading worm to automate the process. The group first appeared online in late 2025.
Arrests and Investigation
Ruben Ian Thomson and Louis Michael Gaebler were arrested by Australian police in a joint investigation with FBI assistance. The Australian Federal Police described them as principal participants in TeamPCP, but did not name them due to privacy laws. Google followed a trail of operational security mistakes allegedly made by one of the two Australians and passed identifying details to law enforcement. Google also received intelligence from ShinyHunters, another cybercriminal group that partnered with TeamPCP but later turned on them.
4 sources
Time · lag behind first