Hacking gang's unprecedented spree

TeamPCP tainted hundreds of open-source programs with malware, stole developer accounts, and deployed a Dune-themed self-spreading worm to breach over a thousand companies.

Google had a mole inside

During TeamPCP's rampage, Google's Mandiant had an undercover analyst embedded in the group's inner circle from almost the beginning, monitoring everything behind the scenes.

“One of our personas had been working for many months to build trust with one of the actors that was invited to join TeamPCP.”

Two Australians arrested

Ruben Ian Thomson and Louis Michael Gaebler, both in their early 20s, were arrested by Australian police with FBI assistance and charged as principal participants in TeamPCP.

Cascading supply-chain attacks

Starting in spring, TeamPCP compromised Trivy, LiteLLM, Checkmarx, TanStack, and Mistral AI, using each breach to hijack developer credentials and plant malware in other tools.

Breached major tech companies

The cascading attacks ultimately allowed TeamPCP to breach GitHub, Mercor, OpenAI, the European Commission, and many others who remained unnamed in public reporting.

Mini Shai-Hulud worm

TeamPCP deployed a self-spreading worm named after the sandworms in Dune to automate hacking and scale attacks to even more victims.

Analyst joins the group

In March, Google's undercover analyst was invited to join TeamPCP's inner circle of about 12 members with access to their core chat called CanisterWorm.

Access to stolen credentials

Google's mole gained access to a server storing TeamPCP's stolen credentials from victims, including usernames, passwords, and access tokens planned for extortion.

Disrupting the campaign

Google reached out to credential providers like Amazon Web Services and Microsoft to revoke stolen credentials, preventing hackers from exploiting them and disrupting the extortion scheme.

“How can we, as quickly as possible, disrupt their campaign before more compromises can happen?”

AI-created zero-day exploit

Google learned TeamPCP was using an AI tool to develop a zero-day exploit bypassing two-factor authentication in login software, tested it, and warned the developer to patch the flaw.

ShinyHunters betrayal

TeamPCP partnered with ShinyHunters to monetize stolen data, but ShinyHunters went rogue in April, conducting its own extortions without sharing profits and even sharing TeamPCP's chat logs.

Mole exposed by betrayal

After ShinyHunters taunted TeamPCP on X, the group narrowed its inner circle, moved servers, and exiled ShinyHunters and other members including Google's undercover analyst.

“Just delete that and stop sharing shit with shinyhunters.”

Digital detective work

Larsen traced a TeamPCP member's handle to the email sheepstealing@gmail.com, then found a 2019 forum dispute linking it to ruben@thomsonfamily.net.au, identifying Thomson.

Google Drive smoking gun

Google discovered TeamPCP's new server was being backed up to a Google Drive on the sheepstealing@gmail.com account, prompting Larsen to tip off the FBI with the evidence.

“Why would he be sending all of this illicit, stolen material to a Google Drive that's tied to himself?”

Ethical guardrails maintained

Google's undercover analyst never engaged in illegal hacking or encouraged breaches, only observing and staying quiet to avoid suspicion while maintaining ethical boundaries.

“They were a fly on the wall, only saying enough to not be suspicious.”

Google's new disruption unit

The investigation coincided with Google's launch of its Cyber Disruption Unit, tasked with taking a more aggressive approach to combating cybercrime and state-sponsored hacking.

“Writing reports can only be so useful. Taking action to protect users and customers, that is the next step.”