# Google's mole inside a hacking gang > A Google undercover analyst infiltrated TeamPCP to monitor their supply-chain attacks from within and help disrupt their campaign. - Title: Google's mole inside a hacking gang · Ars Technica | Shortify - Summary: A Google undercover analyst infiltrated TeamPCP to monitor their supply-chain attacks from within and help disrupt their campaign. Google embedded an… - Keywords: google, teampcp, supply-chain attacks, undercover operation, cybersecurity, malware, open-source software, austin larsen, mandiant, ruben ian thomson, louis michael gaebler, australia - Source: Ars Technica — https://arstechnica.com/security/2026/09/an-undercover-google-analyst-infiltrated-a-notorious-supply-chain-hacking-gang - Published: 2026-09-20T11:07:00+00:00 - Read time: 2 min - Topics: google, teampcp, supply-chain attacks, undercover operation, cybersecurity, malware, open-source software, austin larsen, mandiant, ruben ian thomson, louis michael gaebler, australia ## Hacking gang's unprecedented spree TeamPCP tainted hundreds of open-source programs with malware, stole developer accounts, and deployed a Dune-themed self-spreading worm to breach over a thousand companies. ## Google had a mole inside During TeamPCP's rampage, Google's Mandiant had an undercover analyst embedded in the group's inner circle from almost the beginning, monitoring everything behind the scenes. > One of our personas had been working for many months to build trust with one of the actors that was invited to join TeamPCP. ## Two Australians arrested Ruben Ian Thomson and Louis Michael Gaebler, both in their early 20s, were arrested by Australian police with FBI assistance and charged as principal participants in TeamPCP. ## Cascading supply-chain attacks Starting in spring, TeamPCP compromised Trivy, LiteLLM, Checkmarx, TanStack, and Mistral AI, using each breach to hijack developer credentials and plant malware in other tools. ## Breached major tech companies The cascading attacks ultimately allowed TeamPCP to breach GitHub, Mercor, OpenAI, the European Commission, and many others who remained unnamed in public reporting. ## Mini Shai-Hulud worm TeamPCP deployed a self-spreading worm named after the sandworms in Dune to automate hacking and scale attacks to even more victims. ## Analyst joins the group In March, Google's undercover analyst was invited to join TeamPCP's inner circle of about 12 members with access to their core chat called CanisterWorm. ## Access to stolen credentials Google's mole gained access to a server storing TeamPCP's stolen credentials from victims, including usernames, passwords, and access tokens planned for extortion. ## Disrupting the campaign Google reached out to credential providers like Amazon Web Services and Microsoft to revoke stolen credentials, preventing hackers from exploiting them and disrupting the extortion scheme. > How can we, as quickly as possible, disrupt their campaign before more compromises can happen? ## AI-created zero-day exploit Google learned TeamPCP was using an AI tool to develop a zero-day exploit bypassing two-factor authentication in login software, tested it, and warned the developer to patch the flaw. ## ShinyHunters betrayal TeamPCP partnered with ShinyHunters to monetize stolen data, but ShinyHunters went rogue in April, conducting its own extortions without sharing profits and even sharing TeamPCP's chat logs. ## Mole exposed by betrayal After ShinyHunters taunted TeamPCP on X, the group narrowed its inner circle, moved servers, and exiled ShinyHunters and other members including Google's undercover analyst. > Just delete that and stop sharing shit with shinyhunters. ## Digital detective work Larsen traced a TeamPCP member's handle to the email sheepstealing@gmail.com, then found a 2019 forum dispute linking it to ruben@thomsonfamily.net.au, identifying Thomson. ## Google Drive smoking gun Google discovered TeamPCP's new server was being backed up to a Google Drive on the sheepstealing@gmail.com account, prompting Larsen to tip off the FBI with the evidence. > Why would he be sending all of this illicit, stolen material to a Google Drive that's tied to himself? ## Ethical guardrails maintained Google's undercover analyst never engaged in illegal hacking or encouraged breaches, only observing and staying quiet to avoid suspicion while maintaining ethical boundaries. > They were a fly on the wall, only saying enough to not be suspicious. ## Google's new disruption unit The investigation coincided with Google's launch of its Cyber Disruption Unit, tasked with taking a more aggressive approach to combating cybercrime and state-sponsored hacking. > Writing reports can only be so useful. Taking action to protect users and customers, that is the next step. ## Key takeaway Google embedded an undercover analyst inside a major hacking group's inner circle, allowing real-time monitoring and disruption of their attacks before arrests were made.