Two men suspected of being members of the notorious cybercrime group TeamPCP have been arrested and charged by Australian authorities.
Suspects Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23, were arrested in Perth. They face multiple charges related to their alleged role in a cybercrime syndicate that is believed to have caused hundreds of millions of dollars in financial losses.
Thomson was charged with five types of offenses relating to computer hacking and money laundering. He faces between 3 and 20 years in prison for each charge. Gaebler was charged with computer hacking, with the most serious cases punishable by a maximum prison sentence of five years.
TeamPCP compromised key software supply chains and developer security tools, including Aqua Security’s Trivy, Checkmarx’s KICS, and PyPI’s LiteLLM, to siphon over 500,000 enterprise credentials from compromised CI/CD pipelines.
By hijacking automated build workflows and popular package registries, the group systematically turned companies’ software pipelines into data collection networks and funneled stolen cloud access keys and infrastructure secrets to extortion and ransomware groups.
TeamPCP has used the Mini Shai-Hulud worm (and likely the original Shai-Hulud worm) to automate credential theft and self-propagation across packet registries at scale.
According to Australian police, the hacking group stole at least 300GB of data from more than 1,000 organizations worldwide.
Police have confiscated Thomson and Gaebler’s devices and are now investigating how much money they made from their illegal activities.
“A large amount of the seized data is being forensically examined and the investigation is ongoing. Further arrests and charges are not ruled out,” the Australian Federal Police said announced on Thursday.
Related: Administrators of the Bulletproof hosting service used by Russian hackers arrested in the Netherlands
Related: Two scatter spider hackers sentenced to prison in the UK
Related: Third US security expert sentenced to prison for supporting a ransomware gang
