Two alleged TeamPCP members arrested and charged after months of software supply
Australian Federal Police, with FBI support, arrested two alleged TeamPCP members behind supply-chain attacks that compromised over 1,000 organizations.
The AFP charged two Western Australian men, identified by media as Ruben Ian Thomson (21) and Louis Michael Gaebler (23), with 14 combined offences including unauthorized data modification and dealing in criminal proceeds. TeamPCP is blamed for poisoning open-source software releases including Trivy, LiteLLM, and the mini Shai-Hulud worm campaign, exposing over 500,000 credentials and at least 300 GB of data. Victims included the European Commission and GitHub, with remediation costs estimated in the hundreds of millions of dollars. Researchers from Flare traced one suspect through leaked passwords, a GitHub alias, and a Steam profile.
- Two men face 14 combined charges after AFP, WAPF, and FBI joint investigation
- TeamPCP compromised 1,000+ organizations, stole 500,000+ credentials and 300 GB of data
- Malicious Trivy release placed malware in thousands of automated build pipelines
- Investigator traced suspect via GitHub alias DeadCatx3 and a decade-old gaming profile
- Further arrests have not been ruled out; devices seized for forensic testing
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1552.001 Credentials In FilesT1539 Steal Web Session CookieT1098.001 Additional Cloud Credentials
- Threat actors
- TeamPCP
- Malware
- mini Shai-Hulud
- Victims
- European CommissionGitHub
- Countries
- Australia
From the original article
4 min read at cyberscoop.com
The two men face 14 charges combined. Private researchers traced one suspect through leaked passwords and a decade-old gaming profile. The AFP charged the men yesterday (26 August, 2026) with a combined total of 14 offences after executing search warrants in Perth with WAPF, and the assistance of the FBI.
By @gregotto · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.