An undercover Google analyst infiltrated a notorious supply-chain hacking gang
Google's Mandiant planted an undercover analyst inside TeamPCP, the supply-chain gang that breached 1,000+ companies via poisoned open-source packages before two Australian arrests.
Google Threat Intelligence revealed at SentinelOne's LABScon that an undercover Mandiant analyst joined TeamPCP's inner ~12-member 'CanisterWorm' chat in March, monitoring the gang's cascading supply-chain attacks from day one. TeamPCP tainted open-source tools including Trivy, LiteLLM, Checkmarx infrastructure, TanStack, and Mistral AI, cascading into breaches of GitHub, Mercor, OpenAI employee devices, the European Commission, and over a thousand companies, amplified by the self-spreading 'Mini Shai-Hulud' worm. Google accessed the group's stolen-credential server and sent hundreds of notifications to providers like AWS and Microsoft to revoke credentials and disrupt the planned extortion. Following Google's tip-off from the actor's operational security mistakes and intelligence from a turned ShinyHunters partnership, two Australians in their early 20s, Ruben Ian Thomson and Louis Michael Gaebler, were arrested with FBI assistance and charged as 'principal participants'.
- Mandiant undercover analyst joined TeamPCP's inner 'CanisterWorm' chat from nearly day one, monitoring the campaign internally.
- TeamPCP tainted Trivy, LiteLLM, Checkmarx, TanStack, and Mistral AI, cascading into breaches at 1,000+ companies.
- Google notified AWS, Microsoft, and hundreds of victims to revoke stolen credentials and preempt the extortion scheme.
- ShinyHunters, a former TeamPCP partner, turned on the group and supplied intelligence to Google.
- Two Australians in their early 20s were arrested and charged by Australian police with FBI assistance.
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1078 Valid AccountsT1528 Steal Application Access TokenT1657 Financial Theft
- Products
- Mini Shai-Hulud
- Threat actors
- TeamPCPShinyHunters
- Malware
- Mini Shai-Hulud
- Countries
- Australia
From the original article
8 min read at arstechnica.com
Google’s threat intelligence group said it had a mole inside TeamPCP's inner circle.
By Andy Greenberg, WIRED.com · arstechnica.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.