An Undercover Google Analyst Infiltrated a Notorious Supply Chain Hacking Gang
Google revealed a Mandiant undercover analyst infiltrated TeamPCP, letting it warn hundreds of victims and disrupt the gang's supply chain attacks and extortion.
Google Threat Intelligence Group disclosed at LABScon that a Mandiant undercover analyst joined TeamPCP's roughly 12-member inner circle in March 2026, monitoring the group's CanisterWorm chat and its server of stolen credentials. TeamPCP compromised open source projects including Trivy, LiteLLM, Checkmarx infrastructure, TanStack, and Mistral AI, breaching more than a thousand companies with the self-spreading Mini Shai-Hulud worm. Google warned credential providers such as AWS and Microsoft to revoke stolen usernames, passwords, and access tokens, disrupting the group's planned extortion scheme. Alleged leaders Ruben Ian Thomson and Louis Michael Gaebler were arrested in Australia with FBI assistance.
- Mandiant analyst joined TeamPCP's inner circle in March, watching the CanisterWorm chat
- Group compromised Trivy, LiteLLM, Checkmarx, TanStack, and Mistral AI supply chains
- Mini Shai-Hulud worm automated spread, breaching more than 1,000 companies
- Google pushed AWS and Microsoft to revoke stolen credentials, disrupting extortion
- Alleged leaders Thomson and Gaebler arrested in Australia with FBI help
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1078 Valid AccountsT1528 Steal Application Access Token
- Threat actors
- TeamPCPShinyHunters
- Malware
- Mini Shai-Hulud
- Countries
- AustraliaUnited States
From the original article
8 min read at wired.com
TeamPCP pulled off the worst-ever software supply chain hacking spree and breached thousands of companies. Now Google’s threat intelligence group says it had a mole inside the hackers’ inner circle.
By Andy Greenberg · wired.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.