Summary
- The AFP arrested Ruben Ian Thomson, 21, of Cottesloe, and Michael Gaebler, 23, in Perth over alleged involvement in the TeamPCP cybercrime collective, which embedded malicious code in hundreds of open-source packages.
- TeamPCP’s self-propagating worm, Shai-Hulud, harvested developer credentials from public repositories including GitHub and NPM, enabling a cyclical supply chain compromise campaign affecting thousands of organisations globally.
- A March 2026 attack on open-source AI gateway LiteLLM reportedly exposed cloud service keys and secrets from more than 2,500 organisations, including major technology companies.
- Thomson’s arrest followed a trail of operational security failures, including reusing his cybercrime handle as a registered company name and linking his real identity to a HackerOne profile.
- Both men were denied bail and are remanded in custody until a September 18 court appearance; they face a combined 14 cybercrime charges.
The Arrests
The Australian Federal Police on Wednesday arrested two men from Western Australia in connection with TeamPCP, a cybercrime collective that authorities allege created and distributed malicious open-source software to compromise thousands of organisations worldwide. ABC News in Australia confirmed the two individuals as Ruben Ian Thomson, 21, of Cottesloe, a beachside suburb of Perth, and Michael Gaebler, 23, also of Perth. Both men were denied bail and will remain in custody until their next court appearance on 18 September. Together they face 14 cybercrime offences.
What TeamPCP Did
TeamPCP emerged in late 2025 by embedding malicious code into hundreds of open-source software tools. The group’s core mechanism was a self-propagating worm called Shai-Hulud, which spread by stealing credentials from developers who used public repositories such as GitHub and NPM. Once inside a developer’s environment, the malware allowed TeamPCP to publish poisoned versions of legitimate tools, which then infected other developers’ machines — and so the cycle repeated. Security researcher Andy Greenberg, writing for Wired, characterised the tactic as a form of cyclical exploitation of the software development ecosystem.
Scale and Impact
The scope of compromise was significant. In March 2026, TeamPCP targeted LiteLLM, an open-source AI gateway used to connect applications to more than 100 large language models. Analysis by CloudSEK found that attack harvested cloud service keys and credentials from more than 2,500 organisations, including prominent technology companies. Separately, TeamPCP claimed responsibility for compromising at least 3,800 code repositories on GitHub after a GitHub developer installed a compromised code extension. The group also ran a recruitment contest in mid-2025, offering cryptocurrency prizes to outside participants based on the download volume of packages they could poison — a deliberate strategy to identify talent and acquire malicious access at scale, according to threat intelligence firm Dataminr.
Who Is Behind TeamPCP
Security experts, including analysts at Google Threat Intelligence Group, describe TeamPCP not as a structured criminal organisation but as a peer community of individually skilled actors. The group communicated through a Matrix server called Cybercats, administered by a security researcher using the handle kernelstub. The Cybercats roster also included handles linked to separate criminal entities: one associated with data stolen from multiple automotive manufacturers and from Snapchat and SportRadar; another linked to extortion attacks against Novo Nordisk, LexisNexis, and Fortune 500 distributor Avnet.
How Thomson Was Identified
Thomson’s operational security failures were numerous and ultimately decisive. He registered on HackerOne — a legitimate bug bounty platform — under his real name, Ruben Thomson, using the handle Deadcatx3, an alias multiple security firms had already attributed to TeamPCP. He also incorporated a company in Australia under the name OPSEC Express, using a cybercrime forum nickname as part of the registered business name. A chain of reused email addresses, shared IP addresses, forum handles, and business registrations connecting his family’s Perth internet infrastructure to cybercrime forum accounts dating to 2018 allowed investigators and researchers to reconstruct his identity. KrebsOnSecurity reports it identified Thomson in June 2026 and interviewed him via Signal, during which he acknowledged his activities, expressed no remorse, and said he would accept the consequences of arrest.
An Unstructured But Consequential Threat
Charlie Eriksen, a security researcher at Aikido Security who tracked TeamPCP’s campaigns, noted that the group defies conventional threat-actor categorisation. They were not a state actor, not a traditional organised crime syndicate, and not purely ideologically motivated. Eriksen also observed that large language models have materially compressed the knowledge gap between reading about an attack technique and being able to operationalise it — allowing actors with limited experience to run campaigns at significant scale while making careless mistakes that professional criminal groups would avoid. Paradoxically, Eriksen noted, TeamPCP’s broad success at poisoning software packages prompted GitHub to introduce new security safeguards, including a three-day cooldown mechanism for its Dependabot tool, and spurred similar protective measures across Python and JavaScript ecosystems.
Why it matters
For CISOs, TeamPCP demonstrates that open-source dependencies remain a high-value attack surface requiring active governance, not passive trust. The group’s cyclical credential-theft model means that a single compromised developer account can propagate poisoned packages across thousands of downstream organisations before detection. The LiteLLM compromise illustrates particular exposure in AI infrastructure, where teams may be integrating open-source gateways and model connectors faster than security controls are being applied. The arrests confirm that law enforcement can and does act on this class of threat, but the collective’s distributed, peer-based structure means disruption of two individuals is unlikely to end the broader campaign.
What to do now
- Audit open-source dependencies for packages tied to GitHub, NPM, PyPI, and other public repositories, prioritising those with recent unexpected version updates.
- Enable or enforce cooldown periods for automated dependency update tools such as Dependabot, in line with GitHub’s newly introduced three-day mechanism.
- Require multi-factor authentication on all developer accounts with publish rights to internal or public code repositories.
- Review cloud service credentials and API keys that may have been exposed to AI gateway tools such as LiteLLM, particularly for organisations using it prior to March 2026.
- Treat AI infrastructure integrations — including open-source LLM connectors — as requiring the same supply chain scrutiny applied to other third-party software components.
