Two men suspected of being members of the notorious cybercrime group TeamPCP have been arrested and charged by Australian authorities.
The suspects, Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23, have been arrested in Perth. They face several charges related to their alleged role in a cybercrime syndicate that is believed to have caused financial losses totaling hundreds of millions of dollars.
Thomson has been charged with five types of offenses related to computer hacking and money laundering. He faces between 3 and 20 years in prison for each charge. Gaebler has been charged with computer hacking, and the most serious counts carry a maximum prison sentence of 5 years.
TeamPCP compromised major software supply chains and developer security tools, including Aqua Security’s Trivy, Checkmarx’s KICS, and PyPI’s LiteLLM, to siphon over 500,000 corporate credentials from compromised CI/CD pipelines.
By hijacking automated build workflows and popular package registries, the group systematically transformed corporate software pipelines into data-harvesting networks, funneling stolen cloud access keys and infrastructure secrets to extortion and ransomware groups.
TeamPCP deployed the Mini Shai-Hulud worm (and likely the original Shai-Hulud) to automate credential theft and self-propagation across package registries at scale.