> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Risky Bulletin: Two TeamPCP members arrested in Australia
- URL: https://f4n6.co.uk/security-feed/risky-bulletin-two-teampcp-members-arrested-in-australia/
- Published: 2026-08-28T08:46:14.000Z
- Updated: 2026-08-28T08:46:14.000Z
- Author: Jeff Davies
- Tags: #security-feed, TeamPCP

## 1\. Executive summary

On 26 August 2026, the Australian Federal Police (AFP), assisted by the FBI, arrested two men in Perth, Western Australia — Ruben Thomson, 21 (alleged leader) and Louis Gaebler, 23 — identified as principal participants in TeamPCP (MITRE G1056). The group conducted the longest-running spree of software supply-chain attacks on record, compromising open-source projects including Trivy, KICS, LiteLLM, and Telnyx using a self-propagating worm dubbed "Shai-Hulud." The campaign stole more than 500,000 credentials from over 1,000 organisations globally, exfiltrated at least 300 GB of data, and caused estimated remediation costs in the hundreds of millions of dollars. EMEA financial services firms that consumed compromised open-source packages or whose developer credentials were exposed in the July 2026 leak of 78,000+ TeamPCP tokens face ongoing risk of follow-on intrusion, extortion, and ransomware.

## 2\. Regulatory framing

| Article                                                 | Trigger (the fact in this item)                                                                                                                                                                  | Practical impact                                                                                                                                                                    |
| ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DORA Art. 28: ICT third-party risk — general principles | TeamPCP compromised open-source dependencies (Trivy, KICS, LiteLLM, Telnyx) that EMEA financial institutions may consume as ICT third-party services/components, creating supply-chain exposure. | Firms must review open-source dependency intake and third-party software composition analysis controls; assess whether compromised packages are present in the ICT asset inventory. |
| NIS2 Art. 21(2)(d): supply chain security measures      | The attack vector was exclusively supply-chain: malicious code injected into open-source libraries that propagated to downstream developer environments via the Shai-Hulud worm.                 | In-scope NIS2 entities must evaluate whether their supply-chain security measures adequately address open-source package integrity verification and developer credential hygiene.   |

## 3\. Technical analysis & attack chain

TeamPCP (MITRE G1056) operated as a decentralised peer community of individually-skilled actors rather than a structured criminal crew, according to Google Threat Intelligence Group analyst Austin Larsen (single-sourced; verify before enforcement). The group's operational history traces back to at least 2020, when infrastructure and techniques consistent with TeamPCP members were observed in a crypto-mining botnet targeting cloud servers, per an Oligo investigation.

### Attack chain — confirmed steps

1. **Initial compromise of open-source maintainer credentials.** TeamPCP phished or stole developer credentials at public code repositories (GitHub, NPM) to gain publish access to legitimate open-source packages. Compromised projects included Trivy (open-source scanner), KICS, LiteLLM (AI gateway connecting users to 100+ LLMs), and Telnyx.
2. **Injection of the Shai-Hulud worm.** Malicious code was embedded into the compromised open-source packages. The worm was designed to remain dormant until the library was installed on a developer's machine.
3. **Activation on developer endpoints.** Upon installation, Shai-Hulud activated to steal credentials stored on the local system — including cloud service keys, GitHub tokens, and other secrets — and to propagate itself into other open-source libraries managed by the infected developer. This created a cyclical exploitation pattern: each infected developer became a new vector to compromise additional packages.
4. **Credential harvesting at scale.** The group accumulated more than 500,000 stolen credentials. The LiteLLM compromise alone harvested cloud service keys and secrets from more than 2,500 organisations, including major technology companies, per CloudSEK analysis.
5. **Downstream exploitation.** Stolen credentials were used to access corporate networks or sold to other threat actors. Some victims were hit with ransomware; others were extorted or had data published online. In at least one instance, the Shai-Hulud worm wiped environments "out of spite" if it failed to establish persistence.
6. **Scale of impact.** The AFP estimates more than 1,000 organisations globally were potentially compromised, with at least 300 GB of data exfiltrated. A GitHub compromise in May 2026 saw at least 3,800 code repositories affected after a developer installed a compromised code extension.
7. **Credential leak (July 2026).** More than 78,000 tokens and secrets from nearly 2,200 organisations leaked online. This may have been an attempt to muddle attribution as law enforcement pressure increased.
8. **Recruitment via contest.** In May 2026, TeamPCP published the source code for the third iteration of Shai-Hulud and launched a contest offering $1,000 in Monero (XMR) for the largest supply-chain operation using the worm's code. Per Dataminr, this functioned as talent identification and malicious access acquisition at scale, with TeamPCP stating intent to purchase all meaningful access harvested by participants.

**Attribution caveat:** The verified reference data confirms TeamPCP as MITRE G1056\. The two arrested individuals are alleged members; charges have not been tested in court. The AFP statement notes that "further arrests and charges have not been ruled out," and the investigation remains ongoing with forensic examination of seized devices.

## 4\. Mitigation & containment

### P1 — Within 24 hours

- **Audit for compromised packages.** Check dependency manifests (package.json, requirements.txt, go.mod, Pipfile, etc.) for any versions of Trivy, KICS, LiteLLM, or Telnyx that were published during the known compromise windows. Pull package publication histories and compare against known-clean versions. Isolate any suspect packages from build pipelines.
- **Rotate exposed credentials.** If the organisation appears in the list of 2,200 entities affected by the July 2026 credential leak, immediately rotate all exposed tokens, API keys, cloud service keys, and GitHub/NPM credentials. Revoke and reissue rather than attempting to scope individual token validity.
- **Review GitHub/NPM audit logs.** Search for anomalous package publication events, new SSH/PGP key additions, or unauthorised access from South African residential/mobile IP ranges (Google traced TeamPCP activity to such addresses per CyberScoop, June 2026).

### P2 — Within 72 hours

- **Implement package integrity verification.** Enforce subresource integrity checks, signed package verification, and pinning to known-good hashes across all CI/CD pipelines. Block installation of unsigned or newly published package versions without manual review.
- **Scan developer machines for Shai-Hulud artefacts.** The worm activates upon library installation and searches for credentials; inspect developer workstations and build agents for unexpected network connections to unknown endpoints, unauthorised package modifications, or suspicious post-install scripts in node\_modules / site-packages.
- **Review cloud access patterns.** Search cloud provider logs (AWS CloudTrail, Azure Activity Log, GCP Audit Logs) for access using tokens that may have been harvested via the LiteLLM compromise, focusing on the March 2026 onward timeframe.

### P3 — Within 7 days

- **Enforce least-privilege on developer credentials.** Ensure GitHub/NPM tokens are scoped, time-limited, and rotated on a schedule. Remove broad-scope tokens from CI/CD systems; replace with workload identity or OIDC-based authentication where supported.
- **Conduct retrospective fraud/security review.** Cross-reference the 78,000 leaked tokens against internal secret management systems (Vault, AWS Secrets Manager, Azure Key Vault) to identify any credentials that were present in the leak but not yet rotated.
- **Supply-chain threat briefing.** Brief development teams on the Shai-Hulud worm's propagation mechanism and the risk of installing unverified open-source packages, particularly those published immediately after a maintainer credential compromise.

## 5\. Indicators of compromise

No atomic indicators of compromise (IPs, domains, hashes, file paths) are available in the source material. The sources describe the worm by name ("Shai-Hulud") and its behavioural patterns but do not publish specific IOCs such as C2 domains, file hashes, or registry keys.

### Behavioural indicators

| Behaviour                                                                                                           | Where to observe                                                      | Confidence                                       |
| ------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------- | ------------------------------------------------ |
| Post-install script execution in npm/PyPI packages that attempts credential discovery on the local system           | EDR on developer workstations and build agents; npm/PyPI install logs | High — corroborated across multiple sources      |
| Unauthorised package publication to GitHub/NPM using a maintainer's credentials, followed by injection of worm code | GitHub/NPM audit logs; package registry publication timestamps        | High — confirmed attack pattern                  |
| Mass credential exfiltration from developer environments (cloud keys, GitHub tokens, API secrets)                   | Egress network monitoring; cloud provider secret access logs          | High — confirmed by CloudSEK and AFP             |
| Wiping of development environment after failed persistence attempt                                                  | EDR; filesystem integrity monitoring                                  | Medium — single-sourced to The Register          |
| Network connections from South African residential/mobile IP addresses to developer infrastructure                  | Network firewall/IDS logs; cloud provider geo-IP filtering alerts     | Medium — single-sourced to CyberScoop via Google |

## 6\. Detection

Insufficient indicators to author detection rules. The source material does not contain specific file hashes, C2 domains, command-line strings, mutex names, registry keys, or other artefacts suitable for YARA or Sigma rule construction. The worm name "Shai-Hulud" is an actor-assigned label, not a threat artefact embedded in malicious files or traffic, and cannot be used as a reliable detection string.

## Threat actor context

**TeamPCP** · [G1056](https://attack.mitre.org/groups/G1056?ref=f4n6.co.uk) · aka PCPCat, ShellForce, DeadCatx3, SHADOW-WATER-058, UNC6780

[TeamPCP](https://attack.mitre.org/groups/G1056?ref=f4n6.co.uk) is a financially-motivated, cloud-native threat group that has been active since at least September 2025\. Initially focused on ransomware and cryptocurrency theft, [TeamPCP](https://attack.mitre.org/groups/G1056?ref=f4n6.co.uk) shifted in early 2026 to systematic, worm-driven credential theft and software supply chain attacks targeting Continuous Integration and Continuous Delivery (CI/CD) workflows. …

## 7\. Sources

- Risky Business News, "Risky Bulletin: Two TeamPCP members arrested in Australia," https://news.risky.biz/risky-bulletin-two-teampcp-members-arrested-in-australia/, 2026-08-28
- Krebs on Security, "Two Alleged 'TeamPCP' Hackers Arrested in Australia," https://krebsonsecurity.com/2026/08/two-alleged-teampcp-hackers-arrested-in-australia/, 2026-08-28
- The Register, "Australian cops cuff alleged TeamPCP masterminds," https://www.theregister.com/security/2026/08/28/australian-cops-cuff-alleged-teampcp-masterminds/5293157, 2026-08-28
- Help Net Security, "Two alleged TeamPCP hackers arrested over global supply chain attacks," https://www.helpnetsecurity.com/2026/08/27/alleged-teampcp-hackers-arrested-australia/, 2026-08-27

## 8\. Adverse Trace position

This is a high-impact law-enforcement action against a group (MITRE G1056) responsible for the most sustained series of open-source supply-chain attacks on record. The arrests are significant but do not neutralise the threat: TeamPCP operated as a decentralised peer community, the Shai-Hulud worm source code is public, and a recruitment contest has likely onboarded additional actors who may continue operations independently. The July 2026 leak of 78,000+ credentials from 2,200 organisations creates an active, time-sensitive exposure window — any EMEA financial services firm whose tokens are in that dataset faces imminent risk of follow-on intrusion by parties who acquired the leaked credentials. We assess the residual risk to EMEA financial services as **high** despite the arrests. Adverse Trace will monitor for publication of specific IOCs from seized devices, track the AFP's stated possibility of further arrests, and alert clients if their domains or credentials appear in extensions of the leaked credential dataset. Clients should prioritise the P1 actions in §4 immediately.

---

[Read the original source →](https://news.risky.biz/risky-bulletin-two-teampcp-members-arrested-in-australia/?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*