Two men suspected of being members of the notorious cybercrime group TeamPCP have been arrested and charged by Australian authorities.
The suspects, Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23, have been arrested in Perth. They face several charges related to their alleged role in a cybercrime syndicate that is believed to have caused financial losses totaling hundreds of millions of dollars.
Thomson has been charged with five types of offenses related to computer hacking and money laundering. He faces between 3 and 20 years in prison for each charge. Gaebler has been charged with computer hacking, and the most serious counts carry a maximum prison sentence of 5 years.
TeamPCP compromised major software supply chains and developer security tools, including Aqua Security’s Trivy, Checkmarx’s KICS, and PyPI’s LiteLLM, to siphon over 500,000 corporate credentials from compromised CI/CD pipelines.
By hijacking automated build workflows and popular package registries, the group systematically transformed corporate software pipelines into data-harvesting networks, funneling stolen cloud access keys and infrastructure secrets to extortion and ransomware groups.
TeamPCP deployed the Mini Shai-Hulud worm (and likely the original Shai-Hulud) to automate credential theft and self-propagation across package registries at scale.
According to Australian police, the hacker group exfiltrated at least 300 GB of data from more than 1,000 organizations worldwide.
Police have seized devices belonging to Thomson and Gaebler and are working to determine how much money they have earned from their illegal activities.
“A large volume of data seized is being forensically examined and the investigation remains ongoing. Further arrests and charges have not been ruled out,” the Australian Federal Police announced on Thursday.
Related: Admins of Bulletproof Hosting Service Used by Russian Hackers Arrested in Netherlands
Related: Two Scattered Spider Hackers Sentenced to Jail in UK
Related: Third US Security Expert Sentenced to Prison for Helping Ransomware Gang
