Australian Police Arrest Two in TeamPCP Supply Chain Hacking Case
Australian Federal Police arrested two men in Perth, Western Australia, on Wednesday, accusing them of membership in TeamPCP, a cybercriminal group behind a far-reaching series of software supply chain attacks that compromised open-source projects and cascaded into breaches at major technology companies and government infrastructure.
The two men face more than a dozen charges spanning hacking, money laundering, and other cybercrime offenses, and were expected to appear in court on Thursday. Police did not name the accused. Independent cybersecurity journalist Brian Krebs reported that one of the arrested individuals is Ruben Thomson, who goes by the hacker handle "Ellis." Ellis told Krebs he was the leader of TeamPCP until March 2026, and Krebs said Ellis made operational mistakes that allowed the journalist to identify him (TechCrunch).
The arrests followed a joint disruption operation by the Australian Federal Police, the FBI, and the Western Australia Police Force (WAPF). Australian officials said their investigation began in April 2026 after receiving information from multiple cybersecurity companies (AFP). A press conference announcing the arrests was held on Wednesday.
FBI Cyber Division chief Brett Leatherman said the two alleged TeamPCP members are accused of hacking into more than a thousand organizations. Authorities said the group stole more than half a million credentials — usernames, passwords, and access keys — to further their attacks into other companies (TechCrunch).
TeamPCP's primary method of operation involved software supply chain attacks. In a supply chain attack, instead of targeting a company directly, attackers compromise a piece of software that the company trusts and uses — often an open-source tool maintained by volunteers or a small team. The attackers secretly modify that tool so that when other companies download and run it, they unknowingly install the attackers' malicious code along with it. This lets the attackers steal credentials and data, and extort victims into paying ransoms. The group was blamed for compromising Trivy, a widely used open-source vulnerability scanner, which affected any company that relied on it, including LiteLLM and AI recruiting startup Mercor (TechCrunch). The Trivy compromise was first reported in March 2026 (Ars Technica).
The supply chain attacks rippled outward with significant downstream consequences. Mercor confirmed it was hit by a cyberattack tied to the compromise of the open-source LiteLLM project. Following that incident, Meta paused work with Mercor over concerns that sensitive AI industry data could have been exposed (Wired). TeamPCP also targeted other open-source projects and developer applications that provided access to tech giants including GitHub and OpenAI (TechCrunch).
The group's reach extended to government infrastructure. TeamPCP was suspected of breaching the European Commission's cloud infrastructure (TechCrunch). In July 2026, the FBI issued a FLASH advisory on TeamPCP that linked the group to a hack of airline third-party vendor Pilot Credentials, resulting in the theft of data from 5,745 pilots and applicants (FBI.
The scale here warrants attention. Over a thousand organizations breached, half a million credentials stolen, and the blast radius extended through the specific mechanism that makes supply chain attacks so destructive: trust in upstream dependencies. When a vulnerability scanner like Trivy is itself compromised, the very tool organizations deploy to detect security issues becomes the vector — the pathway through which an attacker reaches their systems. Every automated build pipeline that pulled the tampered version was potentially affected, and the credentials harvested from those pipelines opened doors to subsequent targets, including GitHub repositories and OpenAI systems.
The open-source ecosystem has grappled with supply chain risk for years, from npm package typosquatting (naming a malicious package to closely resemble a popular one) to the XZ Utils backdoor attempt. TeamPCP's approach was different in its operational breadth: rather than a single poisoned package, the group systematically compromised maintainers' access to widely adopted tools, injected malicious code, and then leveraged the credentials and data stolen from downstream consumers to breach additional organizations. The credential theft functioned as a compounding mechanism, each compromised target feeding into the next.
What remains unclear from the available reporting is whether the two arrests effectively dismantle TeamPCP's operational capability or represent a partial disruption. Ellis claimed to have left his leadership role in March 2026, months before the Australian investigation even began. Whether the group continued operating under different leadership, and whether additional members remain at large, are questions the authorities have not publicly addressed. The FBI's July FLASH advisory, issued two months before these arrests, suggests the group was still considered active and dangerous enough to warrant an industry-wide warning at that point.
For engineering and security teams, the takeaway is not new but is reinforced: the trust model inherent in open-source dependency management — where developers pull in third-party code because they trust the source — remains a live attack surface. Pinning dependencies to specific versions, verifying package integrity through cryptographic signatures, monitoring for behavioral anomalies in build tools, and treating even security tooling as potentially compromised are not paranoid measures but practical responses to a demonstrated threat pattern.
