Before two of its alleged core members were arrested in Australia following a joint international investigation, the cybercriminal collective known as TeamPCP executed one of the most destructive and widespread software supply-chain hacking sprees ever documented. The group systematically compromised hundreds of open-source software tools, hijacked developer accounts to spread malware further down the digital supply chain, and released a self-propagating worm to automate its attack pipeline, ultimately breaching more than a thousand organizations worldwide.
Now, new disclosures from Google’s threat intelligence division reveal that throughout a critical phase of TeamPCP’s campaign, the company maintained an undercover presence directly inside the group’s inner circle. This covert access enabled Google to monitor the syndicate’s activities in real time, notify compromised targets, disrupt extortion attempts, and assist law enforcement agencies in unmasking the individuals behind the operation.
Speaking at security firm SentinelOne’s LABScon research conference, Austin Larsen, a researcher with the Google Threat Intelligence Group, detailed how the company infiltrated and tracked TeamPCP during its chaotic supply-chain rampage. According to Larsen, Google combined intelligence gathered by an undercover analyst from its Mandiant unit with traditional digital forensics, tracing operational security errors made by one of the group’s alleged leaders.
Google’s investigation was further augmented by unexpected intelligence shared by ShinyHunters, a rival cybercriminal syndicate that initially partnered with TeamPCP before turning against them. Ultimately, Google gathered identifying information on a key actor and passed the leads directly to federal law enforcement, leading to arrests in Australia.
"One of our personas had been working for many months to build trust with one of the actors that was invited to join TeamPCP, and so was added to the group," Larsen explained. "So essentially, almost day one, Mandiant was watching everything behind the scenes."
The TeamPCP mole
TeamPCP first emerged online in late 2025, quickly gaining notoriety for a series of cascading software supply-chain intrusions. The group’s methodology involved penetrating open-source repositories and security tools to insert malicious code. Once implanted, the malware harvested sensitive developer credentials, access tokens, and administrative keys, which TeamPCP then leveraged to breach additional high-profile software tools and platforms in a self-reinforcing cycle.
Beginning in the spring, TeamPCP compromised several prominent open-source software projects and corporate systems. Among the affected targets were the open-source container security scanner Trivy, the artificial intelligence API integration tool LiteLLM, internal infrastructure belonging to web application security firm Checkmarx, the web application framework library TanStack, and the enterprise AI platform Mistral AI.
By leveraging access tokens stolen from these initial compromises, TeamPCP expanded its reach across the global technology ecosystem. Downstream victims included the code-hosting platform GitHub, data contracting firm Mercor, and individual employee devices at major entities including OpenAI and the European Commission, alongside hundreds of other corporate targets.
To accelerate their operations, the hackers deployed an automated, self-spreading worm designated "Mini Shai-Hulud"—a reference to the giant sandworms in the sci-fi franchise Dune. The worm was designed to crawl through repositories, systematically harvesting credentials and automating the infection process. The tool’s name echoed an earlier worm called Shai-Hulud detected in September 2025, though researchers have not formally confirmed whether TeamPCP or its individual members were tied to that earlier effort.
Unbeknownst to TeamPCP, Google had established visibility inside the group’s private operations in March, just as the supply-chain attacks were escalating. The undercover Mandiant analyst, operating behind a carefully cultivated online persona, was extended an invitation to join the hackers’ inner core. The operative became one of approximately 12 trusted members granted access to TeamPCP’s private operational chat channel, which the group called CanisterWorm.
Inside the private channel, the hackers openly boasted about the historic scale of their operation. "You guys should understand that we pulled off the biggest supplychain [sic] maybe ever recorded in modern history," one TeamPCP member wrote in chat logs reviewed during the investigation.
Around the time Google established its presence, Michael Fletcher, a former Australian Federal Police (AFP) cyber analyst working for an Australian telecommunications firm, contacted Larsen to coordinate research on monitoring TeamPCP. Fletcher recalled that Larsen advised him to approach the group with caution because an undercover "friendly" was already inside their network.
