Although the undercover analyst was removed from the private chat channel, Google continued tracking the group through investigative digital forensics. Larsen began analyzing leaked forum data to establish the real-world identities of the individuals controlling the syndicate.
Cross-referencing database leaks from the cybercrime forum BreachForums, Larsen identified that one of the most active online handles in the CanisterWorm chat had registered an account using the email address [email protected]. Historical forum archives revealed a 2019 transaction dispute between the sheepstealing alias and a seller of pirated Microsoft Office license keys. In that dispute, the user operating the account had requested a PayPal refund directed to [email protected].
Following TeamPCP’s server migration, Google obtained insight into the group’s new hosting setup through what Larsen described as a "trusted partner." The investigators discovered that the hackers were backing up their newly relocated server containing stolen corporate records directly to a cloud storage account on Google Drive—registered to the same [email protected] address.
"When we saw that, I just thought: There’s no way. Why would he be sending all of this illicit, stolen material to a Google Drive that’s tied to himself?" Larsen said. "That’s when we gave the tip to the FBI."
Larsen submitted the evidence directly to the Federal Bureau of Investigation, receiving a response within minutes. Independent cybersecurity journalist Brian Krebs similarly published investigative findings linking online trails to the same identity prior to law enforcement action.
Following legal requests and search warrants served to process account data, federal authorities pinpointed the suspect’s physical location. Late last month, Australian Federal Police (AFP), working in coordination with the FBI, executed search warrants in Western Australia. Authorities arrested Ruben Ian Thomson, 21, and Louis Michael Gaebler, both described by the AFP as "principal participants" in TeamPCP.
Footage released by Australian authorities showed Thomson being led out of a suburban home in handcuffs, wearing a North Face hooded sweatshirt and sweatpants. Both men face federal hacking charges in Australia. Neither Thomson nor Gaebler could be reached for comment following their arrests.
Responding to inquiries regarding the operation, the FBI declined to discuss specific details of active judicial proceedings, referencing its broader strategy: "The FBI is able to confirm we strive to increase impact on adversaries through partnerships as documented in our newly released FBI Cyber Strategy." The AFP similarly declined further comment, citing ongoing legal processes.
Larsen emphasized that Google maintained strict ethical and legal boundaries regarding its undercover persona. The analyst operated strictly as a passive observer, taking no part in illicit hacking activities, data theft, or encouraging criminal acts.
"They were a fly on the wall, only saying enough to not be suspicious," Larsen said. "There are guardrails around what we do."
The operation highlights a broader shift in how major technology companies confront cyber threats. The investigation was driven in part by Google’s newly established Cyber Disruption Unit, an initiative focused on actively dismantling threat actor infrastructure rather than passively publishing post-incident technical analysis.
"Google Threat Intelligence Group has put an emphasis on disruption. That’s one of our missions now," Larsen said. "Writing reports can only be so useful. Taking action to protect users and customers—that is the next step."
