Before two of its alleged core members were arrested in Australia following a joint international investigation, the cybercriminal collective known as TeamPCP executed one of the most destructive and widespread software supply-chain hacking sprees ever documented. The group systematically compromised hundreds of open-source software tools, hijacked developer accounts to spread malware further down the digital supply chain, and released a self-propagating worm to automate its attack pipeline, ultimately breaching more than a thousand organizations worldwide.
Now, new disclosures from Google’s threat intelligence division reveal that throughout a critical phase of TeamPCP’s campaign, the company maintained an undercover presence directly inside the group’s inner circle. This covert access enabled Google to monitor the syndicate’s activities in real time, notify compromised targets, disrupt extortion attempts, and assist law enforcement agencies in unmasking the individuals behind the operation.
Speaking at security firm SentinelOne’s LABScon research conference, Austin Larsen, a researcher with the Google Threat Intelligence Group, detailed how the company infiltrated and tracked TeamPCP during its chaotic supply-chain rampage. According to Larsen, Google combined intelligence gathered by an undercover analyst from its Mandiant unit with traditional digital forensics, tracing operational security errors made by one of the group’s alleged leaders.
Google’s investigation was further augmented by unexpected intelligence shared by ShinyHunters, a rival cybercriminal syndicate that initially partnered with TeamPCP before turning against them. Ultimately, Google gathered identifying information on a key actor and passed the leads directly to federal law enforcement, leading to arrests in Australia.
"One of our personas had been working for many months to build trust with one of the actors that was invited to join TeamPCP, and so was added to the group," Larsen explained. "So essentially, almost day one, Mandiant was watching everything behind the scenes."
The TeamPCP mole
TeamPCP first emerged online in late 2025, quickly gaining notoriety for a series of cascading software supply-chain intrusions. The group’s methodology involved penetrating open-source repositories and security tools to insert malicious code. Once implanted, the malware harvested sensitive developer credentials, access tokens, and administrative keys, which TeamPCP then leveraged to breach additional high-profile software tools and platforms in a self-reinforcing cycle.
Beginning in the spring, TeamPCP compromised several prominent open-source software projects and corporate systems. Among the affected targets were the open-source container security scanner Trivy, the artificial intelligence API integration tool LiteLLM, internal infrastructure belonging to web application security firm Checkmarx, the web application framework library TanStack, and the enterprise AI platform Mistral AI.
By leveraging access tokens stolen from these initial compromises, TeamPCP expanded its reach across the global technology ecosystem. Downstream victims included the code-hosting platform GitHub, data contracting firm Mercor, and individual employee devices at major entities including OpenAI and the European Commission, alongside hundreds of other corporate targets.
To accelerate their operations, the hackers deployed an automated, self-spreading worm designated "Mini Shai-Hulud"—a reference to the giant sandworms in the sci-fi franchise Dune. The worm was designed to crawl through repositories, systematically harvesting credentials and automating the infection process. The tool’s name echoed an earlier worm called Shai-Hulud detected in September 2025, though researchers have not formally confirmed whether TeamPCP or its individual members were tied to that earlier effort.
Unbeknownst to TeamPCP, Google had established visibility inside the group’s private operations in March, just as the supply-chain attacks were escalating. The undercover Mandiant analyst, operating behind a carefully cultivated online persona, was extended an invitation to join the hackers’ inner core. The operative became one of approximately 12 trusted members granted access to TeamPCP’s private operational chat channel, which the group called CanisterWorm.
Inside the private channel, the hackers openly boasted about the historic scale of their operation. "You guys should understand that we pulled off the biggest supplychain [sic] maybe ever recorded in modern history," one TeamPCP member wrote in chat logs reviewed during the investigation.
Around the time Google established its presence, Michael Fletcher, a former Australian Federal Police (AFP) cyber analyst working for an Australian telecommunications firm, contacted Larsen to coordinate research on monitoring TeamPCP. Fletcher recalled that Larsen advised him to approach the group with caution because an undercover "friendly" was already inside their network.
"I thought, damn, you all have been inside this early," Fletcher said.
The undercover analyst gained access to a central server where TeamPCP accumulated stolen credentials harvested from target networks, including account passwords, developer tokens, and administrative credentials intended for use in future extortion demands. Recognizing the immediate risk to thousands of enterprises, Google’s threat intelligence team launched an immediate mitigation strategy.
"My thought was: How can we, as quickly as possible, disrupt their campaign before more compromises can happen?" Larsen said. "Let’s go mess up what they’re doing. That was my goal."
Directly notifying every individual victim company proved impractical given the massive volume of stolen accounts. Instead, Google prioritized contacting major cloud infrastructure and identity service providers, such as Amazon Web Services (AWS) and Microsoft, where the stolen tokens could be utilized. Google issued hundreds of notification alerts to these platform providers, enabling them to proactively revoke compromised credentials, invalidate access tokens, and close attack vectors before TeamPCP could carry out financial extortion.
While monitoring the group’s internal communications, Google’s intelligence team uncovered another significant threat. A core member of TeamPCP was utilizing an artificial intelligence tool to engineer a zero-day exploit targeting widely deployed login software. The exploit was designed to bypass multi-factor authentication (2FA) mechanisms, creating a powerful initial access tool separate from their supply-chain operations.
Google security researchers obtained a copy of the AI-generated exploit code, tested its efficacy in a controlled environment, and confirmed that it functioned as intended with minor adjustments—representing a rare, documented case of an AI-assisted zero-day exploit deployed in the wild. Google quietly alerted the affected software vendor, allowing them to release a patch before the vulnerability could be widely exploited. (Google previously outlined the discovery in a May technical case study without naming TeamPCP or detailing the undercover source).
More betrayals, sloppy opsec
Despite pulling off an unprecedented series of technical intrusions and harvesting credentials for more than 500,000 users, TeamPCP struggled to convert its vast treasure trove of access into illicit revenue. Australian police later confirmed the massive volume of compromised user accounts, but Larsen estimated that TeamPCP earned only tens of thousands of dollars in extortion payouts—a modest sum compared to the multi-million-dollar ransoms routinely secured by established cybercrime syndicates.
To monetize their network access more effectively, TeamPCP sought alliances with other active cybercriminal entities. They invited external hacker groups into their environment, providing them access to stolen corporate credentials in exchange for a percentage of any ransom payments successfully extracted from victims.
Among the groups brought in as revenue partners was ShinyHunters, an established cybercrime syndicate notorious for high-profile extortion schemes, corporate data theft, and ransomware operations—including a high-visibility breach of the Canvas educational platform that impacted thousands of schools across the United States.
The partnership quickly unraveled. By April, roughly a month after joining forces with TeamPCP, ShinyHunters betrayed their partners. ShinyHunters began executing independent extortion demands using TeamPCP’s stolen credential database while refusing to share the proceeds. To further undermine TeamPCP, ShinyHunters contacted Larsen unsolicited and handed over complete chat transcripts from TeamPCP’s operational server—unaware that Google’s undercover analyst was already inside the channel recording the same logs.
ShinyHunters proceeded to publicly taunt TeamPCP on X (formerly Twitter), exposing the rift. Realizing their operational security had been compromised, TeamPCP’s leaders panicked. They locked down their infrastructure, migrated stolen databases to a new isolated server, and conducted a sweep of their communications channels. They purged several members from the CanisterWorm chat, including ShinyHunters and Google’s undercover persona.
"Just delete that and stop sharing shit with shinyhunters," one TeamPCP leader instructed remaining members in an internal message.
Although the undercover analyst was removed from the private chat channel, Google continued tracking the group through investigative digital forensics. Larsen began analyzing leaked forum data to establish the real-world identities of the individuals controlling the syndicate.
Cross-referencing database leaks from the cybercrime forum BreachForums, Larsen identified that one of the most active online handles in the CanisterWorm chat had registered an account using the email address [email protected]. Historical forum archives revealed a 2019 transaction dispute between the sheepstealing alias and a seller of pirated Microsoft Office license keys. In that dispute, the user operating the account had requested a PayPal refund directed to [email protected].
Following TeamPCP’s server migration, Google obtained insight into the group’s new hosting setup through what Larsen described as a "trusted partner." The investigators discovered that the hackers were backing up their newly relocated server containing stolen corporate records directly to a cloud storage account on Google Drive—registered to the same [email protected] address.
"When we saw that, I just thought: There’s no way. Why would he be sending all of this illicit, stolen material to a Google Drive that’s tied to himself?" Larsen said. "That’s when we gave the tip to the FBI."
Larsen submitted the evidence directly to the Federal Bureau of Investigation, receiving a response within minutes. Independent cybersecurity journalist Brian Krebs similarly published investigative findings linking online trails to the same identity prior to law enforcement action.
Following legal requests and search warrants served to process account data, federal authorities pinpointed the suspect’s physical location. Late last month, Australian Federal Police (AFP), working in coordination with the FBI, executed search warrants in Western Australia. Authorities arrested Ruben Ian Thomson, 21, and Louis Michael Gaebler, both described by the AFP as "principal participants" in TeamPCP.
Footage released by Australian authorities showed Thomson being led out of a suburban home in handcuffs, wearing a North Face hooded sweatshirt and sweatpants. Both men face federal hacking charges in Australia. Neither Thomson nor Gaebler could be reached for comment following their arrests.
Responding to inquiries regarding the operation, the FBI declined to discuss specific details of active judicial proceedings, referencing its broader strategy: "The FBI is able to confirm we strive to increase impact on adversaries through partnerships as documented in our newly released FBI Cyber Strategy." The AFP similarly declined further comment, citing ongoing legal processes.
Larsen emphasized that Google maintained strict ethical and legal boundaries regarding its undercover persona. The analyst operated strictly as a passive observer, taking no part in illicit hacking activities, data theft, or encouraging criminal acts.
"They were a fly on the wall, only saying enough to not be suspicious," Larsen said. "There are guardrails around what we do."
The operation highlights a broader shift in how major technology companies confront cyber threats. The investigation was driven in part by Google’s newly established Cyber Disruption Unit, an initiative focused on actively dismantling threat actor infrastructure rather than passively publishing post-incident technical analysis.
"Google Threat Intelligence Group has put an emphasis on disruption. That’s one of our missions now," Larsen said. "Writing reports can only be so useful. Taking action to protect users and customers—that is the next step."
