Google planted an undercover analyst inside notorious supply-chain hacking group TeamPCP

Google's threat intelligence division has disclosed that one of its undercover operatives had embedded themselves within TeamPCP, a hacking gang responsible for one of the most destructive software supply-chain attacks on record. The infiltration allowed the tech giant to observe the group's criminal activity in real time, provide warnings to targeted companies, and assist law enforcement in disrupting their operations.

Inside the supply-chain hacking spree#

TeamPCP orchestrated an unprecedented campaign that compromised hundreds of open-source software projects, pilfered developer credentials to perpetuate attacks, and even deployed a self-spreading worm inspired by science fiction to streamline their malicious work. The group's activities ultimately infiltrated more than a thousand organizations before two alleged members were arrested in Australia.

Google's undercover operation#

During the height of TeamPCP's hacking rampage, an analyst from Mandiant—Google's security subsidiary—had cultivated a trusted relationship with someone invited to join the group. According to Austin Larsen, a Google Threat Intelligence Group researcher who will present findings at SentinelOne's LABScon conference, Mandiant's undercover operative had essentially been present from day one, monitoring the group's communications and tactics behind the scenes.

This inside access proved instrumental. Larsen explained to WIRED that the operative had "been working for many months to build trust with one of the actors," gaining admission to the group's inner circle and enabling continuous surveillance of their operations.

Building the case#

Beyond the embedded operative, Google traced the Australian suspects through a series of operational security mistakes and shared intelligence from ShinyHunters, another cybercriminal group that had partnered with TeamPCP before turning against them. Google's investigators compiled this information and forwarded critical identifying details to law enforcement, helping to catalyze the arrests and charge filings.