Australian authorities bust two suspects in TeamPCP hacking operation

Australian police have arrested and charged two men accused of operating with TeamPCP, a hacking collective responsible for a months-long campaign of supply chain attacks reaching more than 1,000 target organizations across the globe.

The arrests#

According to the Australian Federal Police statement, both suspects faced 14 criminal charges. The individuals were apprehended in Western Australian towns—one in Cottesloe, the other in Mandurah. Security reporter Brian Krebs provided additional reporting identifying the men and detailing investigative findings about how their activities were uncovered.

The TeamPCP campaign#

Since surfacing in December, TeamPCP has emerged as a significant threat to global security infrastructure. The group specialized in supply chain poisoning: infiltrating open source software repositories and injecting malware into packages destined for widespread distribution.

The malware, known as Shai-Hulud, operated as a self-replicating worm. It targeted the CI/CD pipelines—automated systems organizations use to build, test, and release software updates—that developers rely on to manage their codebases. Once a legitimate package became compromised, the worm would embed itself into subsequent versions and updates of that software.

Developers downloading infected packages unwittingly introduced the malware into their own development environments, which then propagated the contamination downstream to their own software products. This cascading mechanism allowed a single point of compromise to metastasize into thousands of secondary infections across enterprise networks.