Google Infiltrated TeamPCP: Inside the Undercover Operation that Stopped a Massive Supply‑Chain Attack

Google infiltrated TeamPCP to expose the gang

In a rare display of offensive cyber‑intelligence, a Google Threat Intelligence researcher slipped past the veil of the notorious supply‑chain hacking collective known as TeamPCP. The operation, unveiled at SentinelOne’s LABScon conference, gave Google a front‑row seat as the group weaponised a Dune‑themed worm, automating malware injection across hundreds of open‑source libraries and breaching over ↑ 1,000 organisations worldwide.

Key breakthroughs emerged when the undercover analyst traced sloppy operational security to two Australian nationals now facing charges. Google passed the identifiers to law‑enforcement, a move echoed by Reuters in its coverage of the arrests.

“Our presence inside the ring allowed us to issue real‑time warnings to potential victims, curbing further spread,” said Austin Larsen, senior researcher.

The intelligence feed was amplified by a betrayal from a rival criminal outfit, ShinyHunters, which supplied insider details that helped Google map the supply‑chain attack vectors. This cross‑group intel proved instrumental in dismantling the worm’s propagation.

While the breach tally is staggering, the episode underscores a shifting paradigm: corporations now field offensive units capable of infiltrating hostile networks. The same techniques that shielded critical infrastructure during the pandemic are being repurposed to pre‑empt cyber‑espionage.