TeamPCP Hackers Arrested in Australia: Two Cybercriminals Nabbed

TeamPCP hackers arrested in Australia sparks global cyber‑security alarm

Supply‑chain impact and arrest details

Australian Federal Police announced Wednesday that two Western Australian men, aged 21 and 23, were taken into custody for their role in the TeamPCP hackers arrested operation. The pair face a combined ↓ 14 cyber‑crime charges, including supply‑chain extortion that affected ↑ 3,800 GitHub repositories.

“They weren’t a traditional gang; they were a loose network of skilled actors,” said Austin Larsen of Google Threat Intelligence.

TeamPCP first emerged in late 2025, inserting malicious code into open‑source libraries and using a self‑propagating worm dubbed “Shai‑Hulud” to hijack developer credentials. Their campaign compromised AI gateway LiteLLM, stole cloud keys from over 2,500 organizations, and even penetrated Microsoft‑owned GitHub after a rogue extension was installed.

Investigators traced the group’s command channel to a Matrix chat called “Cybercats,” run by a user known as @kernelstub. Within that forum, the self‑styled spokesperson @pcpcats—also identified as Ellis/Darkforums user BulkDMT—boasted about a Reuters-cited contest offering 1,000 Monero for the largest supply‑chain breach.

Security analyst Charlie Eriksen warned that AI‑driven tools are shrinking the gap between research and deployment, allowing actors like TeamPCP to scale quickly while leaving sloppy footprints. “They can be noisy, they can make mistakes, but that doesn’t make them less dangerous,” he said.

The arrests were confirmed by ABC News, which reported that the 23‑year‑old suspect, identified as Ruben Thomson, was denied bail. Both men remain in custody pending a hearing on September 18.

Dispatch from: Kaelen Frost

Lead Cybersecurity Analyst