# TeamPCP Hackers Arrested in Australia Over Supply Chain Attacks

> Australian Federal Police arrest two men linked to TeamPCP, a cybercrime syndicate behind major software supply chain attacks and data extortion.

- Published: 2026-09-01T02:41:36.000Z
- Severity: medium
- Category: Supply Chain
- Tags: TeamPCP, Supply Chain Attack, Shai Hulud, GitHub, LiteLLM
- Author: Runtime Rebel Intel
- Primary source: https://krebsonsecurity.com/2026/08/two-alleged-teampcp-hackers-arrested-in-australia/
- Canonical: https://runtimerebel.com/blog/teampcp-hackers-arrested-in-australia-over-supply-chain-attacks

## Key points

- Australian authorities arrested two men allegedly tied to the TeamPCP cybercrime syndicate.
- The group targeted software supply chains, open-source repositories, and developer credentials globally.
- Organizations should audit open-source dependencies and review software repository access controls immediately.

## Overview of TeamPCP Arrests

Law enforcement authorities in Australia have apprehended two men suspected of belonging to **TeamPCP**, a prolific cybercrime and data extortion collective. According to an official statement from the Australian Federal Police (AFP), the suspects—aged 21 and 23 from Western Australia—were taken into custody for their involvement in a sophisticated operation that deployed malicious open-source software packages to target thousands of organizations worldwide. As detailed in a report by [KrebsOnSecurity](https://krebsonsecurity.com/2026/08/two-alleged-teampcp-hackers-arrested-in-australia/), the investigation revealed extensive involvement in software supply chain compromises that impacted major corporate cloud environments.

## Technical Analysis of Supply Chain Tactics

TeamPCP emerged as a significant [threat actor](/glossary#threat-actor) in late 2025, specializing in the poisoning of open-source software libraries. The syndicate relied heavily on a self-propagating [worm](/glossary#worm) referred to as **Shai-Hulud**. This [malware](/glossary#malware) injected malicious payloads into open-source code repositories maintained by developers whose credentials at public platforms such as GitHub and NPM were compromised via [credential harvesting](/glossary#credential-harvesting) or [phishing](/glossary#phishing).

The mechanics of these attacks followed a cyclical pattern. Attackers gained unauthorized access to environments where developer tools were built, subsequently embedding malicious code into packages distributed to other software engineers. This methodology allowed the group to systematically harvest additional credentials, expand their foothold across corporate software pipelines, and compromise thousands of code repositories.

Prominent incidents attributed to this collective include an attack on **LiteLLM**, an open-source artificial intelligence gateway, which resulted in the exposure of cloud service keys and sensitive credentials across more than 2,500 organizations. Furthermore, the group claimed responsibility for compromising thousands of repositories on GitHub following a developer workstation infection via a malicious code extension.

## Threat Actor Dynamics and Recruitment

Security researchers note that TeamPCP operates less like a traditional hierarchical cybercrime crew and more as an amalgamated peer community. Investigators identified links between the syndicate and various online personas operating within collaborative chat platforms such as Matrix, alongside data brokers active on underground forums selling stolen corporate and automotive manufacturer records.

## Actionable Recommendations for Security Teams

Defenders must prioritize [hardening](/glossary#hardening) development pipelines and monitoring repository access to mitigate supply chain risks:

* **Audit Open-Source Dependencies:** Implement automated software composition analysis (SCA) tools to inspect third-party packages for unauthorized modifications or malicious dependencies.
* **Enforce Multi-Factor Authentication ([MFA](/glossary#mfa)):** Require phishing-resistant MFA for all developer accounts interacting with code repositories, package registries, and internal [CI/CD](/glossary#ci-cd) pipelines.
* **Review Credential Hygiene:** Regularly rotate cloud service keys, [API](/glossary#api) tokens, and access credentials, establishing strict least-privilege boundaries for automated build environments.

**Related:** [TeamPCP Supply Chain Attack: Trivy Compromise Impacts 2,500 Orgs](/blog/teampcp-supply-chain-attack-trivy-compromise-impacts-2500-orgs), [npm Supply Chain Attacks: Shai-Hulud, Miasma, and CI/CD Compromises](/blog/npm-supply-chain-attacks-shai-hulud-miasma-and-ci-cd-compromises)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/teampcp-hackers-arrested-in-australia-over-supply-chain-attacks