Authorities link suspects to malicious open-source code affecting 1,000 organizations, stealing credentials and data, with further arrests possible
Australian authorities have charged two men from Western Australia over their alleged involvement in TeamPCP, a cybercrime operation accused of mounting one of the most extensive software supply-chain attack campaigns recorded to date.
On August 27, 2026 the Australian Federal Police (AFP) had announced the men face 14 charges combined after appearing in Perth Magistrates Court, according to ABC News Australia.
The AFP carried out the 26 August arrests with support from the FBI and Western Australia Police Force. Investigators executed search warrants at addresses in Cottesloe, Hamilton Hill, and Mandurah before taking into custody a 21-year-old Cottesloe resident and a 23-year-old from Mandurah.
The older suspect has been charged with six computer-related offenses. The younger man faces eight counts, including an allegation of dealing with proceeds of crime valued at 100,000 Australian dollars or more, an offense that can attract a prison sentence of up to 20 years.
More than 1,000 organizations affected
Cybersecurity journalist Brian Krebs has identified the 21-year-old as Ruben Thomson, who allegedly used the online alias “Ellis”. Krebs reported that Thomson had portrayed himself as the leader of TeamPCP until March 2026. ABC News Australia reported that Thomson was refused bail. The second defendant was identified as Michael Gaebler, 23 — his lawyer did not apply for bail.
Law-enforcement agencies estimate that malicious code attributed to TeamPCP may have affected more than 1,000 organizations around the world. The campaign allegedly enabled the theft of more than 500,000 credentials and at least 300GB of data, while recovery and remediation expenses are expected to run into hundreds of millions of dollars globally.
FBI Cyber Division Assistant Director Brett E Leatherman commented: “These men are allegedly members of the cybercriminal group TeamPCP, whose malicious code potentially compromised more than a thousand organizations worldwide.”
Investigators say the operation inserted malicious code into open-source software repositories, where developers could unknowingly import it into their own applications and systems. Reported victims and affected projects included the Trivy vulnerability scanner, the LiteLLM AI gateway, AI recruitment company Mercor, and GitHub’s developer infrastructure, according to a TechCrunch report. The group is also suspected of compromising cloud infrastructure operated by the European Commission.
Security researcher Charlie Eriksen said TeamPCP had copied Shai-Hulud, an earlier self-propagating worm, rather than creating the malware initially. He said its members did not appear to rely on particularly advanced techniques, but could rapidly turn public exploits, research, methods, and malware concepts into working attacks.
Authorities said the investigation is continuing and indicated that further arrests remain possible.
