Australian Federal Police have arrested two men in Perth accused of being members of TeamPCP, a cybercrime group linked to widespread software supply-chain attacks against more than 1,000 organizations. The two men, aged 21 and 23, face a combined 14 charges covering alleged hacking, money laundering, and other cybercrime offenses.
According to the AFP’s official announcement, the investigation involved the AFP, FBI, and Western Australia Police Force. Authorities allege the group compromised and modified popular open-source software to steal credentials and data before attempting to extort victims.
TeamPCP Targeted Open-Source Software
TeamPCP has been linked to attacks in which malicious code was inserted into widely used software projects. Once organizations or developers installed compromised versions, the code could collect private keys, cloud credentials, and other sensitive information that attackers could then use to enter additional systems.
Australian authorities said more than half a million credentials were stolen during the wider campaign. FBI Cyber Division chief Brett Leatherman said the alleged members were connected to attacks affecting more than 1,000 organizations.
The group has been blamed for compromising the Trivy vulnerability scanner and software linked to LiteLLM. Those incidents affected organizations including AI recruiting company Mercor, while TeamPCP has also been connected to breaches involving European Commission infrastructure and attacks that provided access to systems belonging to GitHub and OpenAI.
Investigation Began After Security Companies Shared Information
Australian investigators began examining the group in April 2026 after receiving information from several cybersecurity companies. Police said they seized electronic devices and a large amount of allegedly stolen data during this week’s arrests and plan to contact organizations identified as victims.
The AFP has not publicly named either defendant. Independent cybersecurity journalist Brian Krebs reported that the 21-year-old suspect is Ruben Thomson, who allegedly used the online name Ellis and described himself as TeamPCP’s former leader.
Krebs said he had communicated with the alleged hacker for several months and used information connected to his online activity to identify him. TeamPCP emerged in late 2025 and became associated with a series of software supply-chain and data-extortion campaigns.
The two men were scheduled to appear in Perth Magistrates Court on Thursday. It remains unclear whether U.S. authorities will seek their extradition.
Featured image credits: Magnific.com
For more stories like it, click the +Follow button at the top of this page to follow us.