TeamPCP

TeamPCP (also styled Team PCP; operating personas PCPcat, ShellForce, DeadCatx3, Persy_PCP, PCPsh) is a prolific cybercrime and data-extortion group blamed for one of the longest-running software supply-chain attacks on record. It surfaces in late 2025 as an opportunistic cloud-exploitation crew before pivoting in early 2026 to poisoning the open-source developer toolchain. (raw/digests/Cyber-Digest-2026-08-28.md)

Activity and TTPs

• Origins: automated scans for exposed Docker APIs, Kubernetes control planes, Ray dashboards and Redis instances; deployed containers that doubled as scanners/proxies, self-propagating.
• Supply-chain pivot (early 2026): in late February 2026 exploited a misconfigured GitHub Actions workflow in Aqua Security's Trivy (widely used vulnerability scanner) and stole a service-account token that was never fully revoked. On 19 March 2026 it pushed a malicious Trivy release across all distribution channels, lacing thousands of CI/CD pipelines with a credential stealer. Downstream victims included the European Commission and GitHub.
• LiteLLM compromise: the poisoned Trivy ran inside the AI gateway's build pipeline, harvesting the PyPI publishing token; on 24 March 2026 the group shipped two backdoored LiteLLM releases (~95 million downloads/month). CloudSEK estimated the attack harvested cloud keys and secrets from 2,500+ organisations.
• Shai-Hulud / Mini Shai-Hulud worms: self-replicating credential stealers that propagated across package registries (TanStack, UiPath, MistralAI, npm), often by phishing or stealing developer credentials. The Mini Shai-Hulud C2 used the domain masscan[.]cloud.
• Other targets: Checkmarx's KICS, Red Hat npm packages, Telnyx, and a claimed compromise of ~3,800 internal GitHub repos.
• Entity shape: less a structured crew than a peer network of individually-skilled actors (Google Threat Intelligence), collaborating with other cybercrime groups via a Matrix chat server ("Cybercats") and publicly taunting victims on Telegram and X.

Scale of the campaign

• Allegedly compromised more than 1,000 organisations worldwide (FBI estimate).
• 500,000+ credentials exposed and at least 300 GB of data exfiltrated (Australian investigators).
• Global cleanup costs estimated in the hundreds of millions of dollars.

August 2026 arrests (Australia)

On 26 August 2026 the Australian Federal Police, working with the FBI and the Western Australia Police Force, arrested two Perth-based men: Ruben Ian Thomson, 21 (Cottesloe) and Louis Michael Gaebler, 23 (Mandurah), named by Australian media. They were charged over their alleged roles as principal participants of TeamPCP, facing counts including computer hacking, unauthorized data modification, identity crime, dealing in criminal proceeds ($100,000+), and cryptocurrency-based money laundering — with potential penalties from 3 to 20 years per charge for Thomson. Devices were seized for forensic examination; further arrests have not been ruled out. (raw/digests/Cyber-Digest-2026-08-28.md)

See the dedicated incident page: Australia Charges Two Men As Teampcp S Principal Participants After Supply Chain

Attribution research

Flare's Emerging Threats Team (27 August 2026) traced a GitHub alias, DeadCatx3, to accounts under the name Ruben Thomson (HackerOne, Hugging Face), a profile listing masscan[.]cloud, and a linked password chain that surfaced a personal Gmail, TikTok and Steam account, tying the persona to Western Australia. Flare assessed with high confidence that Thomson ran the group. Krebs on Security independently identified the TeamPCP leader persona @pcpcats (aka EllisD25/LSD, BulkDMT, Express) and reported the group's leaders congregated on the "Cybercats" Matrix server.

Australian angle

The arrests are a flagship Australia–US law-enforcement cooperation (AFP/FBI/WAPF) and underscore that Australian agencies are now co-producers of Five Eyes takedowns. For AU/NZ organisations relying on open-source developer tools, TeamPCP's campaign is a live reminder to verify dependency and CI/CD supply-chain integrity. Au Impact

Related Pages

• Australia Charges Two Men As Teampcp S Principal Participants After Supply Chain — the August 2026 arrests
• Scattered Spider — another prolific cybercrime group facing LE action
• Mitre Attack — framework for mapping supply-chain TTPs