Australian authorities arrest two alleged members of TeamPCP hacking group behind global supply-chain attacks

Authorities in Australia announced the arrest of two men accused of participating in cybercrimes linked to TeamPCP, a hacking group responsible for a nine-month supply-chain attack campaign that compromised more than 1,000 organizations globally.

The Australian Federal Police stated the two men, residents of Cottesloe and Mandurah in Western Australia, were arrested and charged with 14 offenses. The statement did not name the individuals, but KrebsOnSecurity later reported their names and provided background on the investigation.

TeamPCP is known for injecting malware into open-source software packages, which then self-propagated through CI/CD pipelines used by organizations to develop and deploy software. The malware, named Shai-Hulud, attached itself to package updates, enabling downstream infections when developers used compromised packages.

A key feature of Shai-Hulud was its ability to collect credentials stored in the memory of infected hardware, allowing the group to compromise additional packages. The compromise of the Trivy vulnerability scanner led to the theft of terabytes of credentials and private data, which were then used to infect downstream packages such as KICS, the Telnyx Python SDK, and LiteLLM.

The group employed an Internet Computer Protocol-based canister as a command-and-control mechanism, enabling rapid URL changes to evade takedowns. Infected machines reported to the canister every 50 minutes.

Authorities indicated that, if convicted, one defendant faces more than 20 years in prison and the other more than 10 years.