Australian Police Arrest Two Suspected TeamPCP Hackers Linked to Major Cyberattacks

Australian authorities have arrested two individuals in Perth who are allegedly connected to TeamPCP, a cybercriminal group accused of carrying out multiple high-profile attacks against technology companies, open-source projects, and software supply chains.

The suspects have been charged with more than a dozen offenses, including hacking, money laundering, and other cybercrime-related activities. They are expected to appear before an Australian court following their arrest.

According to the Australian Federal Police (AFP), the suspects are accused of compromising and modifying widely used open-source software projects to distribute malicious code. The attackers allegedly attempted to infect thousands of systems to steal sensitive credentials, access private data, and pressure victims into paying ransom demands.

The FBI’s cyber division chief, Brett Leatherman, stated that the alleged TeamPCP members were involved in attacks against more than 1,000 organizations.

TeamPCP has gained attention for targeting the software supply chain, a technique where attackers compromise trusted software tools used by developers and companies. By inserting malicious code into legitimate projects, attackers can gain access to large numbers of systems.

Investigators said the group’s attacks involved stealing authentication keys, cloud credentials, and other sensitive information. Authorities estimate that more than 500,000 credentials were stolen as part of their campaigns.

The group was previously linked to an attack on Trivy, a popular open-source vulnerability scanning tool. The compromise affected organizations relying on the software, including AI recruiting startup Mercor, developer platforms, and other technology companies.

TeamPCP has also been suspected of targeting additional open-source projects and attempting to gain access to environments connected with major technology platforms, including GitHub and OpenAI.

Australian authorities said the investigation began in April 2026 after receiving intelligence from multiple cybersecurity companies. During the operation, police reportedly seized devices, electronic equipment, and a large amount of suspected stolen data.

Although Australian police have not officially released the names of the arrested individuals, cybersecurity journalist Brian Krebs reported that one alleged TeamPCP member may be Ruben Thomson, who used the online alias “Ellis.” According to Krebs, the individual claimed to have led TeamPCP until March 2026.

Authorities said they are continuing to analyze the seized data and will notify affected organizations as the investigation progresses.

The arrests highlight the growing threat of software supply chain attacks, where cybercriminal groups exploit trusted developer tools and open-source ecosystems to compromise thousands of organizations at once.