The Australian Federal Police announced the arrest of two men on Wednesday in connection with cybercrimes linked to TeamPCP, a prolific hacking collective. According to authorities, the two suspects were charged with 14 offenses and are believed to be members of the group, which has compromised more than 1,000 organizations globally. The men are residents of Western Australian towns Cottesloe and Mandurah, though authorities did not initially release their names.
TeamPCP emerged in December and has conducted an extensive series of supply-chain attacks targeting open source software packages. The group deployed a worm known as Shai-Hulud that infected software packages and propagated through CI/CD pipelines used by organizations to develop and deploy applications. The mechanism allowed the malware to self-replicate when developers downloaded compromised packages and processed them through their own development infrastructure.
A key component of Shai-Hulud collected credentials stored in the memory of infected systems. Once TeamPCP obtained these credentials, members used them to compromise additional packages in the supply chain. A notable case involved the compromise of the Trivy vulnerability scanner, which subsequently infected downstream packages including KICS, the Telnyx Python SDK, and LiteLLM. The initial Trivy compromise resulted in the theft of terabytes of credentials and sensitive data.
The worm utilized an unconventional control mechanism based on Internet Computer Protocol smart contracts to resist third-party takedowns. This approach allowed operators to rapidly change command-and-control URLs while infected machines reported to the system every 50 minutes. Security researchers noted that TeamPCP members displayed less operational discipline than typical groups operating at their level of sophistication, with some analysts attributing this pattern to the accelerated development capabilities provided by large language models.
If convicted, one of the arrested men faces more than 20 years in prison, while the other faces more than 10 years.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI