Google’s threat intelligence division revealed that it had embedded an undercover analyst within TeamPCP, a hacker group responsible for an extensive supply-chain attack campaign affecting over a thousand companies. The infiltration provided real-time visibility into the group’s operations during a period when TeamPCP was conducting what researchers described as an unprecedented hacking spree targeting open-source software and major technology companies.
TeamPCP, which emerged online in late 2025, executed a series of cascading supply-chain compromises by infiltrating popular open-source tools and stealing developer credentials to plant malware in additional software. The group’s targets included security scanning tools, AI platforms, and code repositories, ultimately breaching organizations such as GitHub, OpenAI, and the European Commission. At various points, TeamPCP deployed automated worms, including one named Mini Shai-Hulud, to scale its attacks more efficiently.
According to Austin Larsen, a researcher at Google Threat Intelligence Group, a Mandiant analyst—Google’s security subsidiary—had been cultivating trust with one of the group’s members and gained access to TeamPCP’s core communications channel known as CanisterWorm beginning in March. This insider position allowed Google to access servers containing stolen credentials and intercept plans for extortion and further exploitation. Rather than directly notifying each compromised company, Google strategically revoked credentials at major cloud providers like Amazon Web Services and Microsoft, then issued hundreds of notifications to affected organizations.
Last month, Australian authorities arrested Ruben Ian Thomson and Louis Michael Gaebler, both in their early 20s, in coordination with the FBI. Google researchers traced the group’s operational security errors back to one of the arrested individuals and provided identifying information to law enforcement. The investigation also benefited from intelligence shared by ShinyHunters, a rival cybercriminal group that had partnered with TeamPCP before becoming adversarial. Details of Google’s investigation and infiltration were presented at a security conference later this month.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI