Authorities in Australia have arrested two men believed to be central figures in TeamPCP, a prolific cybercrime and data extortion group held responsible for orchestrating what security experts describe as the longest-running software supply chain attack campaign in history.

In a joint statement released today, the Australian Federal Police (AFP)—acting alongside the Federal Bureau of Investigation (FBI) and the Western Police Force (WAPF)—announced the apprehension of two men from Western Australia, aged 21 and 23. The suspects are accused of being key operatives within a sophisticated cybercrime syndicate that allegedly utilized malicious open-source software to target and compromise thousands of businesses worldwide.

While the AFP did not publicly name the defendants in their initial release, investigative reporting by Brian Krebs confirmed the real identity of the 21-year-old suspect, who has been communicating with the journalist since June. That suspect, identified through extensive digital tracking and subsequent public records, operated as a central voice and self-described spokesperson for TeamPCP. Following the arrests, Australian media outlets confirmed that Ruben Ian Thomson of Cottesloe and 23-year-old Michael Gaebler were the two individuals taken into custody. Both men were denied or chose not to seek bail during their initial appearance at the Perth Magistrates Court and are being held in custody until their next scheduled court date on September 18.

The Rise of TeamPCP and the Shai-Hulud Worm

TeamPCP first burst onto the global cybercrime landscape in late 2025. The collective distinguished itself by embedding malicious code into hundreds of open-source software tools, subsequently extorting victims for financial gain. Members of the syndicate made international headlines by infiltrating corporate cloud environments using a self-propagating worm dubbed Shai-Hulud. This malware injected malicious payloads into open-source programs maintained by developers whose credentials at public code repositories—such as GitHub and NPM—had been compromised through sophisticated phishing and credential-theft operations.

Writing for Wired, journalist Andy Greenberg detailed TeamPCP’s core methodology as a cyclical exploitation model targeting software developers. The hackers initially gained access to development networks housing commonly used open-source tools. They then planted malware into those tools, which subsequently propagated onto the machines of other software developers. This included coders writing additional tools intended for broader distribution. Consequently, the malware harvested credentials that enabled TeamPCP to publish malicious versions of subsequent software development tools, allowing the breach cycle to compound and expand their collection of compromised networks exponentially.

In addition to cyclical exploitation, TeamPCP practiced a form of cyclical recruitment. In May, the source code for the third iteration of Shai-Hulud was published online, quickly followed by a contest launched by the group. TeamPCP offered a $1,000 reward in Monero cryptocurrency to the participant who could execute the largest supply chain operation using the worm’s code. According to contest parameters, participants were scored based on the weekly and monthly download counts of the packages they managed to compromise, directly incentivizing them to target widely used code libraries.

Security firm Dataminr noted that the competition served as a recruitment mechanism and a means to acquire mass unauthorized access. The organizers indicated that the initial cash prize was merely a participation baseline, with higher payouts promised for valuable corporate network access.

The syndicate’s operations targeted critical technological infrastructure. In March, TeamPCP executed an attack on AI infrastructure by compromising LiteLLM, an open-source AI gateway connecting users to over 100 different large language models. Analysis by security firm CloudSEK revealed that this single supply chain breach harvested cloud service keys and sensitive credentials from more than 2,500 organizations, including numerous global technology giants. By May, TeamPCP claimed responsibility for compromising at least 3,800 code repositories on Microsoft-owned GitHub after a developer installed a compromised code extension.

Meet the Cybercats

Security analysts note that TeamPCP functions less as a traditional, hierarchically structured hacking group and more as an amalgamation of threat actors drawn from various cybercriminal gangs who occasionally collaborate. Austin Larsen, a principal threat analyst with the Google Threat Intelligence Group, described the collective as a peer community of individually skilled actors anchored around a central core of operations.

That center of gravity has been linked to George Prepakis, an established security researcher and exploit developer who operates the X profile @kernelstub. Earlier in the year, Prepakis shared an invitation link to a Matrix chat server he created, named "Cybercats." TeamPCP members and associated cybercrime entities utilized this server for daily operational communications.

Kernelstub and other chat administrators frequently used their X handles within the Matrix communications, often taunting targets publicly before news of the breaches broke. Other prominent chat administrators included figures using handles such as "Boxturtle," linked to data breach broker @xpl0itrsturtle on Breachforums and Darkforums, and "SeesawSec," alias for the Fulcrumsec group behind extortion attacks against Novo Nordisk, LexisNexis, and Avnet. Another administrator, @pcpcasper, was identified through extensive Telegram messaging as an active member of the National Socialist Network, a neo-Nazi organization in Australia. Law enforcement sources and online posts indicated that Gaebler was the individual operating behind the @pcpcasper alias.

Unraveling the Leadership and Operational Security Failures

The primary leader and spokesperson for TeamPCP used numerous aliases across cybercrime forums, including EllisD25 and LSD on Darkforums, BulkDMT on Breachstars, and Express on Breachforums. These accounts were linked by shared instant messaging contact handles such as Tox IDs and Session IDs, as well as the promotion of a virtual private service named DMT Host.

Intelligence firms Intel 471 and Flashpoint tracked the leader’s activities, noting connections to South Africa through residential and mobile IP addresses, email registrations like [email protected], and commentary regarding South African politics and personal background. Public reporting from CyberScoop previously indicated that Google traced TeamPCP’s connection points to South Africa during several attacks.

However, a trail of operational security (opsec) failures ultimately linked the online persona back to physical infrastructure in Perth, Australia. Identity threat protection firm SpyCloud discovered that the [email protected] address was used to register an account named ChristmasSnow on Raidforums in 2022, with access logs originating primarily from Perth ISPs.

Further investigation into passive DNS records by KrebsOnSecurity connected those Perth IP addresses to a residential file server operated by the Thomson family. Open-source intelligence platforms linked these records to Joshua Thomson and his brother, Ruben Thomson, who had a long-standing presence on cybercrime forums dating back to 2018 under aliases such as Yolosolo17, Sheep420, and Sheep Stealing. Public business records and professional profiles confirmed that Ruben Thomson, a web developer living in Cottesloe, operated companies with ironic names such as OPSEC Express and Secure Computing Solutions.

Additional opsec lapses sealed the investigation. In mid-2025, an account registered in the name of Ruben Thomson on HackerOne used the username Deadcatx3—an alias previously flagged by multiple security firms as a primary identifier for TeamPCP leadership.

Perspectives on the Syndicate’s Legacy

In interviews conducted prior to his arrest, the TeamPCP spokesperson, who went by the name Ellis, discussed his involvement with the group, noting that he had stepped back from leadership earlier in the year. He acknowledged earning approximately $20,000 through his cybercrime activities and described a background marked by struggles with substance abuse, periods of homelessness, and an entry into hacking driven by a desire for intellectual challenge and community.

Security researchers point to TeamPCP as representative of a new breed of threat actors who defy traditional categorization. Charlie Eriksen, a security researcher at Aikido Security, noted that the group’s motivations blended financial gain, disruption, notoriety, and ideology. Eriksen observed that the accessibility of large language models has compressed the technical learning curve, allowing threat actors to operate at scale without necessarily developing the rigorous operational discipline typical of traditional cybercriminal organizations or state-sponsored APTs.

Despite their chaotic methods and frequent operational mistakes, TeamPCP’s supply chain attacks had profound repercussions for the software industry. The widespread compromise of GitHub via the Shai-Hulud worm compelled major coding platforms to reevaluate their security postures. In response, GitHub and other ecosystems introduced mandatory cooldown periods for package managers to allow security tools time to vet newly updated dependencies before automated deployment.

With the apprehension of Thomson and Gaebler, both men face a combined total of 14 cybercrime charges. Following their court appearance in Perth, they remain remanded in custody ahead of their next court date.