Australian Police Arrest Two Alleged Members of Supply-Chain Extortion Crew TeamPCP
The Western Australia arrests target a group blamed for a year-long run of open-source software attacks, including the Shai-Hulud worm that hit thousands of companies.
Key points
- The Australian Federal Police arrested two men, aged 21 and 23, in Western Australia over their alleged roles in TeamPCP.
- TeamPCP is blamed for the longest-running spree of software supply-chain attacks on record, poisoning hundreds of open-source coding tools since late 2025.
- The group's Shai-Hulud worm lifted cloud credentials from more than 2,500 organisations through a poisoned version of the AI tool LiteLLM, according to security firm CloudSEK.
- TeamPCP claimed credit for tainting at least 3,800 code projects on GitHub after a developer installed a booby-trapped extension.
- The group ran a $1,000 Monero contest in May to recruit hackers willing to poison the most popular software packages.
Australian Federal Police have arrested two men in Western Australia over their alleged roles in TeamPCP, a cybercrime crew blamed for the longest-running spree of software supply-chain attacks ever documented.
Police named neither suspect. They're 21 and 23. The AFP described the pair as part of a "sophisticated cybercrime syndicate that allegedly created malicious open-source software to rob thousands of global businesses."
The reporting on the group's inner workings, and on the identity of the 21-year-old suspect, was first published by KrebsOnSecurity.
Who is TeamPCP?
A loose peer group of skilled hackers who poison open-source software, the free code that almost every app and website depends on. They slip malicious code into popular developer tools, then use those tools to steal from companies that install them.
The group surfaced in late 2025 and quickly built a reputation around a self-spreading program called Shai-Hulud. It's a worm, meaning it copies itself from one victim to the next automatically, hunting developer passwords stored on infected machines. When it finds them, it publishes tainted updates of other coding tools and the cycle repeats. We've been tracking the worm since our first Shai-Hulud story on 2 June 2026.
Andy Greenberg at Wired described the tactic as "cyclical exploitation of software developers." Each new victim becomes the launch pad for the next attack.
Security experts say TeamPCP isn't a structured criminal crew. "It is a peer community of individually-skilled actors, with one clear center of gravity," Austin Larsen, a principal threat analyst at Google Threat Intelligence Group, told KrebsOnSecurity. That center of gravity is George Prepakis, who operates the Twitter/X profile @kernelstub and runs the Cybercats Matrix chat server where TeamPCP and related groups communicate.
How big was the damage?
Larger than most supply-chain incidents on record. Two attacks alone reached thousands of companies through a single poisoned tool.
In March 2026, TeamPCP tampered with LiteLLM, a free tool that connects apps to more than 100 AI models. CloudSEK found the attack pulled cloud service credentials and other secrets from more than 2,500 organisations. Worth noting: our 14 August investigation found that most of that damage traced to a separate Trivy scanner compromise, not the LiteLLM package itself, and stolen credentials were already on sale by the time we published.
Two months later, the group claimed credit for tainting at least 3,800 code projects hosted on GitHub after a single developer installed a compromised code extension.
| Incident | Date | Scale |
|---|---|---|
| LiteLLM AI gateway attack | March 2026 | Credentials taken from 2,500+ organisations |
| GitHub extension attack | May 2026 | 3,800+ code projects compromised |
| Shai-Hulud recruitment contest | May 2026 | $1,000 Monero prize per winner |
| AFP arrests, Western Australia | This week | 2 suspects, aged 21 and 23 |
How did investigators find them?
Through their own online chatter. Cybercats Matrix members used the same handles on Twitter/X, taunting victims and posting about breaches before news coverage caught up.
One administrator, posting as @pcpcasper, shared cat videos that placed him in Western Australia. He was also an active member of the National Socialist Network, an Australian neo-Nazi organisation, on Telegram. A second administrator, handle T, ran the now-banned @pcpcats account and served as the group's self-described spokesperson. KrebsOnSecurity reports both handles map to the two men arrested this week.
Should ordinary businesses worry?
Yes, indirectly. Most companies don't write software, but they run it. If a supplier's tools were tainted by TeamPCP, credentials inside that supplier may already be on criminal forums.
Data tied to the wider Cybercats circle has been offered for sale there, including records allegedly taken from BMW, Audi, Honda, Mercedes-Benz, Volvo, Toyota and Snapchat, as well as SportRadar. Customers of those firms should watch for unusual account activity and phishing emails referencing recent purchases or service records.
The arrests don't dissolve the network. Cybercats has dozens of members, and Larsen's description of it as a peer community rather than a hierarchy means losing two nodes won't stop the rest.
