Australian Federal Police have arrested two men from Western Australia — aged 21 and 23 — accused of being members of TeamPCP, a cybercrime group that ran what investigators describe as the longest software supply chain attack spree ever recorded. The arrests follow months of infiltration and identity-tracing work by law enforcement on multiple continents.
TeamPCP rose to infamy in late 2025 by embedding malicious code in hundreds of open source software tools. The group’s main weapon was a self-propagating worm called Shai-Hulud that worked in cycles: hackers would phish a developer’s credentials at GitHub or NPM, plant malware in a tool that developer maintained, then harvest credentials from everyone who downloaded that tool — and repeat the process across a growing web of compromised networks. A March 2026 attack on LiteLLM, an open source AI gateway used to connect to more than 100 different large language models, resulted in cloud service keys and secrets being stolen from more than 2,500 organizations, including major technology companies. TeamPCP also claimed responsibility for compromising 3,800 code repositories at GitHub after a developer installed a compromised code extension.
The group’s behavior became increasingly brazen. In May, TeamPCP published the source code for the third version of Shai-Hulud and ran a public contest offering $1,000 in Monero to whichever participant could execute the largest supply chain operation using the worm — scored by weekly and monthly download counts of compromised packages, directly incentivizing attacks on the most popular libraries. Security firm Dataminr noted that the prize was described internally as a “participation trophy,” with larger payments promised for high-value access.
Krebs on Security identified the alleged leader of TeamPCP — known online as @pcpcats — as a 21-year-old from Western Australia, after tracing messages in a Matrix chat server called “Cybercats” that also linked TeamPCP to other data extortion groups including Fulcrumsec and a data broker operating as “xpl0itrs.” The Cybercats group includes administrators associated with BMW, Audi, Honda, Mercedes-Benz, Volvo, Toyota, Snapchat, and SportRadar data theft operations.