The Australian Federal Police arrested two men in Western Australia on August 26, 2026 over the supply-chain attack campaign that has disrupted the open-source software ecosystem for the past year. Australian media identified them as Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23, arrested in Cottesloe and Mandurah respectively.

Both appeared in Perth Magistrates Court on August 27, facing a combined 14 offences. Thomson was denied bail. Both are in custody with a next appearance scheduled for September 18.

The AFP executed search warrants in Perth with the Western Australia Police Force and assistance from the FBI. The investigation opened in April 2026, after the AFP and FBI received information from cybersecurity firms.

What TeamPCP did

TeamPCP built its reputation on attacking the developer supply chain rather than end users — poisoning the packages, registries and CI systems that thousands of organizations pull code from automatically.

The campaign timeline, as documented by researchers and now by the AFP:

  • Late 2025 — the group emerges and deploys the Shai-Hulud self-replicating npm worm
  • March 2026 — compromise of LiteLLM, affecting 2,500+ organizations
  • May 2026 — the group claims 3,800 GitHub repository compromises
  • June 2026 — TeamPCP launches a $1,000 XMR supply-chain competition, effectively crowdsourcing attacks against open-source projects

Attributed victims span package ecosystems and the organizations that consume them: Trivy, LiteLLM, Telnyx, SAP and TanStack packages, alongside direct breaches of the European Commission, Mistral AI, OpenAI, GitHub and Mercor.

The LiteLLM compromise alone — which we covered when it broke — reached downstream into BMW Group, Audi, Honda, Mercedes-Benz, Volvo, Toyota, Snapchat, Novo Nordisk, LexisNexis and Avnet, among more than 2,500 companies that had the package in their dependency tree.

The AFP’s aggregate figures: malicious code distributed by TeamPCP potentially compromised over a thousand organizations worldwide, enabling theft of half a million credentials and exfiltration of at least 300GB of data. Global remediation costs are estimated in the hundreds of millions of dollars.

$20,000

Thomson claimed he earned approximately $20,000 in total from TeamPCP activities.

Set that against hundreds of millions in remediation cost and the asymmetry is the entire lesson of modern supply-chain attacks. Two people in Western Australia, working for what amounts to a part-time wage, imposed costs on the global economy roughly four orders of magnitude larger than what they extracted.

This is not because the attacks were sophisticated. It is because the ecosystem is built on transitive trust. A developer adds one dependency; that dependency pulls forty more; CI pipelines resolve them automatically on every build; and a single poisoned package propagates to every organization that runs npm install before anyone notices. The attacker’s cost is one compromised maintainer account. The defenders’ cost is every affected organization independently auditing, rotating and rebuilding.

The financial motive appears to have been secondary in any case. Krebs on Security’s reporting captures the actual draw in a quote from Thomson about why cybercrime groups appeal: “There are actual rewards and incentives to learn and you grow with your team.”

That is a description of an apprenticeship, not a business. It is the same dynamic driving The Com, Scattered Spider and the broader English-speaking cybercrime scene: young men who find in these groups the structure, mentorship and status that legitimate paths were not offering them fast enough.

The handles

Krebs documented an extensive alias history for both men — the kind of accumulated OPSEC debt that eventually resolves an investigation.

Thomson allegedly operated as @pcpcats, EllisD25/LSD, BulkDMT, Express, Deadcatx3 and Persy_PCP, with associated email addresses including sheepstealing@gmail.com, surfinup8@gmail.com and shitstickpp@gmail.com.

Gaebler allegedly used @pcpcasper, Boxturtle and @xpl0itrsturtle.

The pattern is the standard one. Persistent identity across years of forum activity, Telegram channels and Twitter presence, reused email addresses linking pseudonyms to each other and eventually to real infrastructure. The technical attacks were competent. The identity hygiene was not, and it rarely is when the operator is building a reputation rather than hiding.

What arrests fix and what they don’t

The AFP and FBI deserve the win. An eleven-month investigation from first tip to arrest, across jurisdictions, on a case with no single obvious victim to drive the referral, is fast work.

It changes very little about the underlying exposure.

Every malicious package TeamPCP published has already been consumed. The half-million stolen credentials are already in circulation and will be traded independently of whether their thieves are in custody. The 3,800 compromised GitHub repositories were compromised in May. And the $1,000 XMR supply-chain competition the group ran in June was explicitly designed to seed the technique among people who are not Thomson and Gaebler.

The structural problem is untouched. Package registries still permit maintainer account takeover to publish to millions of downstream consumers. CI systems still resolve dependencies automatically at build time. Most organizations still cannot answer, on demand, what is actually in their dependency tree — which is why the DPRK campaign against the Rust arrayref and proc-macro1 crates worked last week using the same playbook, run by an entirely different adversary with entirely different motives.

As our mid-year review of 2026 law enforcement action documented, the arrest tempo against English-speaking cybercrime has increased dramatically. So has the offence rate. Both things are true.

What organizations should do

Arrests do not remediate exposure. If your organization consumed any TeamPCP-affected package:

  1. Rotate every credential reachable from your CI/CD environment — registry tokens, cloud keys, signing keys, deploy keys. Assume anything a build job could read was read.
  2. Audit build logs back to late 2025 for unexpected network egress during dependency resolution.
  3. Pin dependencies by hash, not by version range. A pinned version can be republished; a pinned hash cannot.
  4. Separate build and deploy credentials. A CI job that can read production secrets is a supply-chain attack that already succeeded.
  5. Generate and retain SBOMs. The organizations that responded fastest to LiteLLM were the ones that could answer “do we use this?” in minutes rather than days.

Sources