Australian Federal Police Arrest Two Men Linked to TeamPCP Cybercrime Group

Authorities in Australia said Wednesday that they arrested two men accused of participating in cybercrimes for TeamPCP, a prolific group of hackers that, over nine months, has carried out a relentless series of supply-chain attacks that infected more than 1,000 organizations worldwide.

In a statement, the Australian Federal Police said the two men were arrested and charged with 14 offenses. The statement said the men were members of TeamPCP, which by the authorities’ count, compromised more than 1,000 organizations worldwide. The statement didn’t identify the men, except to say they lived in the Western Australian towns of Cottesloe and Mandurah. KrebsOnSecurity, citing a lengthy investigation, provided what it reports to be both defendants’ names, along with an extensive background of their lives and the mistakes that led to their downfall.

The hacks that keep on hacking

TeamPCP has vexed law enforcement officials and security personnel around the world since it emerged in December. The group is best known for a sustained series of supply-chain attacks that laced open source software with malware that self-propagated from one package to another. The viral infections worked by targeting organizations’ CI/CD pipelines, which are used to rapidly develop, update, and deploy software.

Once a package or tool was compromised, Shai-Hulud, as the worm was dubbed, attached itself to future package updates. When developers downloaded the compromised packages and ran them through their own CI/CD platforms, their software was also compromised.

Key to Shai-Hulud’s viral ability was a separate component that collected credentials for other packages in the memory of infected hardware. Once TeamPCP had the credentials, members used them to infect those packages.

In one case, the group infected the Trivy vulnerability scanner. As reported earlier this month, the compromise went on to infect downstream packages, including KICS, the Telnyx Python SDK, and LiteLLM. Those packages were infected after their developers ran either the compromised versions of Trivy or another package that had. The initial Trivy compromise resulted in the theft of terabytes of credentials and other private data.

Shai-Hulud employed an unconventional means for ensuring its channel for collecting credentials was immune to third-party takedowns. It used a form of smart contract known as an Internet Computer Protocol-based canister. The mechanism lets the worm find control servers using URLs that could be rapidly changed at any time. Infected machines reported to the canister once every 50 minutes.

KrebsOnSecurity’s Brian Krebs said TeamPCP members lacked the operational discipline that usually accompanies a hacking group with its level of accomplishment. Citing Aikido Security researcher Charlie Eriksen, Krebs reported that traditionally, hackers at that level have had to spend considerable time researching various techniques, tailoring and troubleshooting code, and building the infrastructure to successfully carry out such campaigns. “LLMs have compressed that gap significantly,” Eriksen told Krebs.

Australian authorities say that if convicted, one of the men faces more than 20 years in prison and that the other faces more than 10.