Two young Western Australians have been described as the alleged "masterminds" behind a "sophisticated cybercrime syndicate" that created malicious software to rob hundreds of organisations around the world.
Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23, were arrested in Perth following a joint investigation with federal and state police working alongside the US Federal Bureau of Investigation (FBI).
The FBI's Assistant Law Enforcement Attache Dave Andish said Mr Thomson was the alleged leader of the highly organised syndicate known as TeamPCP, which police say is involved in large-scale cybercrimes including data intrusion, identity crime and cryptocurrency-based money laundering.
The pair faced court today charged with 14 offences in total after police raided properties in Cottesloe, Hamilton Hill and Mandurah where electronic devices and other items were seized.
During a bail application for Mr Thomson, the prosecutor described the men as "masterminds" in the offending, saying further charges were likely.
Investigations began in April after the Australian Federal Police and the FBI received tip offs about the syndicate, which allegedly inserted malicious code into open source software available online that was then unwittingly used by other developers.
The term 'open source' refers to content that developers can modify and share because its design is publicly accessible.
Police will allege the infected software made its way into computer systems across government, academic and private sector institutions, potentially compromising more than 1,000 organisations globally.
The software allegedly enabled the syndicate to infiltrate those organisations to steal or harvest sensitive data, including more than 500,000 user credentials and authentication materials.
AFP Commander Graeme Marshall said this allowed the group to allegedly impersonate legitimate users, bypass security controls and gain unauthorised access to networks and cloud environments.
Commander Marshall said this resulted in "significant" financial losses and interruptions to operations, with remediation costs estimated to be in the hundreds of millions of dollars.
He could not confirm how many individuals, businesses or countries were implicated, but confirmed some of the organisations that fell victim to the syndicate are Australian.
"It is rare to have cyber criminals of this status domestically", he said.
Commenting on the young age of the alleged offenders, Commander Marshall said it was unfortunate, but not unusual, to arrest people in their early twenties, and even high-schoolers, for cybercrime.
"We do see a lot of young offenders involved in cybercrime … some of them are exceptionally smart," he said.
"They've grown up in a cyber-native environment, and for whatever reason they've decided to go down that pathway."
During the bail application, Mr Thomson's lawyer Nick Scerri told the court a trial could be more than 18 months away, and that his client could be released to stay with his parents in Cottesloe.
The magistrate said she was not going to grant bail, expressing concern that Mr Thomson may be able to tamper with evidence.
Mr Scerri withdrew the bail application, which may now be heard on another day.
Mr Gaebler's lawyer made no application for bail and his client was remanded in custody for his next appearance on September 18.
Police said they have already extracted 100 terabytes of data from devices seized from one address, and expect to extract much more.
They say there may be more arrests as investigations continue.
