Two Australian men have been charged for their alleged roles in TeamPCP, a cybercrime group linked to software supply chain attacks that compromised organizations worldwide.
Australian Federal Police (AFP) arrested the men on Aug. 26 as part of a joint investigation with the Western Australia Police Force and FBI.
Authorities said the malicious code used in the attacks enabled the theft of more than 500,000 credentials and at least 300 gigabytes of data.
What stands out to me is how much damage TeamPCP allegedly caused by compromising software that organizations already trusted. Authorities estimate the resulting remediation costs are in the hundreds of millions of dollars.
TeamPCP shifted from cloud attacks to the software supply chain
TeamPCP emerged in late 2025 targeting exposed cloud infrastructure. According to Flare research, the group scanned for vulnerable services and used compromised systems to expand its operations.
By early 2026, its focus had shifted to broader software supply chain attacks.
Flare reported that TeamPCP exploited a misconfigured GitHub Actions workflow affecting Aqua Security’s Trivy vulnerability scanner in February and stole a service account token.
Although credentials were rotated following the intrusion, some access reportedly remained active.
That access became important several weeks later. On March 19, TeamPCP allegedly pushed a malicious Trivy release containing credential-stealing code into CI/CD pipelines.
The compromise then reached LiteLLM after its build pipeline ran the poisoned Trivy software.
Attackers obtained a PyPI publishing token and released two backdoored LiteLLM versions on March 24. The package receives roughly 95 million downloads per month.
Investigators traced TeamPCP through its online activity
TeamPCP maintained a visible presence online, using multiple aliases while communicating through social media and Telegram.
Flare’s investigation began with the DeadCatx3 alias and followed connections across online accounts. Investigators eventually linked reused credentials and account information to other identities associated with the group.
A profile image provided another connection. Flare found the same distinctive image associated with a Steam account and a TeamPCP Telegram account. The company said the combined evidence allowed it to assess with high confidence that it had identified an operator behind TeamPCP.
Flare later shared its findings with law enforcement.
The arrests do not mean TeamPCP has disappeared, according to Nick Ascoli, vice president at Flare, in an email to eSecurityPlanet.
“The arrests are a major disruption for TeamPCP, but it’s too early to say definitively that the group is gone,” Ascoli told eSecurityPlanet. “TeamPCP was a loose-knit group, so we don’t know how many people may still be involved.”
Australian authorities said their investigation remains active and additional arrests or charges have not been ruled out.
Stolen credentials remain an important part of the attack chain
TeamPCP’s activity shows why leaked credentials remain a problem as long as they still work.
Ascoli said organizations should not assume older leaked credentials are harmless simply because they have been exposed for some time.
“They don’t care whether a credential is old or new; they care whether it still works,” Ascoli said.
Security teams should proactively identify leaked credentials associated with their organization and determine whether they remain valid.
Any active credentials should be reset, while publishing tokens should be scoped to only the access required and given short lifetimes.
The Trivy compromise also shows why credential rotation needs to cover every credential tied to an affected environment. An overlooked token can be enough to give an attacker continued access.
Supply chain security depends on limiting trust
For organizations running open-source tools inside CI/CD pipelines, the TeamPCP attacks are another reason to examine how much access those tools receive.
Development teams can reduce risk by pinning GitHub Actions to full commit SHAs rather than mutable tags.
Security teams should also watch for unusual outbound traffic from development tools that could indicate a compromise.
The TeamPCP arrests also show the value of sharing threat intelligence with law enforcement.
Ascoli said cybercriminals often reuse online identities and infrastructure, allowing investigators to connect activity over time.
TeamPCP may have tried to hide behind aliases, but its repeated activity left investigators with connections they could follow.