Executive Overview
In a coordinated international sweep involving the Australian Federal Police (AFP), the Federal Bureau of Investigation (FBI), and local law enforcement, authorities in Western Australia have arrested two men accused of anchoring TeamPCP, a prolific and destructive cybercrime syndicate. The suspects—identified in subsequent media reports as 21-year-old Ruben Ian Thomson and 23-year-old Michael Gaebler—face a combined 14 cybercrime offenses following a joint disruption operation.
TeamPCP rose to notoriety in late 2025 as the orchestrator of what security experts have confirmed to be the longest-running and most expansive software supply chain attack spree in history. Operating through a decentralized network of threat actors, the group weaponized open-source ecosystems, deployed the self-propagating "Shai-Hulud" worm, and breached thousands of global enterprises—including automotive giants, pharmaceutical corporations, and crucial artificial intelligence infrastructure.
Yet, despite their technical sophistication, the syndicate’s downfall was ultimately sealed by a cascade of fundamental operational security (OpSEC) failures, public bravado, and a trail of digital breadcrumbs linking aliases on cybercrime forums to real-world identities in Cottesloe, a beachside suburb of Perth. This investigation explores the anatomy of TeamPCP’s rise, the meticulous tracking that led to their arrest, and the profound legacy they leave on global software supply chain security.
Detailed Chronology: The Rise and Fall of TeamPCP
Genesis and the Shai-Hulud Campaign (Late 2025)
TeamPCP burst onto the international threat landscape in late 2025, carving a path of destruction through public code repositories like GitHub and the Node Package Manager (NPM). Rather than relying solely on traditional phishing or perimeter breaches, the group pioneered a cyclical form of developer exploitation.
According to security analysts, TeamPCP members phished or stole credentials from legitimate software developers, injecting malicious code into widely used open-source libraries. When other developers pulled these libraries into their own working environments, the malware infected their machines, harvesting downstream credentials and allowing the group to compromise an ever-expanding web of corporate networks.
At the heart of this campaign was Shai-Hulud, a self-propagating worm that automated the insertion of malicious payloads. The worm’s iterative updates culminated in May 2026 with the release of Shai-Hulud 3.0 source code. To accelerate their reach, TeamPCP launched a bizarre gamified contest on Telegram, offering a Monero (XMR) cryptocurrency bounty to participants who could compromise the highest volume of weekly and monthly software downloads. What appeared to be a hacking competition was, in reality, a mass recruitment drive designed to harvest malicious access at scale.
Targeting AI Infrastructure and Corporate Giants
As their capabilities scaled, TeamPCP expanded their crosshairs beyond traditional software development tools. In March 2026, the group executed a landmark supply chain attack against LiteLLM, an open-source AI gateway linking users to over 100 large language models (LLMs). Security firm CloudSEK later revealed that this single breach harvested cloud service keys and sensitive secrets from more than 2,500 organizations, including many of the world’s leading technology companies.
By May 2026, TeamPCP claimed responsibility for breaching at least 3,800 code repositories on Microsoft-owned GitHub. This brazen exploit cycle eventually forced a reckoning within the software industry, humiliating tech giants into confronting systemic vulnerabilities in their trust models.
The "Cybercats" and the Descent into Chaos
Security researchers have characterized TeamPCP not as a monolithic gang, but as a peer-driven amalgamation of actors from various cybercriminal undergrounds. This loose confederation operated heavily within a Matrix chat server dubbed "Cybercats," created by an accomplished security researcher and exploit developer known by the handle @kernelstub (linked to George Prepakis).
Within the Cybercats server, key administrators coordinated data ransoms and extortion plots. Notable figures included:
- Boxturtle (
@xpl0itrsturtle): Linked to Breachforums and Darkforums, this persona brokered data stolen from major automotive manufacturers—including BMW, Audi, Honda, Mercedes-Benz, Volvo, and Toyota—as well as Snapchat and SportRadar. - SeesawSec: The alias behind Fulcrumsec, which claimed credit for extortion campaigns targeting pharmaceutical giant Novo Nordisk, data broker LexisNexis, and Fortune 500 distributor Avnet.
@pcpcasper(Michael Gaebler): A vocal member whose Telegram activity linked him to the Australian neo-Nazi political organization, the National Socialist Network, and placed him geographically in Western Australia.@pcpcats/ "T" / "Ellis": The self-described TeamPCP spokesperson and core leader whose struggles with substance abuse, long bouts of insomnia, and careless digital footprint ultimately unravelled the syndicate.
Supporting Context & Metrics
The velocity and impact of TeamPCP’s operations are underscored by several key data points collected by threat intelligence firms throughout 2025 and 2026:
- 2,500+ Organizations: Compromised during a single supply chain attack on LiteLLM in March 2026, leaking crucial cloud service credentials and API keys.
- 3,800 Code Repositories: Successfully targeted and breached on GitHub following a developer workstation compromise in May 2026.
- Major Automotive Brands: Data extortion targets brokered by TeamPCP associates included BMW, Audi, Honda, Mercedes-Benz, Volvo, and Toyota.
- 14 Cybercrime Charges: Levied collectively against the two Western Australian suspects following the joint AFP-FBI-WAPF disruption operation.
- 3-Day Cooldown: The mandatory waiting period introduced by GitHub for Dependabot updates in late July 2026, directly spurred by the vulnerabilities exposed during TeamPCP’s campaign.
Official Statements and Investigative Breakthroughs
The dismantling of TeamPCP was made possible by a combination of international law enforcement cooperation and relentless open-source intelligence (OSINT) tracking by cybersecurity journalists and researchers, notably KrebsOnSecurity.
The Law Enforcement Response
In an official statement released in August 2026, the Australian Federal Police confirmed the arrest of two Western Australian men, aged 21 and 23, in connection with a sophisticated cybercrime syndicate that utilized malicious open-source software to defraud thousands of global businesses.
Subsequent updates from Australian Broadcasting Corporation (ABC) news confirmed that 21-year-old Ruben Ian Thomson of Cottesloe was denied bail, while 23-year-old Michael Gaebler was also held in custody. Both men were scheduled to appear in the Perth Magistrates Court to face charges encompassing multiple counts of unauthorized access, extortion, and data theft.
The Anatomy of an OpSEC Collapse
Despite their technical prowess in exploiting global software pipelines, TeamPCP’s leadership suffered from catastrophic operational security failures. Intelligence firms including Intel 471, Flashpoint, SpyCloud, and DomainTools pieced together a definitive trail connecting the syndicate’s key alias—EllisD25/LSD, BulkDMT, and Express—to Ruben Thomson.
Key investigative threads included:
- Email and Account Continuity: The email address
[email protected]tied the forum handle Express to an older Raidforums account named ChristmasSnow, which was accessed primarily via Internet service providers in Perth, Australia. - Passive DNS and Public Records: DomainTools and Constella Intelligence linked Perth IP addresses to family infrastructure associated with Ian Thomson, a Cottesloe dentist originally from South Africa. Ruben Thomson’s brother, Ruben’s own professional profiles on Upwork and Airbnb (where he noted his friends call him "Ellis"), and local business registrations in Western Australia (such as OPSEC Express and Tensor Industries) mapped directly to his digital footprint.
- The Ultimate Irony: In June 2025, Ruben Thomson registered an account on the bug bounty platform HackerOne under the username Deadcatx3—an alias already flagged by multiple security firms as a primary handle used by TeamPCP. Furthermore, registering corporate entities using variations of their cybercrime handles directly violated the core tenets of operational security.
An Inside Look: Interview with "Ellis"
In early July 2026, KrebsOnSecurity conducted an exclusive Signal interview with Ruben "Ellis" Thomson shortly before his arrest. Ellis was remarkably candid about his motivations, admitting that he stepped away from active cybercrime for TeamPCP in March 2026.
Reflecting on his journey from homelessness and substance abuse to leading a global cybercrime syndicate, Ellis remarked:
"Blackhatting is fun. There are actual rewards and incentives to learn and you grow with your team. Without qualifications, no employer will even take the time to hear you out."
Ellis claimed he earned a total of roughly $20,000 through his activities with TeamPCP, insisting it was driven more by a search for community and intellectual stimulation than financial greed. Despite expressing gratitude for escaping immediate poverty, Ellis acknowledged his struggles with addiction—frequently referencing cycles of consuming ketamine, DMT, and 2CB—and expressed a resigned acceptance of his inevitable apprehension by law enforcement.
Future Outlook: A Permanent Shift in Supply Chain Security
The arrest of the TeamPCP leaders marks the end of an era, but the ripple effects of their campaign will permanently alter how the software industry approaches development security.
Charlie Eriksen, a security researcher at Aikido Security, noted that TeamPCP represents a new breed of threat actor that defies traditional classification:
"They are not a state actor, not quite organized cybercrime, and not purely ideological. Their motivations seem to mix money, disruption, attention, and ideology."
Eriksen emphasized that the proliferation of Large Language Models (LLMs) has dangerously compressed the barrier to entry in cybercrime. Threat actors can now scale operations rapidly without necessarily possessing the operational discipline or foresight of traditional organized crime syndicates, rendering them simultaneously noisier and more dangerous.
However, TeamPCP’s aggressive exploitation ultimately served as a painful catalyst for necessary structural reform. In July 2026, Microsoft responded to the GitHub breaches by implementing a mandatory three-day cooldown period for Dependabot version updates, granting developers and security tools crucial breathing room to vet newly published package dependencies before automatic deployment. Similar safeguards were adopted across Python and JavaScript ecosystems.
As Ruben Thomson and Michael Gaebler face justice in the Perth Magistrates Court, the legacy of TeamPCP will be remembered not merely as a cautionary tale of reckless opsec and digital self-destruction, but as the disruption that finally forced the global technology sector to secure the invisible supply chain upon which the modern digital economy runs.
