A joint investigation by the FBI, the Australian Federal Police, and Western Australia Police Force has resulted in charges against two Western Australian men accused of operating the TeamPCP cybercrime syndicate, a group authorities allege compromised more than 1,000 organizations worldwide and harvested over 500,000 credentials through malicious code hidden in open-source software.
The AFP filed a combined 14 charges against 21-year-old Ruben Ian Thomson and 23-year-old Louis Michael Gaebler. Both men appeared before Perth Magistrates Court on Aug. 27, according to the Australian Broadcasting Corporation. Authorities executed warrants at properties in Cottesloe, Hamilton Hill, and Mandurah as part of the operation.
The charges remain allegations. The defendants have not been convicted, and the case will proceed through the courts.
A software supply-chain attack at scale
The joint investigation began in April after several cybersecurity companies supplied intelligence about malicious software distributed through an open-source repository, the AFP said in its official release.
Investigators allege TeamPCP inserted malicious code into legitimate software components used by other developers. Once incorporated into downstream systems, the modified code allegedly gave the group unauthorized access to organizations across government, academia, and the private sector. Police allege the group compromised more than 1,000 organizations, obtained over 500,000 credentials, and removed at least 300 gigabytes of data.
The technique is a classic software supply-chain attack, and its power lies in multiplication. A trusted component may be reused by hundreds of developers, allowing a single modification to reach many unrelated systems. When downstream developers pull in a poisoned package, the attacker’s code inherits every permission the legitimate software already had — often with no additional scrutiny.
Australian authorities estimated that responding organizations face remediation costs totaling hundreds of millions of dollars. That figure reflects an official estimate rather than a confirmed financial loss suffered by identified victims.
The cryptocurrency angle
Police allege the two men were principal participants in the operation and received cryptocurrency payments for their roles. Authorities said the value of those payments remains under investigation.
Notably, the official release did not identify the cryptocurrencies involved, and it did not disclose wallet addresses, transaction hashes, mixers, exchanges, or a confirmed laundering total. Reports claiming investigators seized large cryptocurrency balances or expensive property go beyond the details contained in the AFP announcement. Authorities said electronic devices and other items were seized, but they did not assign a digital-asset value to those items.
Blockchain transactions can nonetheless assist investigators when funds move through identifiable services or interact with regulated exchanges. Australian authorities previously forfeited nearly 25 Bitcoin and other assets tied to a 2013 exchange theft, demonstrating that on-chain evidence can support asset recovery years after the underlying crime.
The charges, in detail
Thomson faces one Australian charge of dealing with money or property worth at least 100,000 Australian dollars that authorities allege represented criminal proceeds. The offence carries a maximum prison sentence of 20 years. The threshold describes the charge and does not establish the final amount involved.
The United States Department of Justice separately unsealed a federal indictment against Thomson. Prosecutors charged him with conspiracy to violate the Computer Fraud and Abuse Act and obtaining information from a protected computer.
The American indictment concerns alleged TeamPCP attacks during spring 2026. Prosecutors claim malicious code scanned downstream systems, extracted sensitive information, and maintained persistent access. The Justice Department also alleges TeamPCP used stolen information to make ransom or extortion demands, with members allegedly offering not to publish victims’ data in exchange for payment. These claims have not been proven in court.
Each U.S. offence carries a maximum five-year prison term and a fine of up to 250,000 USD, or twice the alleged gross gain or victim loss. Any sentence would be determined by a federal judge after a conviction. The U.S. announcement names Thomson but does not announce a corresponding American indictment against Gaebler. Thomson remained in Australian custody when prosecutors disclosed the charges.
Why open-source repositories are a growing target
The TeamPCP case lands amid a broader escalation of attacks on the open-source software ecosystem. Because package registries and code repositories sit upstream of enormous numbers of production systems, they offer attackers an efficiency that direct intrusions cannot match: compromise one component, and every dependent organization inherits the problem.
For the crypto industry, the pattern hits close to home. Many blockchain projects, wallets, and development toolchains depend heavily on open-source packages, and several past incidents in the space have involved compromised dependencies or stolen developer tokens used to push malicious releases. A group that can seed malicious components into repositories used by crypto developers gains potential access to keys, seed phrase handling code, and signing infrastructure — a far more lucrative target than most traditional enterprise software.
The lesson for development teams, crypto or otherwise, is consistent with what security researchers have urged for years: pin dependencies, verify signatures where available, monitor for unexpected package updates, and treat even minor maintainership changes on critical dependencies as security events rather than housekeeping.
What happens next
The Australian matters will return to court, and the unsealed U.S. indictment opens the possibility of extradition proceedings depending on how the Australian case resolves. Meanwhile, organizations that used the affected open-source components face their own reckoning: identifying whether the malicious code reached their systems, rotating any credentials exposed during the compromise window, and documenting the incident for their own compliance and insurance processes.
For an industry that runs on open-source code, TeamPCP is a reminder that the cheapest way to attack a thousand organizations is to attack the code they all share.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
auto merged prs from a hijacked maintainer account and it took months to notice. every ci pipeline trusting floating tags needs to read this one twice
pinned hashes and strict lockfiles everywhere after this. the floating tag convenience tax finally came due
500,000 credentials harvested through poisoned open source code and the guys were 21 and 23. supply chain security is a joke everywhere
14 combined charges for over 1,000 orgs compromised feels light tbh. watch them walk with suspended sentences
light charges are probably a cooperation play. flip one 21 year old and the whole TeamPCP customer list opens up. they wont eat 7 years for the syndicate
charge count looks light until you try proving 1,000 separate intrusions in court. prosecutors take what they can actually win
fair point on proof, but 14 charges still hands prosecutors tons of plea leverage. the sentencing judge sees the whole syndicate file either way
AFP cyber prosecutions have been landing real sentences lately, the last two syndicate cases got 7+ years. different era from the 2019 suspended sentence days
7 years for 1000 orgs and 500k credentials is still a bargain vs what that data probably pulled. sentencing math in cyber cases never adds up
14 charges is just the opening set. feds supersede indictments all the time once they crack open the seized data, watch the count climb
exactly, and 300gb of seized data is the real leverage here. 14 charges is just the opening offer before the superseding indictment
the age thing gets me too. 21 and 23, sitting on 300GB of stolen corporate data and half a million credentials
the ages keep dropping in these crews. elite opsec on the intrusion, zero opsec on getting paid, every single time
and they took crypto payouts in a case the feds co-ran. investigators basically received a free ledger of every customer, incredible business model
^ exactly, and 500k harvested credentials means 500k chances one of them ties back to a payout wallet. chain analysis eats these crews alive
taking crypto payouts turns a permanent public ledger into a receipt for your own crimes. dumbest business model imaginable
the supply chain part scales though. one poisoned package and the blast radius is every downstream repo forever. the 500k credentials are just the bonus round
blast radius is forever until the maintainer yanks the tag. half those orgs are still running the poisoned version because their update cycle is quarterly
quarterly is generous, half of finance still runs annual change windows. those 1000 orgs will be rediscovering the poisoned package in q3 pentest reports
took crypto payments for it though. at least that gives the feds a wallet trail to follow, dumbest possible way to get paid for this
warrants in cottesloe, hamilton hill and mandurah the same morning. the AFP does not knock politely anymore
malicious code smuggled into open source packages, 500k credentials, 1000+ orgs and nobody noticed for months. every company auto-pinning dependencies should be sweating right now
500k credentials harvested and the tell was still payout hygiene, not the code. chain analysis really did make crime pay worse
one hijacked maintainer account and 1000 downstream orgs got owned. every open source maintainer reading this with a weak password right now lol
1000 orgs ate poisoned code because nobody pins lockfile hashes in ci. supply chain hardening is boring right up until it is a federal case
everyone pins the deps, audits the deps, then skips verifying the maintainer account itself. the human layer is always the actual hole