Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks
Summary: Australian Federal Police charged two Western Australian men, Louis Michael Gaebler, 23, and Ruben Ian Thomson, 21, with a combined 14 offences over their alleged roles as principal participants in TeamPCP, the group behind the March 2026 compromises of Trivy, Checkmarx KICS and LiteLLM. The AFP said the malicious code potentially compromised more than 1,000 organizations globally, enabled the theft of more than 500,000 credentials, and led to the exfiltration of at least 300 gigabytes of data, with the syndicate stealing publishing credentials from trusted open-source projects and pushing poisoned releases through GitHub Actions, Docker Hub, npm, PyPI and OpenVSX.
What you should know: The chain ran on trust: credentials taken from the Trivy scanner were turned on Checkmarx KICS days later, and LiteLLM's pipeline installed Trivy without pinning it to a verified version, letting the poisoned scanner take its publishing token. Five months after removal from the PyPI index, both malicious LiteLLM builds still returned HTTP 200 from PyPI's content delivery network at their direct package URLs.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026