Google Infiltrated TeamPCP Hacking Group, Disrupted Supply Chain Attacks

Inside the Operation

Google embedded an undercover analyst within TeamPCP's core membership during the hacking group's unprecedented supply chain attack campaign, according to details revealed at the LABScon security conference. The infiltration allowed Google to monitor the group's activities in real time, warn breach victims, and help disrupt extortion attempts before two alleged leaders were arrested in Australia last month.

Austin Larsen, a researcher with Google Threat Intelligence Group, disclosed that a Mandiant analyst gained access to TeamPCP's inner circle in March, just as the group began its cascading series of breaches. The analyst was among roughly 12 members invited to a core chat channel called CanisterWorm, providing visibility into the group's operations from nearly day one of its public activity.

TeamPCP executed what members themselves described as potentially "the biggest supplychain maybe ever recorded in modern history." The group compromised open-source tools including the security scanner Trivy, AI platform LiteLLM, and infrastructure at Checkmarx, using each breach to steal developer credentials and plant malware in additional widely used software. The attacks ultimately breached GitHub, data contractor Mercor, employee devices at OpenAI, the European Commission, and more than a thousand other organizations, according to details first reported by WIRED.

Disrupting the Extortion Scheme

Google's embedded analyst gained access to a server where TeamPCP stored credentials stolen from victims—usernames, passwords, and access tokens the group planned to use for extortion. Rather than alerting individual victim companies, which would have been too slow given the scale, Google's team contacted cloud providers like Amazon Web Services and Microsoft to have the credentials revoked.

The team sent hundreds of notification emails to providers and victims. The inside access also revealed that someone in TeamPCP's core circle was using AI to develop a zero-day exploit targeting two-factor authentication in widely used login software. Google obtained the exploit code, confirmed it worked with minor modifications, and warned the software developer, who patched the vulnerability.

Operational Security Failures

Despite amassing credentials for more than half a million users, TeamPCP struggled to monetize its haul, pulling in only tens of thousands of dollars rather than millions, according to Larsen's estimates. The group invited other cybercriminal operations to partner on extortions, including ShinyHunters, a prolific hacking group responsible for breaches including the Canvas educational platform attack.

ShinyHunters later went rogue, conducting extortions without sharing proceeds with TeamPCP. The betrayal prompted TeamPCP to narrow its inner circle and move stolen data to a new server, ejecting both ShinyHunters and Google's undercover analyst from the chat.

Traditional investigative work then filled the gap. Larsen traced one active TeamPCP handle to a Gmail address found in leaked BreachForums data. Forum archives from 2019 connected that address to a PayPal account tied to ruben@thomsonfamily.net.au. When TeamPCP's new server was backed up to a Google Drive using the same Gmail account, Google provided a tip to the FBI.

Ruben Ian Thomson and Louis Michael Gaebler, both Australians in their early twenties, were arrested by Australian Federal Police last month and charged with hacking crimes. Authorities described them as "principal participants" in TeamPCP.

Why it matters

The operation marks a shift toward active disruption by Google's threat intelligence division, launched as part of the company's Cyber Disruption Unit. By embedding an analyst and taking direct action to revoke stolen credentials, Google moved beyond traditional threat reporting to actively interfere with an ongoing criminal operation—a model that could reshape how major technology companies respond to sophisticated hacking campaigns targeting their ecosystems.

Larsen emphasized the analyst acted only as an observer and never engaged in illegal activity or encouraged breaches. The investigation details were first reported by WIRED.