- Messages
- 4,003
- Likes
- 1,873
- Points
- 2,130
The Australian Federal Police (AFP) announced the arrest of two alleged members of the TeamPCP hacker group, which is linked to large-scale supply chain attacks. Investigators estimate that the group's attacks may have affected more than 1,000 organizations worldwide, and that the hackers stole over 500,000 credentials and at least 300 GB of data from their victims.
Law enforcement arrested 21-year-old Ruben Ian Thomson and 23-year-old Louis Michael Gaebler from Western Australia. They face a total of 14 charges: unauthorized access to computer systems, illegal acquisition, storage, and distribution of stolen data, and other computer crimes. Additionally, Thomson is separately charged with dealing in criminal proceeds of at least $100,000 and refusing to comply with a police request for access to electronic data. For the most serious of these charges, he faces up to 20 years in prison. The TeamPCP group gained notoriety for attacks on open-source supply chains. One of the group's most notorious attacks was the compromise of the Trivy vulnerability scanner in the spring of 2026. The data obtained during this attack was later used against Checkmarx KICS , and the infected Trivy itself entered the LiteLLM pipeline, allowing the theft of an access token. As a result, the hackers were able to publish infected versions of LiteLLM to PyPI. Recently, experts from CloudSEK and Hudson Rock calculated that in just 40 minutes, while malicious versions of LiteLLM were spreading via PyPI, the attackers stole secrets from 434,000 CI/CD pipelines. According to the researchers, the victims included some of the world's largest technology and industrial companies, and the hackers stole terabytes of data. TeamPCP has also been linked to the compromise of Telnyx , SAP, and TanStack packages , and organizations affected by the group's activities include the European Commission , Mistral AI, GitHub, OpenAI, and others. AFP investigators estimate that the companies' costs of remediating these attacks already amount to hundreds of millions of dollars. Furthermore, police claim that Thomson and Gabler received cryptocurrency payments for participating in TeamPCP operations, although the exact amount is still being investigated. The investigation began in April 2026 after the AFP and FBI received information about TeamPCP from several information security companies. During searches, law enforcement officers seized electronic devices and a large amount of suspected stolen data, which will now be analyzed by forensic experts.
AFP representatives emphasize that the investigation into the hacking group's activities is ongoing, so further charges and arrests may follow.
It is worth noting that independent security journalist Brian Krebs conducted his own investigation and published his findings after the arrests of Thomson and Gabler. He writes that he discovered Thomson's true identity as early as June 2026 and subsequently communicated directly with him for several months.
According to Krebs, Thomson used multiple aliases, including EllisD25, LSD, BulkDMT, Express, and Persy_PCP, and these accounts were linked thanks to a number of significant OPSEC flaws: for example, the identical IDs "Tox" and "Session," which were posted on different hacking forums, helped.
Furthermore, one of the IP addresses associated with Thomson's "ChristmasSnow" account had been used for several years by his family's home servers in Perth. Another lead was discovered thanks to the address ruben@securecomputing.au , which was linked to Thomson's Airbnb profile, where he explicitly described himself as "friends call me Ellis."
Furthermore, in 2025, Thomson registered on the HackerOne platform under his real name and chose the nickname Deadcatx3, which security companies had already linked to TeamPCP.
Ironically, among the Australian companies registered by Thomson, there was even a firm called OPSEC Express, while Express was one of his aliases on Breachforums.
In conversations with Krebs, Ellis claimed to have stepped down from TeamPCP in March 2026, shortly before the attack on LiteLLM, and that leadership of the group had passed to another person. He also claimed to have earned only about $20,000 during his entire tenure with TeamPCP.
About two weeks before his arrest, Thomson told the journalist that he wanted to retire from cybercrime once and for all and was ready to surrender to the authorities.
Law enforcement arrested 21-year-old Ruben Ian Thomson and 23-year-old Louis Michael Gaebler from Western Australia. They face a total of 14 charges: unauthorized access to computer systems, illegal acquisition, storage, and distribution of stolen data, and other computer crimes. Additionally, Thomson is separately charged with dealing in criminal proceeds of at least $100,000 and refusing to comply with a police request for access to electronic data. For the most serious of these charges, he faces up to 20 years in prison. The TeamPCP group gained notoriety for attacks on open-source supply chains. One of the group's most notorious attacks was the compromise of the Trivy vulnerability scanner in the spring of 2026. The data obtained during this attack was later used against Checkmarx KICS , and the infected Trivy itself entered the LiteLLM pipeline, allowing the theft of an access token. As a result, the hackers were able to publish infected versions of LiteLLM to PyPI. Recently, experts from CloudSEK and Hudson Rock calculated that in just 40 minutes, while malicious versions of LiteLLM were spreading via PyPI, the attackers stole secrets from 434,000 CI/CD pipelines. According to the researchers, the victims included some of the world's largest technology and industrial companies, and the hackers stole terabytes of data. TeamPCP has also been linked to the compromise of Telnyx , SAP, and TanStack packages , and organizations affected by the group's activities include the European Commission , Mistral AI, GitHub, OpenAI, and others. AFP investigators estimate that the companies' costs of remediating these attacks already amount to hundreds of millions of dollars. Furthermore, police claim that Thomson and Gabler received cryptocurrency payments for participating in TeamPCP operations, although the exact amount is still being investigated. The investigation began in April 2026 after the AFP and FBI received information about TeamPCP from several information security companies. During searches, law enforcement officers seized electronic devices and a large amount of suspected stolen data, which will now be analyzed by forensic experts.
AFP representatives emphasize that the investigation into the hacking group's activities is ongoing, so further charges and arrests may follow.
It is worth noting that independent security journalist Brian Krebs conducted his own investigation and published his findings after the arrests of Thomson and Gabler. He writes that he discovered Thomson's true identity as early as June 2026 and subsequently communicated directly with him for several months.
According to Krebs, Thomson used multiple aliases, including EllisD25, LSD, BulkDMT, Express, and Persy_PCP, and these accounts were linked thanks to a number of significant OPSEC flaws: for example, the identical IDs "Tox" and "Session," which were posted on different hacking forums, helped.
Furthermore, one of the IP addresses associated with Thomson's "ChristmasSnow" account had been used for several years by his family's home servers in Perth. Another lead was discovered thanks to the address ruben@securecomputing.au , which was linked to Thomson's Airbnb profile, where he explicitly described himself as "friends call me Ellis."
Furthermore, in 2025, Thomson registered on the HackerOne platform under his real name and chose the nickname Deadcatx3, which security companies had already linked to TeamPCP.
Ironically, among the Australian companies registered by Thomson, there was even a firm called OPSEC Express, while Express was one of his aliases on Breachforums.
In conversations with Krebs, Ellis claimed to have stepped down from TeamPCP in March 2026, shortly before the attack on LiteLLM, and that leadership of the group had passed to another person. He also claimed to have earned only about $20,000 during his entire tenure with TeamPCP.
About two weeks before his arrest, Thomson told the journalist that he wanted to retire from cybercrime once and for all and was ready to surrender to the authorities.