An undercover Google analyst infiltrated a notorious supply-chain hacking gang
ars ·
TeamPCP, a hacker group that emerged online in late 2025, conducted a major campaign by compromising open-source projects, stealing developer credentials, and using malware—including the Mini Shai-Hulud worm—to spread to more than a thousand companies. Google Threat Intelligence researcher Austin Larsen says a Mandiant undercover analyst gained access to TeamPCP’s inner circle and its CanisterWorm chat in March, monitoring the group without participating in illegal activity. The access let Google identify stolen credentials, alert cloud and other service providers to revoke them, warn victims, and help a software maker patch a two-factor-authentication bypass exploit developed with an AI tool. Another partner, ShinyHunters, later betrayed TeamPCP and gave Google a chat log, while Google investigators traced an active member’s online aliases and a Google Drive used to store stolen data to Australian suspect Ruben Ian Thomson. Thomson and Louis Michael Gaebler were arrested in Australia last month and charged in connection with the group, although authorities have not publicly commented on the active investigation. Google says the operation reflects a broader shift toward actively disrupting cybercrime through its Cyber Disruption Unit rather than only publishing threat reports.
ars