Google reveals undercover analyst infiltrated TeamPCP hacking group
Security researcher embedded in notorious supply-chain attackers helped warn victims and disrupt exploits before two alleged leaders were arrested.
What to know
- Google had embedded an undercover analyst in TeamPCP's inner circle from nearly the group's inception, monitoring the unprecedented supply chain hacking spree in real time.
- TeamPCP's cascade of attacks compromised hundreds of open-source programs and breached over 1,000 companies including GitHub, OpenAI, and the European Commission.
- Google used its undercover access to warn victims, disrupt extortions, and provide law enforcement with identifying details that led to the August arrest of two alleged ringleaders in Australia.
- The group deployed a self-spreading worm called Mini Shai-Hulud (named after Dune's sandworms) to automate its malware distribution across developer tools and infrastructure.
Austin Larsen Google Threat Intelligence Group researcherRuben Ian Thomson Alleged TeamPCP leaderLouis Michael Gaebler Alleged TeamPCP leaderGoogle Threat Intelligence Group / Mandiant Security researchers and threat intelligence divisionTeamPCP Cybercriminal hacking group
How it unfolded 1 development · click the chart to see its coverage articlesposts
-
1
Google details how it disrupted TeamPCP operations from inside
Larsen reveals Google used its undercover access to monitor the hacking spree, warn breach targets including GitHub, Mercor, OpenAI, and the European Commission, and help disrupt the group's extortion attempts. Google also traced operational security mistakes by one suspect and shared identifying details with law enforcement, while receiving intelligence from ShinyHunters, a rival criminal group that turned against TeamPCP.
“One of our personas had been working for many months to build trust with one of the actors that was invited to join TeamPCP, and so was added to the group. So essentially, almost day one, Mandiant was watching everything behind the scenes.”
— Austin Larsen, Google Threat Intelligence Group researcher · source -
first by Wired, 5d ago · also Ars Technica
1 more headline
-
A
As the TeamPCP cybercrime group carried out an unprecedented spree of software supply chain hacking this year, it had been infiltrated by an undercover analyst from Google's threat intel division. Google watched from inside, warned victims, even disrupted extortions. https://www. wired.com/story/an-undercover-…
1 more of the top 2 · 5 posts in this stretch
-
NEW: A Google researcher snuck into the group chat of TeamPCP, the hacker gang responsible for the worst-ever supply chain hacking spree, allowing the company to disrupt the group's attacks. @agreenberg.bsky.social has the scoop:
-
-
background
Google reveals it had mole inside TeamPCP inner circle — Google Threat Intelligence Group researcher Austin Larsen presents findings at SentinelOne's LABScon conference detailing how Mandiant, Google's security subsidiary, embedded an undercover analyst in TeamPCP from nearly the beginning of the group's operations. The embedded persona had built months of trust with one of the hackers and was added to the group's inner circle.
-
background
Two alleged TeamPCP leaders arrested in Australia — Ruben Ian Thomson and Louis Michael Gaebler, both Australians in their early twenties, are arrested by Australian Federal Police in a joint investigation with FBI assistance and charged with hacking crimes as principal participants in TeamPCP.
-
background
TeamPCP escalates attacks on major software projects — Starting in spring 2026, TeamPCP compromises security scanner Trivy, AI tool LiteLLM, Checkmarx infrastructure, web library TanStack, and Mistral AI platform, using each breach to access more developer credentials and infect additional software.
-
background
TeamPCP emerges online and begins supply chain attacks — The hacker group first appears online in late 2025 and begins its unprecedented spree of cascading supply-chain attacks, compromising open-source software and stealing developer credentials to perpetuate malware distribution across hundreds of programs.