Google infiltrates TeamPCP hacker group to disrupt supply-chain attacks

Google has revealed that its threat intelligence group successfully infiltrated TeamPCP, an international hacking collective known for large-scale software supply-chain attacks. Through the use of an undercover analyst—including a persona placed within the group’s inner circle by Google’s subsidiary Mandiant—the company was able to monitor the group’s activities from the inside.

This infiltration allowed Google to track a massive hacking spree that compromised over a thousand companies by tainting hundreds of open-source programs with malware and using a Dune-themed self-spreading worm. The intelligence gathered enabled Google to warn potential victims and disrupt exploitation attempts. Google also gained access to a server containing stolen credentials.

Working alongside the FBI and the Australian Federal Police (AFP), Google provided critical information that led to the arrest of two alleged members of the group, Ruben Ian Thomson and Louis Michael Gaebler, in Australia. The investigation also benefited from intelligence provided by ShinyHunters, another cybercriminal group that had previously partnered with TeamPCP before turning against them.