Australian Authorities Arrest Two Alleged TeamPCP Hackers Linked to 1,000+ Global Infections

Australian authorities arrested two men this week, accusing them of involvement with the prolific hacking group TeamPCP, which is responsible for infecting over 1,000 organizations worldwide through a series of supply-chain attacks. The arrests, made by the Australian Federal Police (AFP), target individuals linked to a nine-month campaign of cybercrime that began in December.

The two men face 14 charges related to their alleged participation in TeamPCP's activities. They were apprehended in the Western Australian towns of Cottesloe and Mandurah, according to a statement from the AFP. While the police statement did not identify the individuals by name, an extensive investigation by KrebsOnSecurity reportedly revealed their identities and backgrounds.

TeamPCP gained notoriety for its sustained use of supply-chain attacks, a method that involves compromising software components used by many other organizations. The group's primary tactic involved injecting malware into open-source software packages. This malicious code would then spread virally.

The malware used by TeamPCP was dubbed "Shai-Hulud" and was designed to self-propagate. It specifically targeted organizations' CI/CD pipelines, which are automated systems used for developing, updating, and deploying software rapidly.

Once a software package or tool was compromised, Shai-Hulud would attach itself to subsequent updates of that package. Developers who downloaded these compromised packages and integrated them into their own CI/CD platforms inadvertently facilitated the spread of the malware, leading to their own software becoming compromised. The group's activities have posed significant challenges for law enforcement and security professionals worldwide since its emergence.