Post by @briankrebs@infosec.exchange

2026-08-27 11:27 UTC

Today's story is the result of an ungodly amount of research, and I am very glad to finally be able to share it with you. Authorities in Australia have arrested two men believed to be members of TeamPCP, a prolific cybercrime and data extortion group blamed for perpetrating the longest running spree of software supply chain attacks ever. In a statement released today, the Australian Federal Police (AFP) said two unnamed suspects from Western Australia, aged 21 and 23, were arrested in connection with a “sophisticated cybercrime syndicate that allegedly created malicious open-source software to rob thousands of global businesses.” The AFP did not name the defendants, but KrebsOnSecurity learned the 21-year-old suspect’s real identity in June, and has been communicating with him ever since. This story includes interviews with TeamPCP’s self-described spokesperson, and examines clues left behind by the TeamPCP leader that likely led to his undoing. https://krebsonsecurity.com/2026/08/two-alleged-teampcp-hackers-arrested-in-australia/ #cybercrime #cybersecurity #arrest #teamcp

Replies (12)

@stux@mstdn.social 2026-08-27 12:55

@briankrebs@infosec.exchange Yay! Finally..

Open ##4552605
@EvoScale@c.im 2026-08-27 12:45

@briankrebs@infosec.exchange We can only expect more 'soft' crimes to match the harder vital infrastructure destabilization cascading worldwide. We don't have enough expertise in the hard sciences to counter that front, let alone the multiples more potential soft crimes that will only prove effective, if the criminals invest in bunkers to outlast the building mass extinction event.

Open ##5078501
@felichsdakatze@mastodon.social 2026-08-27 13:42

@briankrebs@infosec.exchange Please no one do anything to prejudice any upcoming trial, one way or another. Cheers!

Open ##5078502
@vk6flab@mastodon.radio 2026-08-27 13:43

@briankrebs@infosec.exchange They've now been named. https://www.abc.net.au/news/2026-08-27/two-wa-men-charged-after-investigation-into-alleged-cybercrime/107084796

Open ##5078503
@smlx@fosstodon.org 2026-08-27 13:58

@briankrebs@infosec.exchange there's a reference that jumped out at me https://youtu.be/4XGqnCulhQY

Open ##5078506
@AG100pct@infosec.exchange 2026-08-27 14:06

@briankrebs@infosec.exchange

Open ##5078508
@Viss@mastodon.social 2026-08-27 18:42

@briankrebs@infosec.exchange heh, i guess youre going in my sec-t presentation in 2 weeks :D

Open ##5078509
@jacques@mastodon.chester.id.au 2026-08-27 21:41

@briankrebs@infosec.exchange at last, something from Perth that isn’t canva (But also: PERTH?!!?!?? BOGAN PARADISE PERTH???)

Open ##5078510
@worik@mastodon.social 2026-08-28 07:24

@briankrebs@infosec.exchange > ...longest running spree of software supply chain attacks ever. > ...suspects from Western Australia, aged 21 and 23, were arrested Hmmm... Does not really compute. Perhaps law enforcement agencies are exaggerating something?

Open ##5078512
@adrianhollister@infosec.exchange 2026-08-28 10:07

@briankrebs@infosec.exchange Worth flagging for anyone patching downstream of this: Shai-Hulud did not exploit a vulnerability, it stole maintainer credentials from GitHub and npm through phishing. Any organisation depending on npm packages needs mandatory two-factor authentication and signed provenance for its critical dependencies, not just a CVE watch. The CRA's open-source steward obligations arrive none too soon.

Open ##5078513
@dey@mastodon.social 2026-08-28 13:02

@briankrebs@infosec.exchange respect dude for so much hard work!

Open ##5078514
@Wabbitrubber@mastodon.social 2026-08-29 14:20

@briankrebs@infosec.exchange

Open ##5078515