“These men are allegedly members of the cybercriminal group TeamPCP, whose malicious code potentially compromised more than a thousand organizations worldwide,” said Brett Leatherman, assistant director of the FBI’s Cyber Division.
Arrests and charges in Western Australia
Australian authorities arrested two men in Western Australia on Wednesday for alleged roles in TeamPCP, a cybercrime syndicate accused of inserting malicious code into widely used open-source software. Australian media identified the suspects as Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23. Police searched properties and seized electronic devices for forensic testing.
Thomson faces eight charges, including four counts of unauthorized data modification, dealing in criminal proceeds worth $100,000 or more, and refusal to comply with an order to hand over device passwords. Gaebler faces six related counts. The Australian Federal Police worked with the Western Australia Police Force (WAPF) and the Federal Bureau of Investigation in the investigation. Investigators said further arrests have not been ruled out. The two men are due to appear in Australian court on Thursday.
The Trivy compromise and the March 19 supply‑chain push
TeamPCP activity escalated sharply in early 2026. In late February the group exploited a misconfigured workflow in Trivy, Aqua Security’s widely used vulnerability scanner, and stole a service-account token. Aqua Security replaced the credentials, but investigators say some tokens were missed. On March 19, TeamPCP pushed a malicious Trivy release through every distribution channel at once, embedding malware into thousands of automated build pipelines.
Downstream victims of that campaign included the European Commission and GitHub, according to investigators. The breach chain tied to the Trivy incident was a central vector in a weeks‑long supply‑chain disruption.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coveragemini Shai‑Hulud, targeted libraries, and estimated impact
In May, investigators attributed a self‑replicating piece of malware called “mini Shai‑Hulud” to the same actors. That malware targeted prominent software libraries and developer tooling — including TanStack, UiPath, and MistralAI — embedding credential‑stealing code into components downloaded “millions of times a week,” the reporting says.
Investigators estimate the campaign exposed more than 500,000 credentials, removed at least 300 gigabytes of data, and produced global cleanup costs in the hundreds of millions of dollars. Cybersecurity researchers who shared material with CyberScoop said the group’s attacks date back as far as 2020.
Flare’s forensic trail to Ruben Thomson
Canadian threat intelligence firm Flare published work tracing an online footprint it associates with Ruben Thomson. Flare followed a GitHub alias, DeadCatx3, to a bug‑bounty account under the name Ruben Thomson and a profile listing masscan[.]cloud — a domain Flare says served as a command server for mini Shai‑Hulud.
Flare reported that a password tied to a school email address led researchers to databases of stolen credentials and a trove of accounts: a personal Google account, a TikTok profile under Thomson’s name, and a Steam gaming page showing a cat seated before several monitors. That cat image appeared on a TeamPCP Telegram identity. Flare assessed with high confidence that Thomson ran the group and said it confirmed the findings with law enforcement.
What this means for Aqua Security, the European Commission, and open‑source maintainers
- Aqua Security: The Trivy incident shows how a misconfigured workflow and missed credential rotation can be used to push malicious releases through legitimate distribution channels. Aqua’s remediation steps and credential management decisions are now central to the incident timeline.
- European Commission and GitHub (downstream victims): Organizations that pulled compromised components have faced credential exposures and data loss; investigators say remediation has involved large‑scale credential resets and cleanup efforts tied to the March 19 release.
- Open‑source maintainers (TanStack, UiPath, MistralAI and others named): Libraries and tooling targeted by mini Shai‑Hulud demonstrate that widely downloaded projects can become propagation vectors when supply‑chain hygiene fails. The incidents underscore a need for maintainers to scrutinize automated build and distribution processes.
Law enforcement and researcher reactions
Law enforcement framed the arrests as a coordinated, international response. “We are proud to work with the Australian Federal Police and the Western Australia Police Force to impose cost on criminal actors and combat the growing threat of software supply‑chain attacks,” Brett Leatherman said.
Researchers greeted the arrests cautiously. Charlie Eriksen, lead malware researcher at Aikido Security, called the arrests a “relief,” but warned that the underlying conditions that enabled TeamPCP remain. “The conditions that produced them haven’t gone away, so there will be another TeamPCP,” Eriksen told CyberScoop in an email. “We just don’t know their name yet.”
The investigation continues. Authorities have seized devices for forensic testing, confirmed links between online handles and command infrastructure, and left open the possibility of further arrests — all while the global cleanup from months of supply‑chain compromises continues.
