An undercover Google analyst infiltrated a notorious supply-chain hacking gang

A Google Researcher Went Undercover Inside One of History's Worst Supply-Chain Hacking Operations

Before two of its alleged members were arrested in Australia last month, the hacker group known as TeamPCP pulled off a spree that makes most cybercriminal operations look like amateur hour. They poisoned hundreds of open-source packages with malware, hijacked developer accounts to keep the chain going, and built a self-spreading worm named after a Dune sandworm to automate the whole thing. The end result: more than a thousand companies compromised.

What makes the story more interesting is that Google's threat intelligence team had a front-row seat. Not from outside. From within. A Mandiant analyst, working undercover, had infiltrated TeamPCP's inner circle almost from the start. The operation gave Google the ability to watch the hacks unfold in real time, warn victims before they could be extorted, and feed identifying details to the FBI. Austin Larsen, a researcher at Google Threat Intelligence Group, presented the findings at SentinelOne's LABScon conference this week.

How TeamPCP Built Its Cascade

TeamPCP first appeared online in late 2025. The group's method was simple but devastating: compromise one open-source project, steal the developer credentials stored in it, then use those credentials to compromise the next project. Each breach fed the next. The pattern repeated across dozens of tools that developers rely on daily.

Starting in spring 2026, the group hit Trivy, the widely used open-source security scanner. Then LiteLLM, an AI API tool. Then Checkmarx's web application security infrastructure. Then TanStack, a popular web app library. Then Mistral AI, the enterprise AI platform. Each compromise gave them fresh credentials to work with, letting them cast a wider net each time.

The scale was staggering. The group eventually breached GitHub itself, along with data contracting firm Mercor, employee devices at OpenAI, and infrastructure at the European Commission. Hundreds of other organizations went unnamed in public reporting. At various points, the group deployed a worm called Mini Shai-Hulud, named after the sandworms from Frank Herbert's Dune, to automate the credential theft and scale the campaign further.

A leaked chat message from a TeamPCP member captured the group's own assessment: "You guys should understand that we pulled off the biggest supplychain [sic] maybe ever recorded in modern history."

The Mole in the Inner Circle

Google's undercover analyst was invited into the group's core chat, called CanisterWorm, in March 2026, just as the supply-chain attacks were ramping up. The analyst was one of roughly a dozen members with access to that channel. From inside, the analyst could see the group's plans, its stolen credentials repository, and its internal discussions about targets and monetization.

The analyst maintained a low profile, saying just enough to avoid suspicion. Larsen emphasized that the operative never participated in or encouraged any hacking. The goal was observation and disruption, not infiltration for the sake of gathering evidence. Google's team used the access to map the full scope of the stolen credential trove and to figure out where those credentials could be exploited.

Rather than notify each victim company individually, which would have taken weeks given the number of breached organizations, Google contacted the cloud and identity providers where the stolen credentials were active. AWS and Microsoft received hundreds of notification emails asking them to revoke access tokens before the hackers could use them for extortion. Many victims responded immediately once they understood the scope.

The AI-Generated Zero-Day

One of the more alarming findings from the inside view was a separate project within TeamPCP. A member of the group's core circle was using an AI tool to develop a zero-day exploit against a widely used piece of login software. The exploit would have allowed two-factor authentication bypass. Google obtained a copy of the exploit code, tested it, and confirmed that with minor modifications it worked against the software in question.

Google had described this incident in a case study released in May but had not publicly linked it to TeamPCP or explained how it discovered the vulnerability. The detail that a cybercriminal group used an AI model to produce a working zero-day exploit is one of the clearest real-world examples yet of AI being used for offensive security research. The login software's developer patched the flaw after Google's warning.

Betrayal, Sloppy Opsec, and Arrests

TeamPCP's problems multiplied when it tried to monetize its haul. Despite collecting more than half a million user credentials, the group was only pulling in tens of thousands of dollars in extortion payments. To do better, it invited other cybercriminal groups to partner, giving them access to the credential stash in exchange for a cut of any ransoms they collected.

ShinyHunters, a prolific extortion group responsible for breaches including the attack on educational platform Canvas that disrupted thousands of US schools, took the deal and then broke it. Within weeks, ShinyHunters started extorting victims on its own using TeamPCP's credentials, without paying the promised share. ShinyHunters even sent Larsen a full log of the group's chat on TeamPCP's server without realizing Google already had an analyst inside.

The public fallout forced TeamPCP to tighten its circle, migrate its data to a new server, and lock out several members including the Google analyst. But the damage was done. Larsen traced one of the most active handles in CanisterWorm through a BreachForums data leak to the email address sheepstealing@gmail.com. Forum archives from 2019 connected that handle to a PayPal account tied to ruben@thomsonfamily.net.au. When TeamPCP backed up its stolen credentials to a Google Drive account linked to that same email, Larsen had enough to tip the FBI.

Ruben Ian Thomson and Louis Michael Gaebler, both in their early twenties, were arrested by Australian police late last month in a joint operation with the FBI. The Australian Federal Police described them as "principal participants" in the group.

Google's Shift Toward Disruption

The TeamPCP investigation coincided with the launch of Google's Cyber Disruption Unit, a team tasked with taking a more aggressive posture against cybercriminal and state-sponsored operations. The traditional approach in the security industry has been to write reports, publish indicators of compromise, and let defenders act on the information. Larsen's team took a different approach: actively revoking credentials, patching vulnerabilities, and feeding leads to law enforcement while the operation was still ongoing.

"Writing reports can only be so useful," Larsen told WIRED ahead of his talk. "Taking action to protect users and customers, that is the next step." The TeamPCP case suggests that model is effective when you have the access and the institutional willingness to act fast.

For developers, the takeaway is less about one group's arrest and more about the fragility of the software supply chain. TeamPCP's cascade worked because trust in open-source ecosystems is implicit. When you install a package, you trust its maintainers. When a maintainer's account gets compromised, that trust becomes a weapon. The tools to detect and prevent these attacks exist, but they require active adoption. The next TeamPCP is already out there. The question is whether the ecosystem is ready.