Australia Arrests Two Men Over Alleged Global TeamPCP Cyberattacks

Australian police have apprehended two men for their roles in an international cybercrime ring that targeted trusted software. A joint investigation by the AFP (Australian Federal Police), FBI, and Western Australia Police Force led to these arrests.

The arrests were made in Western Australia on August 26, with one of the suspects being a 21-year old Cottesloe man, Ruben Ian Thomson.  U.S. prosecutors also charged Thomson over alleged TeamPCP attacks in 2026.

The arrests came months after TeamPCP launched a series of software supply-chain attacks. The group allegedly placed harmful code inside trusted developer tools. That code then gave attackers a path into other networks and systems.

Police Link Two Men to TeamPCP

The AFP said its investigation began in April. Several cyber threat firms had shared information about the alleged crime group with authorities. Investigators then worked with the FBI to identify people linked to the operation.

On August 26, AFP and WAPF officers searched properties in Cottesloe, Hamilton Hill and Mandurah. Officers seized electronic devices and other items from the properties. Police will now examine the material for evidence.

The AFP charged the two men with a total of 14 offenses. The charges include illegal data changes, possession and supply of data for computer crimes, and dealing with crime proceeds.

Thomson faces eight charges in Australia. One charge concerns crime proceeds worth at least 100,000 Australian dollars. The other suspect is a 23-year old man from Mandurah. He faces six charges. On August 27, they both appeared before Perth Magistrates Court.

The AFP said its investigation continues. Police have not ruled out more arrests or charges.

U.S. Charges Also Name Thomson

The FBI’s role in the case became clearer after the U.S. Department of Justice announced charges against Thomson. A federal grand jury indicted Thomson on August 25. Prosecutors accuse him of taking part in a plan to commit computer fraud. They also accuse him of obtaining information from protected computers.

U.S. prosecutors say Thomson worked with others to target trusted software tools. The attackers allegedly placed harmful code inside those tools before they reached other users. The code could search infected systems for sensitive data. It could also send stolen information to systems controlled by Thomson and his alleged partners.

The prosecutors added that the malware provided the attackers with persistent access to the compromised computers. In the view of the DOJ, the same group demanded a ransom so as not to leak the data.

Thomson remains in Australian custody. The U.S. charges are still just allegations. Thomson remains innocent pending trial in a court to decide whether he’s guilty or not.

How the March Attack Spread

The TeamPCP campaign did not start with direct attacks on each victim. Instead, the group targeted software and tools that developers already trusted.

Security experts noted that one massive attack started on March 19. In this regard, the attackers targeted the vulnerability scanner Trivy of Aqua Security. Trivy helps developers find security problems in software and cloud systems.

The attackers allegedly used stolen access to place harmful code into Trivy’s GitHub Actions. The malware could then search for cloud keys, SSH keys and other secrets.

These attackers also targeted another developer tool, Checkmarx KICS, on March 21. Two days later, they targeted the LiteLLM project. The attackers then published harmful versions through PyPI, the main package store for Python software.

On March 27, researchers found another TeamPCP attack involving the Telnyx Python SDK. The attacks created a major risk for developers and their customers.

A developer did not need to visit a strange website or open a suspicious file. In some cases, using a trusted software component could bring the harmful code into a normal development process.

Palo Alto Networks’ Unit 42 tracked the attacks across Trivy, LiteLLM, KICS, and Telnyx. The security team said the campaign went after SSH keys, cloud keys, Kubernetes secrets, and other sensitive data. 

Thousands of Organizations at Risk

The AFP says the malicious code targeted more than a thousand firms around the world. They believe the attackers stole over 500,000 credentials as well as at least 300GB of data from affected systems.

This shows how damaging software supply chain attacks can be. They usually go far beyond the initial victim. A trusted software project can connect hackers with hundreds or even thousands of other entities. 

The AFP said global cleanup costs have already reached hundreds of millions of dollars. However, the agency stressed that the full financial impact remains under review.

The financial scale of cybercrime also extends to cryptocurrency seizures. NSW Police seized approximately 52.3 bitcoin valued at $5.7 million from a man on the far south coast in May 2025, allegedly the proceeds of illegal activity on the dark web.

Security researchers have also found TeamPCP activity across several software platforms. These include npm, PyPI, Docker, GitHub Actions and developer marketplaces.

Is Thomson the TeamPCP Leader?

Authorities have not publicly called Thomson the leader of TeamPCP. That point matters because some reports have described him as the group’s alleged leader. Those reports rely on findings from cybersecurity researchers and online activity linked to the group.

Flare said its research connected the online name “DeadCatx3” with accounts linked to Thomson. The research also linked those accounts to infrastructure tied to TeamPCP activity.

KrebsOnSecurity reported another alleged link involving the online name “Ellis.” A person using that identity had claimed to lead TeamPCP.

These findings may help explain why some reports describe Thomson as the group’s leader. Still, neither the AFP charging statement nor the U.S. indictment publicly establishes him as TeamPCP’s leader.

For now, it is safer to describe Thomson as an alleged TeamPCP member or participant. The arrests still mark a major step for investigators.

The case shows how police can use international partnerships and information from private security firms to track cybercriminals. It further sheds light on another rising threat for organizations.

In many cases, attackers do not need to gain entry into the network of an organization. They can attack software that the organization is using. Once criminals compromise that software, routine downloads and updates can become a path into many other systems.

For businesses, the TeamPCP case offers a clear warning. Companies should track the software they use, replace exposed passwords and access keys, and review developer systems after a trusted tool suffers a breach.