Google Infiltrated TeamPCP’s Hacking Spree with Undercover Agent, Aiding Arrests of Alleged Leaders

In a remarkable turn of events that sheds light on the murky world of cybercrime, Google’s threat intelligence group has unveiled its covert operation against TeamPCP, a notorious hacker collective responsible for an unprecedented software supply-chain attack spree. Before the arrest and charging of two of its alleged principal members in Australia last month, TeamPCP had infected hundreds of open-source programs with malware, stolen numerous developer accounts to escalate its campaign, and even deployed a self-spreading worm, Mini Shai-Hulud, inspired by Frank Herbert’s Dune series, to automate its malicious activities. This sprawling campaign ultimately led to the breach of more than a thousand companies globally.

During a critical phase of TeamPCP’s rampage, a Google-employed undercover researcher successfully infiltrated the group’s inner circle. This allowed Google to monitor the extensive hacking spree from within, proactively warn targeted organizations of impending breaches, and even help thwart the group’s attempts to exploit its victims. The full scope of this internal operation was revealed by Austin Larsen, a researcher with the Google Threat Intelligence Group, in a presentation at security firm SentinelOne’s LABScon research conference.

Larsen detailed the intricate investigation and infiltration, explaining how Google ultimately leveraged a trail of operational security (opsec) missteps allegedly made by one of the two Australians now accused of leading TeamPCP. Key identifying details gleaned from this digital breadcrumb trail were then passed on to law enforcement agencies. Further intelligence was surprisingly provided by ShinyHunters, another infamous cybercriminal group that initially partnered with TeamPCP but later turned against the supply-chain hackers. Perhaps the most astonishing revelation was that Google’s security subsidiary, Mandiant, had an undercover analyst embedded within TeamPCP’s core from nearly the very beginning of the group’s public emergence.

"One of our personas had been working for many months to build trust with one of the actors that was invited to join TeamPCP, and so was added to the group," Larsen disclosed in an interview preceding his LABScon talk. "So essentially, almost day one, Mandiant was watching everything behind the scenes."

The arrests of Ruben Ian Thomson and Louis Michael Gaebler, both Australians in their early twenties, occurred late last month. They were apprehended by Australian police in a joint investigation that received assistance from the FBI. The Australian Federal Police (AFP), while not naming the individuals due to Australian privacy laws, described them as "principal participants" in TeamPCP in their official press release. The hacker group, which first surfaced online in late 2025, had gained notoriety for a audacious series of cascading supply-chain attacks. Their modus operandi involved repeatedly compromising open-source software to embed their malware, which in turn allowed them to hijack developer credentials and plant malicious code in yet another widely used tool, perpetuating a self-sustaining cycle of compromise.

Beginning in the spring of the current year, TeamPCP executed a series of high-profile compromises. These included the open-source security scanner Trivy, the AI application programming interface tool LiteLLM, critical infrastructure belonging to the web application security firm Checkmarx, the popular web app library TanStack, and the enterprise AI platform Mistral AI. Each successful supply-chain attack broadened the group’s reach, enabling them to ensnare more victims. This allowed the hackers to breach organizations such as the open-source code repository Github, the data contracting firm Mercor, and even employee devices at OpenAI, the European Commission, and numerous other entities that have remained unnamed in public reports. To further automate and scale their operations, the group sometimes deployed the Mini Shai-Hulud worm, named after the colossal sandworms in Dune. This name also hinted at an earlier Shai-Hulud worm from September 2025, which attempted a similar approach, though TeamPCP’s involvement in that prior campaign remains unconfirmed.

Larsen confirmed that in March, precisely as TeamPCP’s frantic supply-chain hacking spree commenced, Google’s undercover analyst was extended an invitation to join the hackers’ inner circle. This invaluable inside source, whose identity Larsen chose not to reveal, was one of approximately 12 individuals granted access to the group’s central chat channel, which they dubbed "CanisterWorm."

"You guys should understand that we pulled off the biggest supplychain [sic] maybe ever recorded in modern history," one TeamPCP member audaciously boasted in the leaked chats, underscoring the group’s perception of their own illicit achievements.

Michael Fletcher, a former AFP analyst who now works in the threat research division of an Australian telecom firm, recounted his interaction with Larsen around that time. Fletcher had approached Larsen seeking methods to monitor the group’s activities and members. He recalled Larsen cautioning him to approach the hackers with care, as one of them was a "friendly." Fletcher’s immediate thought was, "damn, you all have been inside this early."

Google’s undercover analyst managed to gain access to a server where TeamPCP was storing its vast trove of stolen credentials. This collection included usernames, passwords, and access tokens acquired through their hacking, which the group presumably intended to use for extorting target companies. Recognizing the imminent threat, Google’s team resolved to act swiftly to warn potential victims and preempt TeamPCP’s ransom schemes. "My thought was: How can we, as quickly as possible, disrupt their campaign before more compromises can happen?" Larsen explained. "Let’s go mess up what they’re doing. That was my goal."

Instead of directly alerting the owners of the stolen credentials at the myriad victim companies, a process Larsen noted would have been too time-consuming given the sheer scale of the breaches, Google initially focused on credential providers. They reached out to major service providers like Amazon Web Services and Microsoft, requesting that the stolen credentials be revoked to prevent further exploitation by the hackers. Larsen and his team dispatched hundreds of notification emails to these providers, and subsequently to the victims, many of whom responded immediately.

Concurrently, Google’s privileged view into the TeamPCP internal chat revealed another critical development. Someone within the group’s core was, independently of their supply-chain attacks, leveraging an AI tool to develop a zero-day exploit targeting a widely used login software. This exploit would have allowed the hackers to bypass two-factor authentication. Google’s team successfully obtained a copy of the exploit code, rigorously tested it, and confirmed that, with minor adjustments, it was functional. This represented a rare instance of an in-the-wild AI-created hacking technique exploiting a previously unknown software vulnerability. Google promptly notified the software’s developer, enabling them to patch the security flaw. This incident was detailed in a case study released by Google in May, though it did not name TeamPCP or disclose how Google acquired knowledge of the exploit at the time.

Google’s analyst, it turns out, was not the sole source of betrayal within TeamPCP’s ranks. Even prior to Google’s disruption efforts, Larsen noted that the group struggled to effectively monetize its enormous collection of stolen data, which the AFP estimated to include over half a million users’ credentials. Despite this massive haul, Larsen estimated their extortion payments amounted to only tens of thousands of dollars, a meager sum compared to the millions amassed by similar cybercriminal organizations. In an attempt to better profit from their hacking, TeamPCP invited several other cybercriminal groups to partner with them, offering access to the stolen credentials in exchange for a percentage of any extortion payments they could extract.

Among these partners was ShinyHunters, a prolific hacker group with years of experience, known for extorting millions through data theft and ransomware, including the significant breach of the educational software platform Canvas, which subsequently disrupted thousands of schools across the US. Around April, mere weeks after forming their alliance with TeamPCP, ShinyHunters went rogue, according to Larsen. They began conducting their own extortions using TeamPCP’s credentials but withheld the agreed-upon percentage from the supply-chain hackers. ShinyHunters went as far as to proactively share with Larsen a complete log of their chat on TeamPCP’s server, unaware that he already had access to this information via Google’s embedded mole.

ShinyHunters further antagonized TeamPCP with taunting messages on X (formerly Twitter), and their overt betrayal quickly captured TeamPCP’s attention. In response, TeamPCP narrowed its inner circle, migrated its data to a new server, and expelled ShinyHunters and several other group members, including Google’s undercover analyst, from its CanisterWorm chat. "Just delete that and stop sharing shit with shinyhunters," one of the TeamPCP leaders reportedly wrote.

Even without the direct inside source, Larsen’s more traditional digital detective work allowed him to meticulously reconstruct the trail of digital breadcrumbs that ultimately led to the identification of Thomson, one of the two individuals charged for allegedly playing "key" roles in TeamPCP. Larsen discovered in a leaked user data from the BreachForums hacker forum that one of the most active handles in the CanisterWorm chat had been registered with a specific Gmail address. Further investigation through other forum archives revealed a 2019 dispute involving a user with the pseudonym "sheepstealing" and a vendor of pirated Microsoft Office keys. In this dispute, the "sheepstealing" user demanded a refund to a PayPal account linked to another specific email address.

When TeamPCP moved its stolen credentials to a server hosted by a different provider, Larsen revealed that Google gained insight into some of the new server’s contents through a "trusted partner." Crucially, they also discovered that this server was being backed up to a Google Drive account linked to the same problematic Gmail address previously identified.

"When we saw that, I just thought: There’s no way. Why would he be sending all of this illicit, stolen material to a Google Drive that’s tied to himself?" Larsen recounted. "That’s when we gave the tip to the FBI." Larsen noted that he received an interested response from an agent within minutes. (It is worth noting that Larsen may not have been the sole party to identify Thomson or other alleged TeamPCP hackers prior to their arrest; journalist and cybersecurity sleuth Brian Krebs, for instance, published his own investigation last month, outlining a separate set of clues that led to Thomson’s identity.)

In a statement to WIRED, the FBI declined to comment on any "active investigation" but affirmed its commitment to "increase impact on adversaries through partnerships as documented in our newly released FBI Cyber Strategy." The AFP also declined to comment on the matter.

Approximately a month after Larsen’s initial tip, US law enforcement completed the legal process, obtaining a warrant to request Thomson’s data from Google. Late last month, Thomson was arrested by Australian police, who later released a video showing him being escorted from a suburban home, dressed in a Northface hoodie and sweatpants. Neither Thomson nor Gaebler, the other alleged TeamPCP member arrested, could be reached for comment.

Larsen was careful to emphasize that Google’s undercover analyst within TeamPCP never engaged in any illegal hacking activities or even encouraged the group’s breaches. "They were a fly on the wall, only saying enough to not be suspicious," Larsen stated. "There are guardrails around what we do."

However, Larsen also highlighted that his team’s proactive efforts to foil TeamPCP’s hacking represent a significant shift within Google. The entire investigation coincided with the launch of Google’s new Cyber Disruption Unit, a division officially tasked with adopting a more aggressive stance against cybercrime and state-sponsored hacking.

"Google Threat Intelligence Group has put an emphasis on disruption. That’s one of our missions now," Larsen affirmed. "Writing reports can only be so useful. Taking action to protect users and customers—that is the next step."