# The Security Tools That Became the Backdoor: Inside TeamPCP's Takedown
Two men in their early twenties sat in Perth while more than a thousand companies worldwide had their cloud credentials quietly drained. The arrests of Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23, announced Thursday by Australian Federal Police in collaboration with the FBI, mark the most significant disruption yet of TeamPCP — a cybercrime outfit that turned the software development pipeline into a mass credential-harvesting machine.
Thomson, whom the FBI identifies as the alleged ringleader, faces five categories of charges related to computer hacking and money laundering. Each carries between 3 and 20 years. Gaebler faces computer hacking charges with a maximum of 5 years on the most serious counts. Australian police have seized devices and are still calculating how much the pair actually made. "Further arrests and charges have not been ruled out," the Australian Federal Police said Thursday — a sentence that will make a few people nervous this weekend.
## They Attacked the Tools Defenders Trust Most
Here is what makes TeamPCP worth understanding beyond the arrest headline: they didn't attack random applications or go phishing in employees' inboxes. They went straight for the infrastructure security teams use to protect everything else.
Aqua Security's Trivy is one of the most widely deployed open-source vulnerability scanners in CI/CD pipelines. Checkmarx's KICS (Keeping Infrastructure as Code Secure) scans infrastructure-as-code configurations for misconfigurations. PyPI's LiteLLM is a popular library for interacting with large language models. These aren't obscure corners of the software supply chain — they are tools explicitly positioned at security checkpoints, running with elevated access to the environments they're supposed to protect.
When TeamPCP compromised these, they didn't need to break through firewalls or social-engineer help desks. The scanner ran, the scanner had access, and the scanner silently exfiltrated cloud access keys and infrastructure secrets alongside its legitimate output. Five hundred thousand corporate credentials, by authorities' count. Three hundred gigabytes of data from more than 1,000 organizations.
The group deployed a worm — Mini Shai-Hulud, with indications they also ran the original Shai-Hulud — to automate propagation across package registries at scale. The Dune reference isn't subtle: sandworms consume everything in their path underground, unseen. The naming choice suggests these operators had a sense of theater, or at least a library card.
## Credentials-as-a-Service for Ransomware Groups
TeamPCP wasn't running ransomware themselves, at least not primarily. Their model was upstream: steal cloud access keys, infrastructure secrets, and CI/CD tokens from compromised build pipelines, then funnel that access to extortion and ransomware operators. This is increasingly how the criminal ecosystem works — specialization, not generalism.
That model matters because it means TeamPCP's real victim list extends far beyond the 1,000+ organizations whose data was directly exfiltrated. Every ransomware group that bought or received TeamPCP credentials potentially used them to stage further attacks. The Australian Federal Police's estimated losses in "hundreds of millions of dollars" almost certainly undercounts the downstream damage, which may never be fully attributable.
It also means disrupting TeamPCP cuts supply to other criminal operations. This is the logic behind joint operations like this one: you can't arrest your way out of ransomware, but you can degrade the infrastructure that feeds it. The FBI's involvement in identifying Thomson as the alleged leader signals this was coordinated at the intelligence level, not just law enforcement after the fact.
## Twenty-One Years Old, Running a Global Operation From Perth
There is a persistent myth that sophisticated cybercrime requires sophisticated nation-state resources. TeamPCP ran what amounts to a credential-harvesting empire — compromising security tools used by enterprise companies globally, deploying self-propagating worms across package registries, causing hundreds of millions in losses — and the alleged leader was 21 years old and living in Perth, Australia.
This fits the profile of recent high-profile arrests. Scattered Spider, which ran some of the most disruptive social engineering campaigns of recent years, was largely composed of teenagers and young adults in the UK and US. The talent pipeline into cybercrime has gotten very young, very skilled, and very international.
Australia is not typically where people picture major cybercriminal operations. The arrests should prompt a reexamination of that assumption. The Australian Cyber Security Centre has been increasingly vocal about domestic threats, but this case represents a category shift: not opportunistic fraud, but sophisticated supply chain exploitation with global reach.
---
## HackWire Analysis
The most under-reported dimension of this story is what it reveals about the current state of open-source supply chain security. Trivy and KICS aren't obscure packages — they're enterprise staples, the kind of tools that get blessed by security teams and then run with broad permissions inside production pipelines. When attackers compromise them, they're not exploiting a gap in your defenses. They're exploiting your defenses themselves.
This is the logical endpoint of a trend that's been building since SolarWinds in 2020 and accelerated through the XZ Utils backdoor in 2024: sophisticated actors now specifically target the security and build toolchain because it runs privileged, it's trusted implicitly, and it's often the least-audited part of the pipeline. Your SIEM might flag an unknown binary, but it's unlikely to flag your vulnerability scanner phoning home.
The Shai-Hulud worm is the detail defenders should study. Self-propagating malware targeting package registries at scale means that even organizations that weren't direct targets of TeamPCP may have ingested compromised packages without knowing it. The forensic question isn't just "were we on the list?" — it's "did we pull a dependency that had already been poisoned?"
For security teams, the immediate action is an audit of CI/CD pipeline tool provenance: what version of Trivy are you running, where did it come from, and have you verified the supply chain for your security tooling the same way you'd verify any other dependency? Most teams haven't. TeamPCP knew that.
The broader implication: the attack surface for credential theft has moved upstream from endpoints to pipelines. Endpoint detection is a mature market. Pipeline security is not. Expect more groups to follow TeamPCP's playbook before defenders close the gap.
— HackWire Editorial
---
## Related Coverage