The Australian Federal Police (AFP) has charged two Western Australian men, Louis Michael Gaebler (23) and Ruben Ian Thomson (21), with 14 offences related to their alleged involvement in the cybercrime group TeamPCP. The group is responsible for the March 2026 supply chain compromise of open-source security scanners Trivy and Checkmarx KICS, as well as the AI gateway LiteLLM. Both individuals appeared in Perth Magistrates Court on August 27. The attacks targeted widely-used security and AI tooling, potentially impacting a broad range of downstream users and organizations. This case represents a significant law enforcement action against supply chain attackers in Australia. The compromise of security scanning tools is particularly concerning as it could undermine the integrity of software security pipelines globally.
TeamPCP is a cybercrime syndicate that conducted a major supply chain attack campaign beginning in March 2026. The group operated by stealing publishing credentials from trusted open-source projects and pushing trojanized/backdoored versions through the projects' own legitimate release channels. The attack chain was chained and cascading: credentials stolen during the Trivy security scanner compromise were then used against Checkmarx KICS GitHub Actions. LiteLLM's build pipeline installed Trivy without pinning it to a verified version, allowing the poisoned scanner to steal LiteLLM's publishing token, which was then used to push backdoored LiteLLM releases in late March 2026. LiteLLM sits at a position where an organization's LLM provider keys are consolidated, making it a high-value target. The campaign spanned five distribution ecosystems: GitHub Actions, Docker Hub, npm, PyPI, and OpenVSX. The group also used a worm framework called 'Mini Shai-Hulud', which was open-sourced to GitHub on May 12, 2026. A subsequent npm wave on August 4, 2026 poisoned the 'keyv' and 'cacheable' packages using the same toolkit. The worm creates repositories named 'tpcp-docs' and 'docs-tpcp' using stolen credentials. The attack potentially compromised more than 1,000 organizations globally (with CloudSEK estimating over 2,500 organizations and ~434,000 CI/CD pipelines affected), enabled theft of more than 500,000 credentials, and led to exfiltration of at least 300 GB of data. Hudson Rock attributed 118,829 CI runner dumps to 2,488 corporate domains from a 153 GB archive of attackers' own exfiltrated data. Affected platforms by organization count: GitLab (1,064), GitHub Actions (618), Azure DevOps (233), Jenkins (105), Bitbucket Pipelines (94), CircleCI (15). TeamPCP-linked infrastructure has been traced back to 2020, with the group previously tracked as TA-NATALSTATUS and IronErn. Two Western Australian men — Louis Michael Gaebler (23) and Ruben Ian Thomson (21) — were charged on August 27, 2026 with 14 combined offences including unauthorized modification of data, possessing/supplying data with intent to commit a computer offence, failing to comply with a section 3LA order, and dealing with proceeds of crime. They received payments in cryptocurrency.
1. Rotate all CI/CD secrets, publishing tokens, and cloud credentials that were accessible during the exposure windows. 2. Treat any exfiltrated data and credentials as a persistent risk, as affiliated threat actors are likely to weaponize them long after the initial compromise. 3. Search your organization's repositories and CI/CD environments for repositories named 'tpcp-docs' and 'docs-tpcp', which are created by the worm using stolen credentials. 4. Pin all GitHub Actions workflows to verified commit SHA hashes rather than floating version tags to prevent dependency confusion and supply chain attacks. 5. Audit all open-source dependencies used in build pipelines and ensure they are pinned to verified, immutable versions. 6. Review CI/CD pipeline logs for unauthorized modifications, unexpected credential access, or anomalous publishing activity across GitHub Actions, GitLab, Azure DevOps, Jenkins, Bitbucket Pipelines, and CircleCI. 7. Scan for the presence of backdoored LiteLLM versions in your environment and remove them; note that removed PyPI packages may still be accessible via direct CDN URLs. 8. Audit LLM provider API keys and credentials consolidated through LiteLLM and rotate them if exposure is suspected. 9. Monitor for any activity associated with threat actor aliases TeamPCP, TA-NATALSTATUS, and IronErn. 10. Review the FBI advisory at https://www.ic3.gov/CSA/2026/260702.pdf for additional technical indicators and defensive guidance.
Repository name: tpcp-docs (created by worm using stolen credentials), Repository name: docs-tpcp (created by worm using stolen credentials), Malicious LiteLLM builds on PyPI (removed from index but still returning HTTP 200 from PyPI CDN as of August 27, 2026), 153 GB archive of attackers' exfiltrated data, Infrastructure linked to domains associated with TA-NATALSTATUS and IronErn, Poisoned keyv npm package (August 4, 2026), Poisoned cacheable npm package (August 4, 2026), Mini Shai-Hulud worm framework (open-sourced to GitHub on May 12, 2026), TeamPCP leak site listing 16 confirmed victim organizations
