Nine months of activity. Over 1,000 organizations breached. And the alleged endpoint: two seaside towns just outside Perth.
On Wednesday, the Australian Federal Police announced the arrest of two men, who face 14 charges connected to TeamPCP — the crew that has spent most of this year distributing self-propagating malware via open source software packages. The men were not identified by the AFP, which disclosed only that they resided in Cottesloe and Mandurah, Western Australia.
Following a lengthy investigation of its own, KrebsOnSecurity published what it says are the names of both defendants, alongside a detailed portrait of their lives and the errors that ultimately undid them.
The worm that rode your build pipeline
Since emerging in December, TeamPCP has been a headache for security teams and law enforcement around the world. The supply chain attack was its calling card, and the group ran that same play repeatedly.
Open source software was seeded with malware capable of hopping from package to package without human help. Your laptop was never the objective. The prize was the CI/CD pipeline — the automated infrastructure organizations rely on to build, update and ship software quickly.
After a tool or package fell, the worm — named Shai-Hulud — latched onto that package’s subsequent updates. Developers downloaded the tainted releases, fed them through their own CI/CD platforms, and watched their software fall too. Then the cycle started again.
The viral element came from a distinct component that harvested credentials for other packages out of the memory of infected hardware. Armed with those credentials, TeamPCP members went on to infect those packages in turn.
Trivy fell, and everything downstream fell with it
Nothing illustrates the damage better than the group’s compromise of Trivy, the vulnerability scanner. As reported earlier this month, that lone breach cascaded into downstream packages such as KICS, the Telnyx Python SDK and LiteLLM, whose developers had run either a tainted build of Trivy or another package that had done so.
Terabytes of credentials and other private data were stolen in the original Trivy compromise. Terabytes — siphoned out of a tool built for the sole purpose of finding security problems.
A smart contract as a takedown-proof phone home
Seize the command server and most malware dies. Shai-Hulud was engineered to outlive exactly that.
It leaned on a type of smart contract called an Internet Computer Protocol-based canister, allowing the worm to resolve control servers via URLs that could be replaced at a moment’s notice. Every 50 minutes, infected machines phoned the canister to check in.
As design decisions go, that one is genuinely unusual, and it’s the aspect of the campaign security teams ought to be studying hardest. A canister isn’t something you can file an abuse report against the way you would with a hosting provider.
Sloppy operators with very good tools
And that’s where the story turns contradictory. TeamPCP assembled something technically nasty and durable, yet its members — per Brian Krebs of KrebsOnSecurity — lacked the operational discipline you’d normally expect from a hacking group with that kind of track record.
Citing Aikido Security researcher Charlie Eriksen, Krebs reported that hackers working at that tier have historically had to invest serious time in researching techniques, customizing and debugging code, and building out the infrastructure needed to execute a campaign of this scale.
“LLMs have compressed that gap significantly,” Eriksen told Krebs.
It’s a line worth dwelling on. What kept campaigns like this uncommon was precisely that capability gap between seasoned operators and ambitious amateurs. The operational security gap, it seems, remains wide enough to land you in handcuffs.
What the men are facing
According to Australian authorities, a conviction would expose one man to more than 20 years behind bars, and the other to more than 10.
For anyone running a CI/CD pipeline, the real lesson has nothing to do with the arrests. It’s that a scanner you trusted made off with terabytes of its own users’ credentials, and those stolen credentials became the accelerant for the next wave of infections. Rotate anything that came near a compromised build. Work on the assumption that the worm has already seen it.