Authorities arrest 2 alleged members of prolific hacking group TeamPCP

Key facts

• Two men were arrested and charged with 14 offenses in Australia.
• The arrested men are alleged members of the hacking group TeamPCP.
• TeamPCP is accused of carrying out supply chain attacks that infected over 1,000 organizations globally.
• The group's malware, Shai-Hulud, targeted CI/CD pipelines and used smart contracts for control servers.
• If convicted, one man faces over 20 years in prison, and the other over 10 years.

Australian authorities announced the arrest of two men accused of being members of the prolific hacking group TeamPCP. Over a nine-month period, TeamPCP allegedly conducted supply chain attacks that compromised more than 1,000 organizations globally.

The Australian Federal Police stated that the two men were arrested and face 14 charges. TeamPCP is known for its sustained supply chain attacks, which involved lacing open-source software with malware that self-propagated. The group's worm, dubbed Shai-Hulud, targeted organizations' CI/CD pipelines. Once a package was compromised, Shai-Hulud attached itself to future updates, infecting subsequent downloads. A component of the malware collected credentials for other packages, which TeamPCP members then used to infect those additional packages.

One notable compromise involved the Trivy vulnerability scanner, which led to the theft of terabytes of credentials and private data. Shai-Hulud employed Internet Computer Protocol-based canisters, a form of smart contract, to ensure its command-and-control servers were resistant to takedowns. Infected machines communicated with these canisters every 50 minutes.

According to reporting by KrebsOnSecurity, citing researcher Charlie Eriksen, the operational discipline of TeamPCP members was lacking compared to other highly accomplished hacking groups. Eriksen suggested that large language models (LLMs) have significantly reduced the gap in the skills and infrastructure required for such sophisticated campaigns.

If convicted, one of the arrested men could face over 20 years in prison, while the other faces more than 10 years.