The Australian Federal Police (AFP) has charged two Western Australian men with a combined total of 14 offences over their alleged role in TeamPCP, the cybercrime group behind the March 2026 compromise of the open-source security scanners Trivy and Checkmarx KICS and the AI gateway LiteLLM.
Louis Michael Gaebler, 23, and Ruben Ian Thomson, 21, appeared in Perth Magistrates Court on August 27, 2026, a day after the AFP and the Western Australia Police Force (WAPF) executed search warrants at properties in Cottesloe, Hamilton Hill, and Mandurah and seized electronic devices for forensic analysis.
Police allege the two men were principal participants in the syndicate and received payments in cryptocurrency, the value of which is still under investigation.
The Federal Bureau of Investigation (FBI) said in a July 2 advisory that organizations impacted by the campaign should treat exfiltrated data and credentials as a persistent risk, since affiliated threat actors are "likely to weaponize them long after the initial compromise." It advised rotating all continuous integration and continuous delivery (CI/CD) secrets, publishing tokens, and cloud credentials accessible during the exposure windows.
FBI Cyber Division Assistant Director Brett E. Leatherman said in a joint media release that the two men are allegedly members of TeamPCP, whose malicious code "potentially compromised more than a thousand organizations worldwide."
The Cottesloe man, 21, was charged with one count of possessing data with intent to commit a computer offence, four counts of unauthorized modification of data with intent to commit a serious offence, one count of supplying data with intent to commit a computer offence, one count of failing to comply with a section 3LA order, and one count of dealing with proceeds of crime worth $100,000 or more.
The Mandurah man, 23, was charged with one count of possessing data with intent, four counts of unauthorized modification of data with intent to commit a serious offence, and one count of supplying data with intent to commit a computer offence.
The section 3LA count, brought under the Crimes Act 1914 (Cth), carries a maximum penalty of 10 years' imprisonment, and the proceeds of crime count carries a maximum of 20 years.
None of the 14 charges names a specific compromised project.
The syndicate worked by stealing publishing credentials from trusted open-source projects and pushing poisoned versions out through the projects' own release channels. The campaign spanned five distribution ecosystems, GitHub Actions, Docker Hub, npm, PyPI, and OpenVSX.
The compromise of one project supplied the credentials used against the next. Credentials taken during the Trivy scanner compromise were turned on the Checkmarx KICS actions days later.
LiteLLM's own build pipeline installed Trivy without pinning it to a verified version. The poisoned scanner then took the project's publishing token.
The actor used that token to push the backdoored LiteLLM releases in late March. LiteLLM routes requests across large language model (LLM) providers, and sits where an organization's provider keys are consolidated.
The AFP said the malicious code potentially compromised more than 1,000 organizations globally, enabled the theft of more than 500,000 credentials, and led to the exfiltration of at least 300 gigabytes of data. Unit 42 published the same two figures in March, hedged as what the actor "may have exfiltrated."
CloudSEK and Hudson Rock published the August exposure figures for the same campaign, with CloudSEK putting reconstructed exposure at more than 2,500 organizations and roughly 434,000 CI/CD pipelines, and Hudson Rock attributing 118,829 CI runner dumps to 2,488 corporate domains from a 153GB archive of the attackers' own exfiltrated data.
CloudSEK said credential theft is not proof that a company was successfully compromised, and the confirmed victim count is the 16 organizations TeamPCP published on its leak site as of late March.
StepSecurity said its analysis of the CloudSEK dataset found GitLab led the affected platforms with 1,064 organizations, ahead of GitHub Actions on 618, Azure DevOps on 233, Jenkins on 105, Bitbucket Pipelines on 94, and CircleCI on 15.
The Hacker News confirmed via PyPI on August 27 that the two malicious LiteLLM builds no longer appear in the package's release history, and that both still return HTTP 200 from PyPI's content delivery network at their direct package URLs five months after removal from the index.
TeamPCP-linked infrastructure has been traced back to 2020, Oligo Security said in an August 5 report, tying the group to activity previously tracked as TA-NATALSTATUS and IronErn through overlapping domains, malware deployment paths, staging techniques, and backend infrastructure.
Whether that continuity reflects a rebrand, a shared operator set, or close collaboration between historically related actors "cannot be determined with 100% certainty," Oligo said.
The group open-sourced the worm framework used in the Mini Shai-Hulud campaign to GitHub on May 12, 2026.
A fresh npm wave using the same toolkit poisoned the keyv and cacheable packages on August 4, 2026. Socket said the self-identifying markers that would tie the sample to a named campaign were not recovered.
The FBI advisory lists tpcp-docs and docs-tpcp as the repository names the worm creates using stolen credentials, and advises defenders to search their organizations for both and to pin all GitHub Actions workflows to verified commit SHA hashes rather than floating version tags.
