Google infiltrated TeamPCP hacker group to disrupt attacks from the inside

For a brief window earlier this year, someone in TeamPCP’s private chat was not who they seemed. While the hacker collective was executing one of the most damaging software supply-chain campaigns on record, a Google researcher was sitting in the room, watching every move.

Google’s Threat Intelligence Group, operating through its Mandiant subsidiary, disclosed the operation on September 18, revealing that an undercover analyst had been embedded inside TeamPCP’s internal communications channel, known as CanisterWorm, since March 2026. The infiltration let Google monitor the campaign in real time, alert companies that had been breached, and actively work to blunt the group’s follow-on exploitation attempts.

What TeamPCP actually did

The scale of the operation was, to put it plainly, extraordinary. TeamPCP compromised more than 1,000 organizations, exfiltrated at least 300 GB of data, and walked away with more than 500,000 stolen credentials across several months of activity.

The group’s method was a textbook software supply-chain attack, with some creative embellishments. Rather than breaking into companies one by one, TeamPCP went upstream, tainting hundreds of widely used open-source packages and tools, including Trivy, a popular container security scanner, and LiteLLM, a library that sits inside countless AI application stacks.

To accelerate the campaign, TeamPCP also released a self-spreading worm with a Dune theme, an automation layer designed to propagate the malware with minimal hands-on effort from the group’s members. Stolen developer accounts were used to publish tainted versions of legitimate software, keeping the infection chain moving.

Remediation costs across affected organizations have been estimated in the hundreds of millions of dollars. That figure reflects not just incident response and forensics work, but the cascading cost of auditing every build pipeline that touched a compromised dependency.

How Google played it

The infiltration began in March 2026, shortly before the campaign reached its peak intensity. Google has not disclosed exactly how its analyst gained access to CanisterWorm, which is consistent with operational security practice: revealing the method would help future groups screen for similar intrusions.

What Google has said is that the inside access served three functions. First, it gave the company visibility into which organizations were being targeted, allowing for proactive warnings. Second, it provided insight into TeamPCP’s tooling and tactics detailed enough to inform defensive countermeasures. Third, and most directly, Google used what it learned to help disrupt exploitation attempts as they were happening, effectively degrading the group’s ability to monetize the access it had already obtained.

Google revealed the operation publicly at LABScon, a security research conference, on September 18. The timing followed the arrest of two alleged group members by roughly three weeks, suggesting Google held the disclosure until law enforcement had made its moves.

The arrests and what comes next

Australian Federal Police and the FBI coordinated to arrest two alleged TeamPCP members, Ruben Ian Thomson and Louis Michael Gaebler, on August 26 and 27, 2026. The pair face a combined 14 charges covering hacking offenses and money laundering. Thomson and Gaebler were taken into custody in Australia, where the group appears to have had a significant operational footprint.

The Trivy compromise is a particularly pointed example. Trivy is used specifically to scan container images for vulnerabilities. Poisoning a security tool creates a trust paradox: organizations running what they believe is a protective scan are instead executing attacker-controlled code, with no obvious warning signal to tip them off.

LiteLLM’s inclusion in the target list points to where supply-chain attackers are looking next. As AI development accelerates, the libraries that sit between applications and large language model APIs have become high-value targets. They are relatively new, widely adopted, and in many cases audited less rigorously than older, more battle-hardened packages.