Authorities in Australia have arrested two males believed to be members of TeamPCP, a prolific cybercrime and information extortion group blamed for perpetrating the longest working spree of software program provide chain assaults ever.
In a press release launched immediately, the Australian Federal Police (AFP) mentioned two males from Western Australia, aged 21 and 23, have been arrested in reference to a “refined cybercrime syndicate that allegedly created malicious open-source software program to rob hundreds of world companies.”
The AFP didn’t title the defendants, however KrebsOnSecurity discovered the 21-year-old suspect’s actual id in June, and has been speaking with him ever since. This story consists of interviews with TeamPCP’s self-described spokesperson, and examines clues left behind by the TeamPCP chief that doubtless led to his undoing.
TeamPCP vaulted onto the cybercrime scene in late 2025, embedding malicious code in lots of of open supply software program instruments and extorting victims for revenue. Members of the group made headlines by compromising company cloud environments utilizing a self-propagating worm dubbed Shai-Hulud, which added malicious code to open supply packages maintained by builders whose credentials at public code repositories like GitHub or NPM have been phished or stolen.
Writing for Wired, journalist Andy Greenberg described TeamPCP’s core tactic as a form of cyclical exploitation of software program builders.
“The hackers achieve entry to a community the place an open supply device generally utilized by coders is being developed,” Greenberg wrote in Could. “The hackers plant malware within the device that finally ends up on different software program builders’ machines, together with some who’re writing different instruments supposed for use by coders. The malware permits TeamPCP’s hackers to steal credentials that allow them publish malicious variations of these software program improvement instruments, too. The cycle repeats, and TeamPCP’s assortment of breached networks grows.”
TeamPCP additionally has practiced one thing akin to cyclical recruitment. In Could, the supply code for the third iteration of Shai-Hulud was revealed on-line, and TeamPCP quickly after launched a contest providing $1,000 in digital foreign money to whichever participant may conduct the biggest provide chain operation utilizing the worm’s code. Based on the competition guidelines, members have been scored primarily based on the variety of weekly and month-to-month downloads of packages they compromised — straight incentivizing them to focus on the most well-liked code libraries.
A screenshot of a message from TeamPCP’s Telegram account, saying the availability chain hacking contest. Picture: dataminr.com.
“TeamPCP has said the competitors is a recruiting alternative they usually intend to buy all significant entry harvested from members’ campaigns,” the safety agency Dataminr wrote. “The $1,000 XMR (Monero) prize is a recruitment ground and has been dismissed by the actor as ‘identical to participation trophy,’ including ‘should you discover one thing good you may be paid far more,’ confirming the competition’s true operate as expertise identification and malicious entry acquisition at scale.”
In March, TeamPCP executed a provide chain assault focusing on AI infrastructure by compromising the code for LiteLLM, an open supply AI gateway that connects customers to greater than 100 completely different massive language fashions. A current evaluation by the safety agency CloudSEK discovered TeamPCPs assault on LiteLLM harvested cloud service keys and different secrets and techniques from greater than 2,500 organizations, together with most of the world’s high know-how corporations.
In Could, TeamPCP claimed credit score for compromising not less than 3,800 code repositories on the Microsoft-owned GitHub, after a GitHub developer put in a code extension that was compromised by TeamPCP’s malware.
MEET THE CYBERCATS
Safety consultants say TeamPCP is much less of a hacker group than an amalgamation of menace actors from a number of cybercriminal gangs who generally work collectively towards related objectives.
“It isn’t a structured legal crew with a single operator,” mentioned Austin Larsen, a principal menace analyst with the Google Risk Intelligence Group. “It’s a peer group of individually-skilled actors, with one clear heart of gravity.”
That heart of gravity is George Prepakis, an achieved safety researcher and self-described exploit developer who operates the Twitter/X profile @kernelstub. Earlier this 12 months, @kernelstub tweeted a public invite hyperlink to a Matrix chat server he created and dubbed “Cybercats,” and TeamPCP and several other different cybercrime entities have been utilizing this server to speak each day for the previous a number of months.
A screenshot of the Factor Matrix chat server “Cybercats,” whose members used hacker handles related to a number of distinct cybercrime teams which have sometimes collaborated on a sequence of provide chain and information ransom assaults over the previous 9 months.
Kernelstub, like different directors within the Cybercats chat, has been utilizing his Twitter/X profile title as his deal with in these Matrix communications, steadily tweeting references to different members and to conversations happening within the Cybercats chat. In quite a lot of circumstances, the corresponding X accounts for members of the Cybercats chat taunted cybercrime victims publicly earlier than the incidents have been reported within the information media.
The Cybercats administrator listed on the high of the screenshot above — “Boxturtle” — is an in depth affiliate of TeamPCP who has been tweeting in regards to the group’s conquests beneath the title @xpl0itrsturtle. This deal with corresponds to an information breach dealer energetic on Breachforums and Darkforums who has been promoting information stolen in a wave of current breaches at vehicle producers, together with BMW Group, Audi, Honda, Mercedes-Benz, Volvo and Toyota, in addition to information allegedly taken from Snapchat and SportRadar.
The information leak web site for the extortion group or deal with “xpl0itrs.”
The Cybercats administrator “SeesawSec” within the screenshot above is the alias of whoever is behind the cybercrime group referred to as Fulcrumsec, which not too long ago claimed credit score for information extortion assaults towards the pharmaceutical big Novo Nordisk, the info dealer LexisNexis, and Avnet, a Fortune 500 distributor of digital elements.
The information leak web site of Fulcrum Safety, a.ok.a. Fulcrumsec.
The Cybercats administrator “@pcpcasper” additionally has been utilizing an analogous title on X to debate TeamPCP’s assaults and victims. This individual has an in depth message historical past on Telegram, the place their messages and shared movies present @pcpcasper is an energetic and vocal member of the Nationwide Socialist Community, a neo-Nazi political group primarily based in Australia.
At one level in these chats, @pcpcasper shared movies and pictures of what they claimed was their cat, and several other of these movies place this person in Western Australia. One supply near the investigation informed KrebsOnSecurity that @pcpcasper was the opposite suspect arrested immediately, a declare supported by messages that @kernelstub posted on-line this morning.
The Cybercats member roster pictured above additionally options an administrator with the username “T,” which is brief for the now-banned Twitter/X profile @pcpcats, the account operated by the self-described TeamPCP spokesperson who was arrested immediately. As we’ll see in a second, @pcpcats is also from Western Australia.
By the point @kernelstub tweeted a public invite hyperlink to the Cybercats Matrix server, T/@pcpcats was posting solely occasionally to the group chat, with different members typically inquiring as to his whereabouts and well-being. The group’s collective concern associated to @pcpcats’s tendency responsible his more and more prolonged absences on the usage of hallucinogens and different narcotics that stored him awake for days on finish, but additionally triggered him to crash in mattress for a number of days after the highs wore off.
WHO IS THE TEAMPCP LEADER?
The Cybercats member @pcpcats has used a number of nicknames on the cybercrime boards, together with EllisD25/LSD on Darkforums, BulkDMT on Breachstars, and Specific on Breachforums. These accounts are linked as a result of all of them marketed the identical Tox ID and/or Session ID as prompt message contact handles of their cybercrime discussion board posts. BulkDMT was additionally identified on the boards as DMT Host, which was a digital personal server (VPS) internet hosting service that was peddled on Darkforums and Breachstars.
DMT Host/EllisD25, posting on the English-language cybercrime group DarkForums in September 2025. Picture: ke-la.com.
Based on the cyber intelligence agency Intel 471, Specific registered on Breachforums utilizing the e-mail deal with shitstickpp@gmail.com. Intel 471 finds Specific posted on Breachforums throughout a two-month interval in 2025 utilizing 4 completely different Web addresses situated in South Africa. On July 30, 2025, Specific introduced on Breachforums they have been promoting entry to 14 gigabytes of information stolen from South Africa’s State Info Know-how Company.
The menace intelligence platform Flashpoint recorded greater than a 12 months’s value of messages from the TeamPCP chief’s alter ego on Telegram — Persy_PCP — who claimed they cut up their life residing between two international locations [full disclosure: Flashpoint is an advertiser on this blog]. “I’ve these [files] as properly, drawback is these are abroad,” Persy_PCP defined to a different person inquiring a couple of stolen information set in November 2025.
Later that month, Persy_PCP complained, “My entire nation is racist they usually need individuals like me useless.” Flashpoint data present BulkDMT shared in September 2025 that “this nation goes to fucking starve once they take the farmers land,” a probable reference to white landowners in South Africa who declare to be focused by an ongoing genocide marketing campaign.
This tracks with public reporting on TeamPCP. Cyberscoop reported in June that Google had traced TeamPCP’s residential and cell Web deal with connections to South Africa, “indicating the first operator was situated there throughout not less than a few of its assaults.”
BulkDMT additionally shared on the group chat at Breachforums that they have been recovering from an dependancy to methamphetamine. “My life is kinda fucked rn [right now], however that’s positive and there isn’t actually some extent in pouring a lot emotional power into that reality, my mother and father had cash however I sadly received actually hooked on some issues so I don’t get to profit from that. So long as I proceed to outlive, keep sober, and transfer nearer in the direction of my objectives that’s sufficient drive and that means.”
The breach monitoring service SpyCloud finds shitstickpp@gmail.com reveals up within the registration of an account known as ChristmasSnow on the cybercrime group Raidforums in 2022. Almost the entire Web addresses used to entry that account got here from ISPs in Perth, Australia, SpyCloud discovered.
KrebsOnSecurity appeared up all of these Perth IP addresses in passive DNS data maintained by DomainTools.com, and located one among them — 211.27.196.111 — for a number of years was used as a personal file server by a household in Perth with the final title of Thomson. These data present not less than three hosts — ithomson.direct.quickconnect.to (a distant Synology server), kthomson0061.direct.quickconnect.to, and joshuawthomson39.myqnapcloud.com (a QNAP community storage system) — persevered at that deal with between 2022 and 2025.
Looking on “joshuathomson39” within the breach monitoring service Constella Intelligence reveals an account on the freight forwarding firm kwe.com created within the title of Joshua Thomson from Perth, Australia. The open supply intelligence platform Epieos finds the cellphone quantity connected to that kwe.com account was used to register a Fb profile for Josh Thomson, which says his household features a brother named Ruben, his father Ian, and his mother Cindy.
That Fb profile additionally says Josh and his household are initially from Pietermaritzburg, in KwaZulu-Natal, South Africa, however presently residing in Cottesloe, a beach-side suburb of Perth. A search in DomainTools for Ian Thomson and Australia unearthed 5 domains by the identical registrant, together with securecomputing.au, thomson.org.au, and thomsonfamily.internet.au. Ian Thomson is a dentist in Cottesloe, and a biography says he graduated from The College of the Witwatersrand in Johannesburg, South Africa.
Constella finds a joshua@thomson.org.au registered quite a lot of accounts on-line, however Josh doesn’t appear to have a lot of a connection to dodgy cybercrime boards. His brother Ruben, however, has fairly the presence on these communities, courting again to not less than 2018. Constella experiences ruben@thomson.org.au steadily reused the password “joshuathomson1,” and Constella additional finds that password was utilized by only a handful of accounts, together with yolosolo17@gmail.com and surfinup8@gmail.com.
Based on Intel 471, surfinup8@gmail.com was used to register the person Yolosolo17 on the crime discussion board Altenen in 2018, and that person account was registered from the Perth deal with 110.141.230.15. On Altenen, Yolosolo17 marketed free internet proxies, in addition to the area rubenthomson.com, which was at one level used to promote steeply discounted iPhones. DomainTools says rubenthomson.com was hosted at 110.141.230.15 and registered to surfinup8@gmail.com.
A cached copy of the area rubenthomson.com from 2017 reveals a login web page beneath a banded stack of cash. Picture: archive.org.
SpyCloud experiences 10.141.230.15 was utilized by the e-mail deal with sheepstealing@gmail.com on Raidforums and surfinup8@gmail.com on Nulled, and that the identical IP was utilized by the e-mail addresses ian@thomsonfamily.internet.au, jasper@yakuza.cc, and rubenthomson1@gmail.com. SpyCloud additionally reveals that sheepstealing Gmail deal with is tied to the accounts Sheep420, YoloSolo117 and Yakuza.cc on Raidforums, and to the account “Sheep Stealing” on Hackforums. Intel 471 says sheepstealing@gmail.com was used to register the account DingoFlour on Breachforums in October 2023, as properly Sheepx on Altenen.
Epieos experiences that ruben@securecomputing.au is tied to an Airbnb account for Ruben, who described himself as a Internet developer who went to highschool on the College of Western Australia and was residing outdoors the nation. “Hey, I’m Ruben, my pals name me Ellis. I’m a Perth artistic who sometimes books rooms when visiting household and for pictures.”
Epieos additionally finds sheepstealing@gmail.com registered an upwork.com profile beneath the title Ruben, who mentioned his predominant expertise are establishing safe server internet hosting options and PHP full-stack Internet improvement.
“I’m accustomed to Linux, working with relational databases (SQL),” the Upwork profile reads. “I additionally script in Python primarily for writing social media bots.”
The Upwork profile for Ruben Thomson in Cottesloe, Australia.
Epieos additional found sheepstealing@gmail.com is related to a Microsoft account for Ruben Thomson, and to a now-defunct GitHub account known as XmasSnow/XmasSnowisBack that scammed individuals on the boards in 2022 by claiming to promote unique exploits for recently-released software program patches (recall that shitstickpp@gmail.com was used to register a discussion board account named ChristmasSnow).
This identical sheepstealing e mail deal with registered a Twitter/X account in 2026 known as “Gone Fishing” that lists its location as South Africa. That Gmail account additionally left a number of evaluations for companies listed on Google Maps over the previous seven years, however all of these institutions are situated on the west coast of Australia.
Enterprise evaluations in Western Australia left by the Google account sheepstealing at gmail.com.
The individuals search service Pipl finds a 21-year-old Ruben Thomson in Western Australia who has a cellphone quantity ending in 979. A lookup on that quantity at Epieos reveals it’s related to a TikTok account beneath the title Ellis, and to a PayPal account within the title of Ruben Thomson.
Lastly, a search on the title Ruben Thomson from Cottesloe on the Australian authorities’s report of registered companies finds he has integrated or served as an official in a number of corporations created since 2024, together with Safe Computing Options, Tensor Industries, and one other entity paradoxically named OPSEC Specific. Recall that Specific was BulkDMT’s nickname on Breachforums.
Australian corporations related to Ruben Thomson. Picture: abr.enterprise.gov.au.
It’s ironic as a result of OPSEC is brief for the time period “operational safety,” which refers to methods and behaviors used to obfuscate and compartmentalize one’s real-life id on-line, and utilizing your cybercrime deal with as a part of your individual firm title may be very a lot the antithesis of that observe.
There may be not less than one different main opsec failure by Ruben that uncovered a hyperlink to TeamPCP. In June 2025, somebody utilizing the title Ruben Thomson registered on HackerOne, a preferred “bug bounty” program that seeks to reward and acknowledge researchers who comply with work with affected software program distributors to assist repair the issues earlier than publishing about their findings. What was Ruben Thomson’s chosen HackerOne username? Deadcatx3, a nickname that has been flagged by a number of safety companies as an alias utilized by TeamPCP.
The HackerOne profile for “Ruben Thomson” makes use of the nickname Deadcatx3, which a number of safety companies have concluded is an alias utilized by TeamPCP. Picture credit score: flare.io.
INTERVIEW WITH ELLIS
In early July 2026, not lengthy after having found clues about Ellis’s actual life id, KrebsOnSecurity interviewed the TeamPCP chief by way of Sign, the place he was remarkably open about his actions and private struggles [for the sake of simplicity, the TeamPCP spokesperson will be referred to from here on as Ellis].
Ellis claims he stopped doing cybercrime for TeamPCP in March 2026 — simply earlier than the assaults that compromised LiteLLM — and that not less than one different particular person has taken over the group’s management since then. Ellis shared {that a} 12 months earlier he had simply accomplished the most recent in a sequence of detox and sobriety packages, and was two months sober when he reconnected with some previous pals from the malware improvement scene.
“One 12 months in the past I wanted assist monetizing some [GitHub credentials], I used to be two months sober and wanted a distraction and one thing to maintain busy in addition to individuals to talk to,” Ellis mentioned. “I had largely disconnected from my previous circle, they’d turn into very poisonous and I wanted to get away from the substances. Beforehand I had finished some mass exploitation campaigns and grew up doing [malware development] and [capture the flag] contests. There have been some pals who have been additionally merchandising however had stopped some time, and one among them launched me to some chats the place I posted entry on the market.”
Previous to that, Ellis mentioned, he was homeless and hopping between “some very unstable locations.”
“Blackhatting is enjoyable,” he mentioned. “There are precise rewards and incentives to study and also you develop together with your crew. With out {qualifications}, no employer will even take the time to listen to you out.”
Ellis claims he’s earned a grand complete of about $20,000 for his actions with TeamPCP, and that it was by no means in regards to the cash or fame for him. Requested whether or not his experiences with TeamPCP would possibly put together him for gainful employment in a reputable IT job, Ellis mentioned he doubted it.
“I’m nowhere near a talent stage the place I’m comfy, and this may take perhaps half a decade of additional expertise,” he mentioned. “I not have to decide on between hire and meals for that I’m grateful and so are the crew members.”
Ellis expressed no regret over his cybercrime actions, and mentioned he was grateful for the friendships and relationships constructed all through his engagement with TeamPCP. The younger hacker additionally appeared resigned to his destiny, and informed KrebsOnSecurity that he’ll settle for the implications if he’s ever arrested.
“If I’ve already been came upon then its out of my management, I’ll make peace with that,” he mentioned. “Truthfully, I feel somebody like me wants lots of assist that jail simply can’t present. If I had the funds to review completely different components of the sector and nearer steerage, this may have turned out otherwise. However that’s a pipe dream and we each know this.”
It’s clear from studying Ellis’s posts to the group’s Matrix server chats that his struggles with sobriety are ongoing. On Thursday, June 25, Ellis informed @kernelstub he was about to “journey” along with his “homie.”
“What variety,” @kernelstub inquired.
“Ketty and a few DMT,” Ellis replied, referring to the dissociative anesthetic ketamine and dimethyltryptamine (DMT), a robust psychedelic compound that’s discovered naturally in some crops however can be synthetically produced in underground lab environments. “There’s a bit 2cb so we would throw that within the combine,” he continued, referring to one other psychedelic compound by its chemical shorthand.
Roughly two weeks earlier than his arrest, Ellis informed KrebsOnSecurity he was prepared to go away his lifetime of crime behind and was ready to show himself in, however that within the meantime he was planning to tie up free ends.
Lower than 24 hours later, the TeamPCP chief posted a picture on Telegram exhibiting a yellowish powdered substance in a baggie and on a scale, presumably artificial DMT. The picture reveals the powder being weighed subsequent to a sequence of small vape cartridges, two of that are open on the desk in entrance of the photographer.
A picture posted by the TeamPCP chief to Telegram, promoting his acquisition of some sort of psychoactive substance, more than likely an artificial model of the highly effective hallucinogen referred to as DMT.
The 2 defendants have been arrested Wednesday morning. The AFP mentioned the lads face a mixed 14 cybercrime offenses and are scheduled to look in Perth Magistrates Court docket immediately.
Charlie Eriksen is a safety researcher at Aikido Safety who has intently adopted TeamPCP’s cybercrime campaigns. Eriksen mentioned TeamPCP are an excellent instance of a brand new form of menace actor that doesn’t match neatly into the standard classes.
“They don’t seem to be a state actor, not fairly organized cybercrime, and never purely ideological,” he mentioned. “Their motivations appear to combine cash, disruption, consideration, and beliefs.”
Eriksen mentioned that traditionally there has all the time been a significant hole between studying about an assault approach and having the ability to reliably flip it into an operational marketing campaign, however that enormous language fashions (LLMs) and synthetic intelligence more and more are serving to menace actors to bypass that information hole.
“You needed to perceive the analysis, adapt the code, troubleshoot it, construct infrastructure round it, after which repeat that course of throughout completely different targets,” he mentioned. “LLMs have compressed that hole considerably.”
Based on Eriksen, this creates an setting the place menace actors abruptly have the power to function at important scale with out having developed the operational self-discipline that historically accompanies that stage of functionality. Put one other means, it units the stage for cybercriminals who’re succesful sufficient to trigger important harm, however not essentially cautious sufficient to grasp or care in regards to the penalties.
“They are often noisy, they will make errors,” he mentioned. “They’ll go away proof in all places. They’ll take dangers {that a} skilled legal group or intelligence service would contemplate utterly unacceptable. However that doesn’t essentially make them much less harmful. In some methods, it might make them extra harmful. ”
In a current weblog publish, Eriksen known as TeamPCP’s Shai-Hulud worm the “neatest thing to occur to produce chain safety,” as a result of it compelled GitHub and different public coding platforms to erect new safety safeguards.
In direct response to TeamPCP’s broad success at pushing poisoned variations of standard software program packages, GitHub in late July launched a three-day “cooldown” mechanism for Dependabot, the platform’s device for auto-fetching newly shipped updates for any bundle dependencies. Cooldown durations are designed to assist purchase time for safety instruments and bundle maintainers to establish and take away any compromised variations. Different coding ecosystems like Python and varied JavaScript platforms additionally added assist for cooldown durations this 12 months amid rising calls from safety consultants in regards to the want for extra widespread adoption of the security characteristic.
Eriksen mentioned TeamPCP’s legacy is that they achieved within the span of some months what the availability chain safety group has been unable to do for years.
“They managed to get up Microsoft to the truth that they’d turn into negligent by way of safety,” Eriksen mentioned. “By compromising GitHub and stealing their supply code, they humiliated Microsoft into motion, making them lastly act on what we had been asking them to do and take severely for some time now.”
