Authorities in Australia have arrested two males believed to be members of TeamPCP, a prolific cybercrime and knowledge extortion group blamed for perpetrating the longest operating spree of software program provide chain assaults ever.
In a press release launched at this time, the Australian Federal Police (AFP) mentioned two males from Western Australia, aged 21 and 23, had been arrested in reference to a “refined cybercrime syndicate that allegedly created malicious open-source software program to rob hundreds of world companies.”
The AFP didn’t identify the defendants, however KrebsOnSecurity discovered the 21-year-old suspect’s actual id in June, and has been speaking with him ever since. This story contains interviews with TeamPCP’s self-described spokesperson, and examines clues left behind by the TeamPCP chief that possible led to his undoing.
TeamPCP vaulted onto the cybercrime scene in late 2025, embedding malicious code in lots of of open supply software program instruments and extorting victims for revenue. Members of the group made headlines by compromising company cloud environments utilizing a self-propagating worm dubbed Shai-Hulud, which added malicious code to open supply applications maintained by builders whose credentials at public code repositories like GitHub or NPM had been phished or stolen.
Writing for Wired, journalist Andy Greenberg described TeamPCP’s core tactic as a type of cyclical exploitation of software program builders.
“The hackers achieve entry to a community the place an open supply software generally utilized by coders is being developed,” Greenberg wrote in Could. “The hackers plant malware within the software that finally ends up on different software program builders’ machines, together with some who’re writing different instruments supposed for use by coders. The malware permits TeamPCP’s hackers to steal credentials that allow them publish malicious variations of these software program growth instruments, too. The cycle repeats, and TeamPCP’s assortment of breached networks grows.”
TeamPCP additionally has practiced one thing akin to cyclical recruitment. In Could, the supply code for the third iteration of Shai-Hulud was revealed on-line, and TeamPCP quickly after launched a contest providing $1,000 in digital forex to whichever participant might conduct the most important provide chain operation utilizing the worm’s code. In line with the competition guidelines, individuals had been scored primarily based on the variety of weekly and month-to-month downloads of packages they compromised — instantly incentivizing them to focus on the preferred code libraries.
A screenshot of a message from TeamPCP’s Telegram account, saying the provision chain hacking contest. Picture: dataminr.com.
“TeamPCP has said the competitors is a recruiting alternative they usually intend to buy all significant entry harvested from individuals’ campaigns,” the safety agency Dataminr wrote. “The $1,000 XMR (Monero) prize is a recruitment ground and has been dismissed by the actor as ‘identical to participation trophy,’ including ‘when you discover one thing good you can be paid far more,’ confirming the competition’s true perform as expertise identification and malicious entry acquisition at scale.”
In March, TeamPCP executed a provide chain assault focusing on AI infrastructure by compromising the code for LiteLLM, an open supply AI gateway that connects customers to greater than 100 totally different massive language fashions. A current evaluation by the safety agency CloudSEK discovered TeamPCPs assault on LiteLLM harvested cloud service keys and different secrets and techniques from greater than 2,500 organizations, together with most of the world’s prime expertise firms.
In Could, TeamPCP claimed credit score for compromising not less than 3,800 code repositories on the Microsoft-owned GitHub, after a GitHub developer put in a code extension that was compromised by TeamPCP’s malware.
MEET THE CYBERCATS
Safety consultants say TeamPCP is much less of a hacker group than an amalgamation of menace actors from a number of cybercriminal gangs who generally work collectively towards comparable targets.
“It’s not a structured felony crew with a single operator,” mentioned Austin Larsen, a principal menace analyst with the Google Risk Intelligence Group. “It’s a peer neighborhood of individually-skilled actors, with one clear middle of gravity.”
That middle of gravity is George Prepakis, an achieved safety researcher and self-described exploit developer who operates the Twitter/X profile @kernelstub. Earlier this yr, @kernelstub tweeted a public invite hyperlink to a Matrix chat server he created and dubbed “Cybercats,” and TeamPCP and a number of other different cybercrime entities have been utilizing this server to speak every day for the previous a number of months.
A screenshot of the Matrix chat server “Cybercats,” whose members used hacker handles related to a number of distinct cybercrime teams which have sometimes collaborated on a sequence of provide chain and knowledge ransom assaults over the previous 9 months.
Kernelstub, like different directors within the Cybercats chat, has been utilizing his Twitter/X profile identify as his deal with in these Matrix communications, continuously tweeting references to different members and to conversations going down within the Cybercats chat. In a lot of instances, the corresponding X accounts for members of the Cybercats chat taunted cybercrime victims publicly earlier than the incidents had been reported within the information media.
The Cybercats administrator listed on the prime of the screenshot above — “Boxturtle” — is an in depth affiliate of TeamPCP who has been tweeting in regards to the group’s conquests underneath the identify @xpl0itrsturtle. This deal with corresponds to a knowledge breach dealer lively on Breachforums and Darkforums who has been promoting knowledge stolen in a wave of current breaches at car producers, together with BMW Group, Audi, Honda, Mercedes-Benz, Volvo and Toyota, in addition to knowledge allegedly taken from Snapchat and SportRadar.
The information leak web site for the extortion group or deal with “xpl0itrs.”
The Cybercats administrator “SeesawSec” within the screenshot above is the alias of whoever is behind the cybercrime group generally known as Fulcrumsec, which lately claimed credit score for knowledge extortion assaults in opposition to the pharmaceutical big Novo Nordisk, the info dealer LexisNexis, and Avnet, a Fortune 500 distributor of digital parts.
The information leak web site of Fulcrum Safety, a.okay.a. Fulcrumsec.
The Cybercats administrator “@pcpcasper” additionally has been utilizing an identical identify on X to debate TeamPCP’s assaults and victims. This particular person has an intensive message historical past on Telegram, the place their messages and shared movies present @pcpcasper is an lively and vocal member of the Nationwide Socialist Community, a neo-Nazi political group primarily based in Australia.
At one level in these chats, @pcpcasper shared movies and pictures of what they claimed was their cat, and a number of other of these movies place this consumer in Western Australia. One supply near the investigation instructed KrebsOnSecurity that @pcpcasper was one of many two arrested, a declare supported by messages that @kernelstub posted on-line this morning.
The Cybercats member roster pictured above additionally options an administrator with the username “T,” which is brief for the now-banned Twitter/X profile @pcpcats, the account operated by the self-described TeamPCP spokesperson who was arrested at this time. As we’ll see in a second, @pcpcats is also from Western Australia.
By the point @kernelstub tweeted a public invite hyperlink to the Cybercats Matrix server, T/@pcpcats was posting solely occasionally to the group chat, with different members usually inquiring as to his whereabouts and well-being. The group’s collective concern associated to @pcpcats’s tendency responsible his more and more prolonged absences on the usage of hallucinogens and different narcotics that saved him awake for days on finish, but additionally triggered him to crash in mattress for a number of days after the highs wore off.
WHO IS THE TEAMPCP LEADER?
The Cybercats member @pcpcats has used a number of nicknames on the cybercrime boards, together with EllisD25/LSD on Darkforums, BulkDMT on Breachstars, and Categorical on Breachforums. These accounts are linked as a result of all of them marketed the identical Tox ID and/or Session ID as instantaneous message contact handles of their cybercrime discussion board posts. BulkDMT was additionally recognized on the boards as DMT Host, which was a digital non-public server (VPS) internet hosting service that was peddled on Darkforums and Breachstars.
DMT Host/EllisD25, posting on the English-language cybercrime neighborhood DarkForums in September 2025. Picture: ke-la.com.
In line with the cyber intelligence agency Intel 471, Categorical registered on Breachforums utilizing the e-mail handle shitstickpp@gmail.com. Intel 471 finds Categorical posted on Breachforums throughout a two-month interval in 2025 utilizing 4 totally different Web addresses situated in South Africa. On July 30, 2025, Categorical introduced on Breachforums they had been promoting entry to 14 gigabytes of knowledge stolen from South Africa’s State Info Know-how Company.
The menace intelligence platform Flashpoint recorded greater than a yr’s value of messages from the TeamPCP chief’s alter ego on Telegram — Persy_PCP — who claimed they break up their life residing between two international locations [full disclosure: Flashpoint is an advertiser on this blog]. “I’ve these [files] as nicely, downside is these are out of the country,” Persy_PCP defined to a different consumer inquiring a few stolen knowledge set in November 2025.
Later that month, Persy_PCP complained, “My entire nation is racist they usually need individuals like me lifeless.” Flashpoint information present BulkDMT shared in September 2025 that “this nation goes to fucking starve once they take the farmers land,” a probable reference to white landowners in South Africa who declare to be focused by an ongoing genocide marketing campaign.
This tracks with public reporting on TeamPCP. Cyberscoop reported in June that Google had traced TeamPCP’s residential and cell Web handle connections to South Africa, “indicating the first operator was situated there throughout not less than a few of its assaults.”
BulkDMT additionally shared on the group chat at Breachforums that they had been recovering from an habit to methamphetamine. “My life is kinda fucked rn [right now], however that’s positive and there isn’t actually a degree in pouring a lot emotional vitality into that truth, my dad and mom had cash however I sadly obtained actually hooked on some issues so I don’t get to learn from that. So long as I proceed to outlive, keep sober, and transfer nearer in direction of my targets that’s sufficient drive and that means.”
The id menace safety firm SpyCloud finds shitstickpp@gmail.com reveals up within the registration of an account known as ChristmasSnow on the cybercrime neighborhood Raidforums in 2022. Practically the entire Web addresses used to entry that account got here from ISPs in Perth, Australia, SpyCloud discovered.
KrebsOnSecurity appeared up all of these Perth IP addresses in passive DNS information maintained by DomainTools.com, and located one in all them — 211.27.196.111 — for a number of years was used as a personal file server by a household in Perth with the final identify of Thomson. These information present not less than three hosts — ithomson.direct.quickconnect.to (a distant Synology server), kthomson0061.direct.quickconnect.to, and joshuawthomson39.myqnapcloud.com (a QNAP community storage gadget) — persevered at that handle between 2022 and 2025.
Looking out on “joshuathomson39” within the breach monitoring service Constella Intelligence reveals an account on the freight forwarding firm kwe.com created within the identify of Joshua Thomson from Perth, Australia. The open supply intelligence platform Epieos finds the cellphone quantity hooked up to that kwe.com account was used to register a Fb profile for Josh Thomson, which says his household features a brother named Ruben, his father Ian, and his mother Cindy.
That Fb profile additionally says Josh and his household are initially from Pietermaritzburg, in KwaZulu-Natal, South Africa, however at the moment residing in Cottesloe, a beach-side suburb of Perth. A search in DomainTools for Ian Thomson and Australia unearthed 5 domains by the identical registrant, together with securecomputing.au, thomson.org.au, and thomsonfamily.web.au. Ian Thomson is a dentist in Cottesloe, and a biography says he graduated from The College of the Witwatersrand in Johannesburg, South Africa.
Constella finds a joshua@thomson.org.au registered a lot of accounts on-line, however Josh doesn’t appear to have a lot of a connection to dodgy cybercrime boards. His brother Ruben, however, has fairly the presence on these communities, relationship again to not less than 2018. Constella experiences ruben@thomson.org.au continuously reused the password “joshuathomson1,” and Constella additional finds that password was utilized by only a handful of accounts, together with yolosolo17@gmail.com and surfinup8@gmail.com.
In line with Intel 471, surfinup8@gmail.com was used to register the consumer Yolosolo17 on the crime discussion board Altenen in 2018, and that consumer account was registered from the Perth handle 110.141.230.15. On Altenen, Yolosolo17 marketed free net proxies, in addition to the area rubenthomson.com, which was at one level used to promote steeply discounted iPhones. DomainTools says rubenthomson.com was hosted at 110.141.230.15 and registered to surfinup8@gmail.com.
A cached copy of the area rubenthomson.com from 2017 reveals a login web page beneath a banded stack of cash. Picture: archive.org.
SpyCloud experiences 10.141.230.15 was utilized by the e-mail handle sheepstealing@gmail.com on Raidforums and surfinup8@gmail.com on Nulled, and that the identical IP was utilized by the e-mail addresses ian@thomsonfamily.web.au, jasper@yakuza.cc, and rubenthomson1@gmail.com. SpyCloud additionally reveals that sheepstealing Gmail handle is tied to the accounts Sheep420, YoloSolo117 and Yakuza.cc on Raidforums, and to the account “Sheep Stealing” on Hackforums. Intel 471 says sheepstealing@gmail.com was used to register the account DingoFlour on Breachforums in October 2023, as nicely Sheepx on Altenen.
Epieos experiences that ruben@securecomputing.au is tied to an Airbnb account for Ruben, who described himself as a Net developer who went to highschool on the College of Western Australia and was residing exterior the nation. “Hey, I’m Ruben, my associates name me Ellis. I’m a Perth inventive who sometimes books rooms when visiting household and for images.”
Epieos additionally finds sheepstealing@gmail.com registered an upwork.com profile underneath the identify Ruben, who mentioned his major abilities are establishing safe server internet hosting options and PHP full-stack Net growth.
“I’m accustomed to Linux, working with relational databases (SQL),” the Upwork profile reads. “I additionally script in Python primarily for writing social media bots.”
The Upwork profile for Ruben Thomson in Cottesloe, Australia.
Epieos additional found sheepstealing@gmail.com is linked to a Microsoft account for Ruben Thomson, and to a now-defunct GitHub account known as XmasSnow/XmasSnowisBack that scammed individuals on the boards in 2022 by claiming to promote unique exploits for recently-released software program patches (recall that shitstickpp@gmail.com was used to register a discussion board account named ChristmasSnow).
This similar sheepstealing e-mail handle registered a Twitter/X account in 2026 known as “Gone Fishing” that lists its location as South Africa. That Gmail account additionally left a number of evaluations for companies listed on Google Maps over the previous seven years, however all of these institutions are situated on the west coast of Australia.
Enterprise evaluations in Western Australia left by the Google account sheepstealing at gmail.com.
The individuals search service Pipl finds a 21-year-old Ruben Thomson in Western Australia who has a cellphone quantity ending in 979. A lookup on that quantity at Epieos reveals it’s linked to a TikTok account underneath the identify Ellis, and to a PayPal account within the identify of Ruben Thomson.
Lastly, a search on the identify Ruben Thomson from Cottesloe on the Australian authorities’s report of registered companies finds he has included or served as an official in a number of firms created since 2024, together with Safe Computing Options, Tensor Industries, and one other entity mockingly named OPSEC Categorical. Recall that Categorical was BulkDMT’s nickname on Breachforums.
Australian firms linked to Ruben Thomson. Picture: abr.enterprise.gov.au.
It’s ironic as a result of OPSEC is brief for the time period “operational safety,” which refers to strategies and behaviors used to obfuscate and compartmentalize one’s real-life id on-line, and utilizing your cybercrime deal with as a part of your individual firm identify could be very a lot the antithesis of that observe.
There may be not less than one different main opsec failure by Ruben that uncovered a hyperlink to TeamPCP. In June 2025, somebody utilizing the identify Ruben Thomson registered on HackerOne, a well-liked “bug bounty” program that seeks to reward and acknowledge researchers who conform to work with affected software program distributors to assist repair the failings earlier than publishing about their findings. What was Ruben Thomson’s chosen HackerOne username? Deadcatx3, a nickname that has been flagged by a number of safety companies as an alias utilized by TeamPCP.
The HackerOne profile for “Ruben Thomson” makes use of the nickname Deadcatx3, which a number of safety companies have concluded is an alias utilized by TeamPCP. Picture credit score: flare.io.
INTERVIEW WITH ELLIS
In early July 2026, not lengthy after having found clues about Ellis’s actual life id, KrebsOnSecurity interviewed the TeamPCP chief through Sign, the place he was remarkably open about his actions and private struggles [for the sake of simplicity, the TeamPCP spokesperson will be referred to from here on as Ellis].
Ellis claims he stopped doing cybercrime for TeamPCP in March 2026 — simply earlier than the assaults that compromised LiteLLM — and that not less than one different particular person has taken over the group’s management since then. Ellis shared {that a} yr earlier he had simply accomplished the newest in a sequence of detox and sobriety applications, and was two months sober when he reconnected with some previous associates from the malware growth scene.
“One yr in the past I wanted assist monetizing some [GitHub credentials], I used to be two months sober and wanted a distraction and one thing to maintain busy in addition to individuals to talk to,” Ellis mentioned. “I had largely disconnected from my previous circle, they’d change into very poisonous and I wanted to get away from the substances. Beforehand I had executed some mass exploitation campaigns and grew up doing [malware development] and [capture the flag] contests. There have been some associates who had been additionally merchandising however had stopped some time, and one in all them launched me to some chats the place I posted entry on the market.”
Previous to that, Ellis mentioned, he was homeless and hopping between “some very unstable locations.”
“Blackhatting is enjoyable,” he mentioned. “There are precise rewards and incentives to be taught and also you develop along with your crew. With out {qualifications}, no employer will even take the time to listen to you out.”
Ellis claims he’s earned a grand whole of about $20,000 for his actions with TeamPCP, and that it was by no means in regards to the cash or fame for him. Requested whether or not his experiences with TeamPCP may put together him for gainful employment in a respectable IT job, Ellis mentioned he doubted it.
“I’m nowhere near a ability degree the place I’m snug, and this is able to take possibly half a decade of additional expertise,” he mentioned. “I not have to decide on between hire and meals for that I’m grateful and so are the crew members.”
Ellis expressed no regret over his cybercrime actions, and mentioned he was grateful for the friendships and relationships constructed all through his engagement with TeamPCP. The younger hacker additionally appeared resigned to his destiny, and instructed KrebsOnSecurity that he’ll settle for the implications if he’s ever arrested.
“If I’ve already been discovered then its out of my management, I’ll make peace with that,” he mentioned. “Actually, I believe somebody like me wants a number of assist that jail simply can’t present. If I had the funds to review totally different elements of the sector and nearer steering, this is able to have turned out in another way. However that’s a pipe dream and we each know this.”
It’s clear from studying Ellis’s posts to the group’s Matrix server chats that his struggles with sobriety are ongoing. On Thursday, June 25, Ellis instructed @kernelstub he was about to “journey” along with his “homie.”
“What variety,” @kernelstub inquired.
“Ketty and a few DMT,” Ellis replied, referring to the dissociative anesthetic ketamine and dimethyltryptamine (DMT), a robust psychedelic compound that’s discovered naturally in some vegetation however can also be synthetically produced in underground lab environments. “There’s slightly 2cb so we would throw that within the combine,” he continued, referring to a different psychedelic compound by its chemical shorthand.
Roughly two weeks earlier than his arrest, Ellis instructed KrebsOnSecurity he was prepared to go away his lifetime of crime behind and was ready to show himself in, however that within the meantime he was planning to tie up unfastened ends.
Lower than 24 hours later, the TeamPCP chief posted a picture on Telegram displaying a yellowish powdered substance in a baggie and on a scale, presumably artificial DMT. The picture reveals the powder being weighed subsequent to a sequence of small vape cartridges, two of that are open on the desk in entrance of the photographer.
A picture posted by the TeamPCP chief to Telegram, promoting his acquisition of some sort of psychoactive substance, most definitely an artificial model of the highly effective hallucinogen generally known as DMT.
The 2 defendants had been arrested Wednesday morning. The AFP mentioned the lads face a mixed 14 cybercrime offenses and are scheduled to seem in Perth Magistrates Courtroom at this time.
Charlie Eriksen is a safety researcher at Aikido Safety who has carefully adopted TeamPCP’s cybercrime campaigns. Eriksen mentioned TeamPCP are a great instance of a brand new type of menace actor that doesn’t match neatly into the standard classes.
“They don’t seem to be a state actor, not fairly organized cybercrime, and never purely ideological,” he mentioned. “Their motivations appear to combine cash, disruption, consideration, and beliefs.”
Eriksen mentioned that traditionally there has all the time been a significant hole between studying about an assault method and with the ability to reliably flip it into an operational marketing campaign, however that giant language fashions (LLMs) and synthetic intelligence more and more are serving to menace actors to bypass that data hole.
“You needed to perceive the analysis, adapt the code, troubleshoot it, construct infrastructure round it, after which repeat that course of throughout totally different targets,” he mentioned. “LLMs have compressed that hole considerably.”
In line with Eriksen, this creates an setting the place menace actors all of a sudden have the flexibility to function at important scale with out having developed the operational self-discipline that historically accompanies that degree of functionality. Put one other manner, it units the stage for cybercriminals who’re succesful sufficient to trigger important harm, however not essentially cautious sufficient to know or care in regards to the penalties.
“They are often noisy, they’ll make errors,” he mentioned. “They will go away proof in every single place. They will take dangers {that a} skilled felony group or intelligence service would take into account utterly unacceptable. However that doesn’t essentially make them much less harmful. In some methods, it will probably make them extra harmful.”
In a current weblog put up, Eriksen known as TeamPCP’s Shai-Hulud worm the “smartest thing to occur to provide chain safety,” as a result of it pressured GitHub and different public coding platforms to erect new safety safeguards.
In direct response to TeamPCP’s broad success at pushing poisoned variations of in style software program packages, GitHub in late July launched a three-day “cooldown” mechanism for Dependabot, the platform’s software for auto-fetching newly shipped updates for any bundle dependencies. Cooldown durations are designed to assist purchase time for safety instruments and bundle maintainers to establish and take away any compromised variations. Different coding ecosystems like Python and numerous JavaScript platforms additionally added help for cooldown durations this yr amid rising calls from safety consultants in regards to the want for extra widespread adoption of the security characteristic.
Eriksen mentioned TeamPCP’s legacy is that they achieved within the span of some months what the provision chain safety neighborhood has been unable to do for years.
“They managed to get up Microsoft to the truth that they’d change into negligent by way of safety,” Eriksen mentioned. “By compromising GitHub and stealing their supply code, they humiliated Microsoft into motion, making them lastly act on what we had been asking them to do and take critically for some time now.”
Replace, 10:08 a.m. ET: A narrative this morning from ABC Information in Australia confirms Ruben Ian Thomson of Cottesloe was one of many two arrested. The 23-year-old suspect regarded as @pcpcasper, Michael Gaebler, additionally was arrested in Perth. ABC Information experiences that Thomson was denied bail (Mr. Gaebler’s lawyer reportedly didn’t request bail for his shopper), and that each males shall be held in custody till their subsequent courtroom look on September 18.
