Authorities in Australia have arrested two males believed to be members of TeamPCP, a prolific cybercrime and knowledge extortion group blamed for perpetrating the longest operating spree of software program provide chain assaults ever.<\/p>\n
In a press release launched at this time, the Australian Federal Police (AFP) mentioned two males from Western Australia, aged 21 and 23, had been arrested in reference to a \u201crefined cybercrime syndicate that allegedly created malicious open-source software program to rob hundreds of world companies.\u201d<\/p>\n
The AFP didn’t identify the defendants, however KrebsOnSecurity discovered the 21-year-old suspect\u2019s actual id in June, and has been speaking with him ever since. This story contains interviews with TeamPCP\u2019s self-described spokesperson, and examines clues left behind by the TeamPCP chief that possible led to his undoing.<\/p>\n
TeamPCP vaulted onto the cybercrime scene in late 2025, embedding malicious code in lots of of open supply software program instruments and extorting victims for revenue. Members of the group made headlines by compromising company cloud environments utilizing a self-propagating worm dubbed\u00a0Shai-Hulud, which added malicious code to open supply applications maintained by builders whose credentials at public code repositories like GitHub or NPM had been phished or stolen.<\/p>\n
Writing for Wired, journalist Andy Greenberg described TeamPCP\u2019s core tactic as a type of cyclical exploitation of software program builders.<\/p>\n
\u201cThe hackers achieve entry to a community the place an open supply software generally utilized by coders is being developed,\u201d Greenberg wrote in Could. \u201cThe hackers plant malware within the software that finally ends up on different software program builders\u2019 machines, together with some who’re writing different instruments supposed for use by coders. The malware permits TeamPCP\u2019s hackers to steal credentials that allow them publish malicious variations of these software program growth instruments, too. The cycle repeats, and TeamPCP\u2019s assortment of breached networks grows.\u201d<\/p>\n
TeamPCP additionally has practiced one thing akin to cyclical recruitment. In Could, the supply code for the third iteration of Shai-Hulud was revealed on-line, and TeamPCP quickly after launched a contest providing $1,000 in digital forex to whichever participant might conduct the most important provide chain operation utilizing the worm\u2019s code. In line with the competition guidelines, individuals had been scored primarily based on the variety of weekly and month-to-month downloads of packages they compromised \u2014 instantly incentivizing them to focus on the preferred code libraries.<\/p>\n
![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/07\/teampcp-shai-hulud.png\")
<\/p>\nA screenshot of a message from TeamPCP\u2019s Telegram account, saying the provision chain hacking contest. Picture: dataminr.com.<\/p>\n<\/div>\n
\u201cTeamPCP has said the competitors is a recruiting alternative they usually intend to buy all significant entry harvested from individuals\u2019 campaigns,\u201d the safety agency Dataminr wrote. \u201cThe $1,000 XMR (Monero) prize is a recruitment ground and has been dismissed by the actor as \u2018identical to participation trophy,\u2019 including \u2018when you discover one thing good you can be paid far more,\u2019 confirming the competition\u2019s true perform as expertise identification and malicious entry acquisition at scale.\u201d<\/p>\n
In March, TeamPCP executed a provide chain assault focusing on AI infrastructure by compromising the code for LiteLLM, an open supply AI gateway that connects customers to greater than 100 totally different massive language fashions. A current evaluation by the safety agency CloudSEK discovered TeamPCPs assault on LiteLLM harvested cloud service keys and different secrets and techniques from greater than 2,500 organizations, together with most of the world\u2019s prime expertise firms.<\/p>\n
In Could, TeamPCP claimed credit score for compromising not less than 3,800 code repositories on the Microsoft-owned GitHub, after a GitHub developer put in a code extension that was compromised by TeamPCP\u2019s malware.<\/p>\n
MEET THE CYBERCATS<\/h2>\n
Safety consultants say TeamPCP is much less of a hacker group than an amalgamation of menace actors from a number of cybercriminal gangs who generally work collectively towards comparable targets.<\/p>\n
\u201cIt’s not a structured felony crew with a single operator,\u201d mentioned Austin Larsen, a principal menace analyst with the Google Risk Intelligence Group. \u201cIt’s a peer neighborhood of individually-skilled actors, with one clear middle of gravity.\u201d<\/p>\n
That middle of gravity is George Prepakis, an achieved safety researcher and self-described exploit developer who operates the Twitter\/X profile @kernelstub. Earlier this yr, @kernelstub tweeted a public invite hyperlink to a Matrix chat server he created and dubbed \u201cCybercats,\u201d and TeamPCP and a number of other different cybercrime entities have been utilizing this server to speak every day for the previous a number of months.<\/p>\n
![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/08\/matrix-tpcp-xpl0itrs.png\")
<\/p>\nA screenshot of the Matrix chat server \u201cCybercats,\u201d whose members used hacker handles related to a number of distinct cybercrime teams which have sometimes collaborated on a sequence of provide chain and knowledge ransom assaults over the previous 9 months.<\/p>\n<\/div>\n
Kernelstub, like different directors within the Cybercats chat, has been utilizing his Twitter\/X profile identify as his deal with in these Matrix communications, continuously tweeting references to different members and to conversations going down within the Cybercats chat. In a lot of instances, the corresponding X accounts for members of the Cybercats chat taunted cybercrime victims publicly earlier than the incidents had been reported within the information media.<\/p>\n
The Cybercats administrator listed on the prime of the screenshot above \u2014 \u201cBoxturtle\u201d \u2014 is an in depth affiliate of TeamPCP who has been tweeting in regards to the group\u2019s conquests underneath the identify @xpl0itrsturtle. This deal with corresponds to a knowledge breach dealer lively on Breachforums and Darkforums who has been promoting knowledge stolen in a wave of current breaches at car producers, together with BMW Group, Audi, Honda, Mercedes-Benz, Volvo and Toyota, in addition to knowledge allegedly taken from Snapchat and SportRadar.<\/p>\n
![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/08\/xpl0itrs-dls.png\")
<\/p>\nThe information leak web site for the extortion group or deal with \u201cxpl0itrs.\u201d<\/p>\n<\/div>\n
The Cybercats administrator \u201cSeesawSec\u201d within the screenshot above is the alias of whoever is behind the cybercrime group generally known as Fulcrumsec, which lately claimed credit score for knowledge extortion assaults in opposition to the pharmaceutical big Novo Nordisk, the info dealer LexisNexis, and Avnet, a Fortune 500 distributor of digital parts.<\/p>\n
![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/08\/fulcrumsec-dls.png\")
<\/p>\nThe information leak web site of Fulcrum Safety, a.okay.a. Fulcrumsec.<\/p>\n<\/div>\n
The Cybercats administrator \u201c@pcpcasper\u201d additionally has been utilizing an identical identify on X to debate TeamPCP\u2019s assaults and victims. This particular person has an intensive message historical past on Telegram, the place their messages and shared movies present @pcpcasper is an lively and vocal member of the Nationwide Socialist Community, a neo-Nazi political group primarily based in Australia.<\/p>\n
At one level in these chats, @pcpcasper shared movies and pictures of what they claimed was their cat, and a number of other of these movies place this consumer in Western Australia. One supply near the investigation instructed KrebsOnSecurity that @pcpcasper was one of many two arrested, a declare supported by messages that @kernelstub posted on-line this morning.<\/p>\n
The Cybercats member roster pictured above additionally options an administrator with the username \u201cT,\u201d which is brief for the now-banned Twitter\/X profile @pcpcats, the account operated by the self-described TeamPCP spokesperson who was arrested at this time. As we\u2019ll see in a second, @pcpcats is also from Western Australia.<\/p>\n
By the point @kernelstub tweeted a public invite hyperlink to the Cybercats Matrix server, T\/@pcpcats was posting solely occasionally to the group chat, with different members usually inquiring as to his whereabouts and well-being. The group\u2019s collective concern associated to @pcpcats\u2019s tendency responsible his more and more prolonged absences on the usage of hallucinogens and different narcotics that saved him awake for days on finish, but additionally triggered him to crash in mattress for a number of days after the highs wore off.<\/p>\n The Cybercats member @pcpcats has used a number of nicknames on the cybercrime boards, together with EllisD25\/LSD on Darkforums, BulkDMT on Breachstars, and Categorical on Breachforums. These accounts are linked as a result of all of them marketed the identical Tox ID and\/or Session ID as instantaneous message contact handles of their cybercrime discussion board posts. BulkDMT was additionally recognized on the boards as DMT Host, which was a digital non-public server (VPS) internet hosting service that was peddled on Darkforums and Breachstars.<\/p>\n DMT Host\/EllisD25, posting on the English-language cybercrime neighborhood DarkForums in September 2025. Picture: ke-la.com.<\/p>\n<\/div>\n In line with the cyber intelligence agency Intel 471, Categorical registered on Breachforums utilizing the e-mail handle shitstickpp@gmail.com. Intel 471 finds Categorical posted on Breachforums throughout a two-month interval in 2025 utilizing 4 totally different Web addresses situated in South Africa. On July 30, 2025, Categorical introduced on Breachforums they had been promoting entry to 14 gigabytes of knowledge stolen from South Africa\u2019s State Info Know-how Company.<\/p>\n The menace intelligence platform Flashpoint recorded greater than a yr\u2019s value of messages from the TeamPCP chief\u2019s alter ego on Telegram \u2014 Persy_PCP \u2014 \u00a0who claimed they break up their life residing between two international locations [full disclosure: Flashpoint is an advertiser on this blog]. \u201cI’ve these [files] as nicely, downside is these are out of the country,\u201d Persy_PCP defined to a different consumer inquiring a few stolen knowledge set in November 2025.<\/p>\n Later that month, Persy_PCP complained, \u201cMy entire nation is racist they usually need individuals like me lifeless.\u201d Flashpoint information present BulkDMT shared in September 2025 that \u201cthis nation goes to fucking starve once they take the farmers land,\u201d a probable reference to white landowners in South Africa who declare to be focused by an ongoing genocide marketing campaign.<\/p>\n This tracks with public reporting on TeamPCP. Cyberscoop reported in June that Google had traced TeamPCP\u2019s residential and cell Web handle connections to South Africa, \u201cindicating the first operator was situated there throughout not less than a few of its assaults.\u201d<\/p>\n BulkDMT additionally shared on the group chat at Breachforums that they had been recovering from an habit to methamphetamine. \u201cMy life is kinda fucked rn [right now], however that\u2019s positive and there isn\u2019t actually a degree in pouring a lot emotional vitality into that truth, my dad and mom had cash however I sadly obtained actually hooked on some issues so I don\u2019t get to learn from that. So long as I proceed to outlive, keep sober, and transfer nearer in direction of my targets that\u2019s sufficient drive and that means.\u201d<\/p>\n The id menace safety firm SpyCloud finds shitstickpp@gmail.com reveals up within the registration of an account known as ChristmasSnow on the cybercrime neighborhood Raidforums in 2022. Practically the entire Web addresses used to entry that account got here from ISPs in Perth, Australia, SpyCloud discovered.<\/p>\n KrebsOnSecurity appeared up all of these Perth IP addresses in passive DNS information maintained by DomainTools.com, and located one in all them \u2014 211.27.196.111 \u2014 for a number of years was used as a personal file server by a household in Perth with the final identify of Thomson. These information present not less than three hosts \u2014 ithomson.direct.quickconnect.to (a distant Synology server), kthomson0061.direct.quickconnect.to, and joshuawthomson39.myqnapcloud.com (a QNAP community storage gadget) \u2014 persevered at that handle between 2022 and 2025.<\/p>\n Looking out on \u201cjoshuathomson39\u201d within the breach monitoring service Constella Intelligence reveals an account on the freight forwarding firm kwe.com created within the identify of Joshua Thomson from Perth, Australia. The open supply intelligence platform Epieos finds the cellphone quantity hooked up to that kwe.com account was used to register a Fb profile for Josh Thomson, which says his household features a brother named Ruben, his father Ian, and his mother Cindy.<\/p>\n That Fb profile additionally says Josh and his household are initially from Pietermaritzburg, in KwaZulu-Natal, South Africa, however at the moment residing in Cottesloe, a beach-side suburb of Perth. A search in DomainTools for Ian Thomson and Australia unearthed 5 domains by the identical registrant, together with securecomputing.au, thomson.org.au, and thomsonfamily.web.au. Ian Thomson is a dentist in Cottesloe, and a biography says he graduated from The College of the Witwatersrand in Johannesburg, South Africa.<\/p>\n Constella finds a joshua@thomson.org.au registered a lot of accounts on-line, however Josh doesn\u2019t appear to have a lot of a connection to dodgy cybercrime boards. His brother Ruben, however, has fairly the presence on these communities, relationship again to not less than 2018. Constella experiences ruben@thomson.org.au continuously reused the password \u201cjoshuathomson1,\u201d and Constella additional finds that password was utilized by only a handful of accounts, together with yolosolo17@gmail.com and surfinup8@gmail.com.<\/p>\n In line with Intel 471, surfinup8@gmail.com was used to register the consumer Yolosolo17 on the crime discussion board Altenen in 2018, and that consumer account was registered from the Perth handle 110.141.230.15. On Altenen, Yolosolo17 marketed free net proxies, in addition to the area rubenthomson.com, which was at one level used to promote steeply discounted iPhones. DomainTools says rubenthomson.com was hosted at 110.141.230.15 and registered to surfinup8@gmail.com.<\/p>\n A cached copy of the area rubenthomson.com from 2017 reveals a login web page beneath a banded stack of cash. Picture: archive.org.<\/p>\n<\/div>\n SpyCloud experiences 10.141.230.15 was utilized by the e-mail handle sheepstealing@gmail.com on Raidforums and surfinup8@gmail.com on Nulled, and that the identical IP was utilized by the e-mail addresses ian@thomsonfamily.web.au, jasper@yakuza.cc, and rubenthomson1@gmail.com. SpyCloud additionally reveals that sheepstealing Gmail handle is tied to the accounts Sheep420, YoloSolo117 and Yakuza.cc on Raidforums, and to the account \u201cSheep Stealing\u201d on Hackforums. Intel 471 says sheepstealing@gmail.com was used to register the account DingoFlour on Breachforums in October 2023, as nicely Sheepx on Altenen.<\/p>\n Epieos experiences that ruben@securecomputing.au is tied to an Airbnb account for Ruben, who described himself as a Net developer who went to highschool on the College of Western Australia and was residing exterior the nation. \u201cHey, I\u2019m Ruben, my associates name me Ellis. I\u2019m a Perth inventive who sometimes books rooms when visiting household and for images.\u201d<\/p>\n Epieos additionally finds sheepstealing@gmail.com registered an upwork.com profile underneath the identify Ruben, who mentioned his major abilities are establishing safe server internet hosting options and PHP full-stack Net growth.<\/p>\n \u201cI\u2019m accustomed to Linux, working with relational databases (SQL),\u201d the Upwork profile reads. \u201cI additionally script in Python primarily for writing social media bots.\u201d<\/p>\n The Upwork profile for Ruben Thomson in Cottesloe, Australia.<\/p>\n<\/div>\n Epieos additional found sheepstealing@gmail.com is linked to a Microsoft account for Ruben Thomson, and to a now-defunct GitHub account known as XmasSnow\/XmasSnowisBack that scammed individuals on the boards in 2022 by claiming to promote unique exploits for recently-released software program patches (recall that shitstickpp@gmail.com was used to register a discussion board account named ChristmasSnow).<\/p>\n This similar sheepstealing e-mail handle registered a Twitter\/X account in 2026 known as \u201cGone Fishing\u201d that lists its location as South Africa. That Gmail account additionally left a number of evaluations for companies listed on Google Maps over the previous seven years, however all of these institutions are situated on the west coast of Australia.<\/p>\n Enterprise evaluations in Western Australia left by the Google account sheepstealing at gmail.com.<\/p>\n<\/div>\n The individuals search service Pipl finds a 21-year-old Ruben Thomson in Western Australia who has a cellphone quantity ending in 979. A lookup on that quantity at Epieos reveals it’s linked to a TikTok account underneath the identify Ellis, and to a PayPal account within the identify of Ruben Thomson.<\/p>\n Lastly, a search on the identify Ruben Thomson from Cottesloe on the Australian authorities\u2019s report of registered companies finds he has included or served as an official in a number of firms created since 2024, together with Safe Computing Options, Tensor Industries, and one other entity mockingly named OPSEC Categorical. Recall that Categorical was BulkDMT\u2019s nickname on Breachforums.<\/p>\n Australian firms linked to Ruben Thomson. Picture: abr.enterprise.gov.au.<\/p>\n<\/div>\n It\u2019s ironic as a result of OPSEC is brief for the time period \u201coperational safety,\u201d which refers to strategies and behaviors used to obfuscate and compartmentalize one\u2019s real-life id on-line, and utilizing your cybercrime deal with as a part of your individual firm identify could be very a lot the antithesis of that observe.<\/p>\n There may be not less than one different main opsec failure by Ruben that uncovered a hyperlink to TeamPCP. In June 2025, somebody utilizing the identify Ruben Thomson registered on HackerOne, a well-liked \u201cbug bounty\u201d program that seeks to reward and acknowledge researchers who conform to work with affected software program distributors to assist repair the failings earlier than publishing about their findings. What was Ruben Thomson\u2019s chosen HackerOne username? Deadcatx3, a nickname that has been flagged by a number of safety companies as an alias utilized by TeamPCP.<\/p>\n The HackerOne profile for \u201cRuben Thomson\u201d makes use of the nickname Deadcatx3, which a number of safety companies have concluded is an alias utilized by TeamPCP. Picture credit score: flare.io.<\/p>\n<\/div>\n In early July 2026, not lengthy after having found clues about Ellis\u2019s actual life id, KrebsOnSecurity interviewed the TeamPCP chief through Sign, the place he was remarkably open about his actions and private struggles [for the sake of simplicity, the TeamPCP spokesperson will be referred to from here on as Ellis].<\/p>\n Ellis claims he stopped doing cybercrime for TeamPCP in March 2026 \u2014 simply earlier than the assaults that compromised LiteLLM \u2014 and that not less than one different particular person has taken over the group\u2019s management since then. Ellis shared {that a} yr earlier he had simply accomplished the newest in a sequence of detox and sobriety applications, and was two months sober when he reconnected with some previous associates from the malware growth scene.<\/p>\n \u201cOne yr in the past I wanted assist monetizing some [GitHub credentials], I used to be two months sober and wanted a distraction and one thing to maintain busy in addition to individuals to talk to,\u201d Ellis mentioned. \u201cI had largely disconnected from my previous circle, they’d change into very poisonous and I wanted to get away from the substances. Beforehand I had executed some mass exploitation campaigns and grew up doing [malware development] and [capture the flag] contests. There have been some associates who had been additionally merchandising however had stopped some time, and one in all them launched me to some chats the place I posted entry on the market.\u201d<\/p>\n Previous to that, Ellis mentioned, he was homeless and hopping between \u201csome very unstable locations.\u201d<\/p>\n \u201cBlackhatting is enjoyable,\u201d he mentioned. \u201cThere are precise rewards and incentives to be taught and also you develop along with your crew. With out {qualifications}, no employer will even take the time to listen to you out.\u201d<\/p>\n Ellis claims he\u2019s earned a grand whole of about $20,000 for his actions with TeamPCP, and that it was by no means in regards to the cash or fame for him. Requested whether or not his experiences with TeamPCP may put together him for gainful employment in a respectable IT job, Ellis mentioned he doubted it.<\/p>\n \u201cI’m nowhere near a ability degree the place I’m snug, and this is able to take possibly half a decade of additional expertise,\u201d he mentioned. \u201cI not have to decide on between hire and meals for that I\u2019m grateful and so are the crew members.\u201d<\/p>\n Ellis expressed no regret over his cybercrime actions, and mentioned he was grateful for the friendships and relationships constructed all through his engagement with TeamPCP. The younger hacker additionally appeared resigned to his destiny, and instructed KrebsOnSecurity that he\u2019ll settle for the implications if he\u2019s ever arrested.<\/p>\n \u201cIf I\u2019ve already been discovered then its out of my management, I\u2019ll make peace with that,\u201d he mentioned. \u201cActually, I believe somebody like me wants a number of assist that jail simply can\u2019t present. If I had the funds to review totally different elements of the sector and nearer steering, this is able to have turned out in another way. However that\u2019s a pipe dream and we each know this.\u201d<\/p>\n It’s clear from studying Ellis\u2019s posts to the group\u2019s Matrix server chats that his struggles with sobriety are ongoing. On Thursday, June 25, Ellis instructed @kernelstub he was about to \u201cjourney\u201d along with his \u201chomie.\u201d<\/p>\n \u201cWhat variety,\u201d @kernelstub inquired.<\/p>\n \u201cKetty and a few DMT,\u201d Ellis replied, referring to the dissociative anesthetic ketamine and dimethyltryptamine (DMT), a robust psychedelic compound that’s discovered naturally in some vegetation however can also be synthetically produced in underground lab environments. \u201cThere\u2019s slightly 2cb so we would throw that within the combine,\u201d he continued, referring to a different psychedelic compound by its chemical shorthand.<\/p>\n Roughly two weeks earlier than his arrest, Ellis instructed KrebsOnSecurity he was prepared to go away his lifetime of crime behind and was ready to show himself in, however that within the meantime he was planning to tie up unfastened ends.<\/p>\n Lower than 24 hours later, the TeamPCP chief posted a picture on Telegram displaying a yellowish powdered substance in a baggie and on a scale, presumably artificial DMT. The picture reveals the powder being weighed subsequent to a sequence of small vape cartridges, two of that are open on the desk in entrance of the photographer.<\/p>\n A picture posted by the TeamPCP chief to Telegram, promoting his acquisition of some sort of psychoactive substance, most definitely an artificial model of the highly effective hallucinogen generally known as DMT.<\/p>\n<\/div>\n The 2 defendants had been arrested Wednesday morning. The AFP mentioned the lads face a mixed 14 cybercrime offenses and are scheduled to seem in Perth Magistrates Courtroom at this time.<\/p>\n Charlie Eriksen is a safety researcher at Aikido Safety who has carefully adopted TeamPCP\u2019s cybercrime campaigns. Eriksen mentioned TeamPCP are a great instance of a brand new type of menace actor that doesn’t match neatly into the standard classes.<\/p>\n \u201cThey don’t seem to be a state actor, not fairly organized cybercrime, and never purely ideological,\u201d he mentioned. \u201cTheir motivations appear to combine cash, disruption, consideration, and beliefs.\u201d<\/p>\n Eriksen mentioned that traditionally there has all the time been a significant hole between studying about an assault method and with the ability to reliably flip it into an operational marketing campaign, however that giant language fashions (LLMs) and synthetic intelligence more and more are serving to menace actors to bypass that data hole.<\/p>\n \u201cYou needed to perceive the analysis, adapt the code, troubleshoot it, construct infrastructure round it, after which repeat that course of throughout totally different targets,\u201d he mentioned. \u201cLLMs have compressed that hole considerably.\u201d<\/p>\n In line with Eriksen, this creates an setting the place menace actors all of a sudden have the flexibility to function at important scale with out having developed the operational self-discipline that historically accompanies that degree of functionality. Put one other manner, it units the stage for cybercriminals who’re succesful sufficient to trigger important harm, however not essentially cautious sufficient to know or care in regards to the penalties.<\/p>\n \u201cThey are often noisy, they’ll make errors,\u201d he mentioned. \u201cThey will go away proof in every single place. They will take dangers {that a} skilled felony group or intelligence service would take into account utterly unacceptable. However that doesn’t essentially make them much less harmful. In some methods, it will probably make them extra harmful.\u201d<\/p>\n In a current weblog put up, Eriksen known as TeamPCP\u2019s Shai-Hulud worm the \u201csmartest thing to occur to provide chain safety,\u201d as a result of it pressured GitHub and different public coding platforms to erect new safety safeguards.<\/p>\n In direct response to TeamPCP\u2019s broad success at pushing poisoned variations of in style software program packages, GitHub in late July launched a three-day \u201ccooldown\u201d mechanism for Dependabot, the platform\u2019s software for auto-fetching newly shipped updates for any bundle dependencies. Cooldown durations are designed to assist purchase time for safety instruments and bundle maintainers to establish and take away any compromised variations. Different coding ecosystems like Python and numerous JavaScript platforms additionally added help for cooldown durations this yr amid rising calls from safety consultants in regards to the want for extra widespread adoption of the security characteristic.<\/p>\n Eriksen mentioned TeamPCP\u2019s legacy is that they achieved within the span of some months what the provision chain safety neighborhood has been unable to do for years.<\/p>\n \u201cThey managed to get up Microsoft to the truth that they’d change into negligent by way of safety,\u201d Eriksen mentioned. \u201cBy compromising GitHub and stealing their supply code, they humiliated Microsoft into motion, making them lastly act on what we had been asking them to do and take critically for some time now.\u201d<\/p>\n Replace, 10:08 a.m. ET: A narrative this morning from ABC Information in Australia confirms Ruben Ian Thomson of Cottesloe was one of many two arrested. The 23-year-old suspect regarded as @pcpcasper, Michael Gaebler, additionally was arrested in Perth. ABC Information experiences that Thomson was denied bail (Mr. Gaebler\u2019s lawyer reportedly didn’t request bail for his shopper), and that each males shall be held in custody till their subsequent courtroom look on September 18.<\/p>\n<\/p><\/div>\nWHO IS THE TEAMPCP LEADER?<\/h2>\n
![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/07\/dmthost.png\")
<\/p>\n![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/05\/rubenthomsondotcom.png\")
<\/p>\n![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/07\/upwork-thomson.png\")
<\/p>\n![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/07\/gonefishing.png\")
<\/p>\n![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/08\/rthomson-companies.png\")
<\/p>\n![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/08\/ruben-deadcatx3.png\")
<\/p>\nINTERVIEW WITH ELLIS<\/h2>\n
![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/08\/teampcp-dmtmaybe.png\")
<\/p>\n