A hacker’s reuse of an online screen name likely helped investigators catch him.
On Thursday, law enforcement arrested two men in Australia who are allegedly part of TeamPCP, a hacking gang that’s been spreading malware through open-source software tools.
One of the reported suspects, 21-year-old Ruben Thomson, wasn’t hard to identify because of his association with the screen name DeadCatx3, cybersecurity provider Flare outlines in a new report. TeamPCP has been linked to the alias DeadCatx3 via an account on the software development platform GitHub, which the group used to host its tools. Flare looked to see if the DeadCatx3 handle was registered on any other platforms, and it popped up on HackerOne, a bug bounty platform security researchers use to submit software vulnerabilities.
(Credit: Flare.io)
A user on HackerOne not only registered an account with the DeadCatx3 handle in June 2025 but also listed their full name on the profile.
“The account in question had the name Ruben Thomson connected to it. It can’t be that easy, can it?” Flare said. It seems like it was. Flare uncovered a wider web of accounts traced back to Thomson, including a Steam account that featured a unique picture of a cartoon cat in a hoodie sitting in front of computer monitors.
“We then found a screenshot of the TeamPCP Telegram account using the same profile picture as Thomson’s Steam account, signaling with high confidence that Ruben Thomson is the leader of Team PCP,” Flare concluded.
(Credit: Flare.io)
The other reason TeamPCP was easier to investigate was that the group was “loud by choice,” Flare noted, and frequently posted on their Telegram channel and on X before their account was shut down. “A group that talks this much, this publicly, under this many aliases, doesn’t just invite scrutiny, but it hands you the first thread to pull,” the cybersecurity vendor added.
(Credit: Flare.io)
Cybersecurity journalist Brian Krebs did similar reporting on Thomson and even interviewed him last month before his arrest.
Recommended by Our Editors
Using the alias Ellis, Thomson “expressed no remorse over his cybercrime activities, and said he was grateful for the friendships and relationships built throughout his engagement with TeamPCP,” Krebs wrote. “The young hacker also seemed resigned to his fate, and told KrebsOnSecurity that he’ll accept the consequences if he’s ever arrested.”
Australian Federal Police also reportedly arrested a 23-year-old named Louis Michael Gaebler. “It is estimated the malicious code potentially compromised more than 1,000 organizations globally, enabling the theft of more than 500,000 credentials, and the exfiltration of at least 300 gigabytes of data,” the agency added.
Together, both suspects have been charged with 14 offenses and are scheduled to appear in a local court in Australia later today.
About Our Expert
Michael Kan
Principal Reporter
Experience
I’ve been a journalist for over 15 years. I got my start as a schools and cities reporter in Kansas City and joined PCMag in 2017, where I cover satellite internet services, cybersecurity, PC hardware, and more. I’m currently based in San Francisco, but previously spent over five years in China, covering the country’s technology sector.
Since 2020, I’ve covered the launch and explosive growth of SpaceX’s Starlink satellite internet service, writing 600+ stories on availability and feature launches, but also the regulatory battles over the expansion of satellite constellations, fights with rival providers like AST SpaceMobile and Amazon, and the effort to expand into satellite-based mobile service. I’ve combed through FCC filings for the latest news and driven to remote corners of California to test Starlink’s cellular service.
I also cover cyber threats, from ransomware gangs to the emergence of AI-based malware. In 2024 and 2025, the FTC forced Avast to pay consumers $16.5 million for secretly harvesting and selling their personal information to third-party clients, as revealed in my joint investigation with Motherboard.
I also cover the PC graphics card market. Pandemic-era shortages led me to camp out in front of a Best Buy to get an RTX 3000. I’m now following how the AI-driven memory shortage is impacting the entire consumer electronics market. I’m always eager to learn more, so please jump in the comments with feedback and send me tips.
Click Here For The Original Source.
