Two Perth-based men in their early 20s have been charged over their alleged ties to a highly organised cybercrime syndicate that facilitated attacks against thousands of organisations across the globe.
On 26 August, the Australian Police Force (AFP) and Western Australia Police Force (WAPF) executed search warrants at separate properties in Cottesloe, Hamilton Hill, and Mandurah.
The young men have been named as 21-year-old Ruben Thomson and 23-year-old Louis Gaebler by ABC News.
The were charged for their alleged role in a cybercrime syndicate dubbed ‘TeamPCP’.
According to AFP, this “highly organised” syndicate was allegedly involved in large-scale cybercrime offending, including identity crime, data intrusion and cryptocurrency-based money laundering.
The WA youths were arrested and charged roughly four months after transnational investigations into TeamPCP started in April.
At the time, AFP and the US Federal Bureau of Investigation (FBI) received tip-offs from multiple threat-monitoring companies about the widespread distribution of malicious code into certain open-source software, which was in turn being used by unwitting developers.
The open-source tools may have included security scanner Trivy, code analysis solution KICS, and AI gateway LiteLLM.
Police intend to allege infected software was distributed into systems across government, academia, and private sector organisations, enabling the syndicate to steal sensitive data such as user credentials.
“By weaponising these supply chain entry points, the threat actors were able to introduce malicious code into victim environments at scale,” said the FBI.
According to police, this ‘trojan horse’ method potentially compromised more than 1,000 organisations, enabling the theft of over 500,000 credentials and the exfiltration of “at least 300GB of data”.
AFP said the financial impacts are estimated to be in the hundreds of millions of dollars.
The WA men have been accused of being “principal participants” in the criminal syndicate, for which they were allegedly paid an undetermined amount of cryptocurrency.
“These men are allegedly members of the cybercriminal group TeamPCP, whose malicious code potentially compromised more than a thousand organisations worldwide,” said Brett Leatherman, FBI Cyber Division assistant director.
“We are proud to work with AFP and WAPF to impose cost on criminal actors and combat the growing threat of software supply-chain attacks.”
Thomson dubbed leader after US indictment
Speaking at a media conference on Thursday, FBI assistant law enforcement attache Dave Andish said Thomson was the alleged leader of TeamPCP.
Soon after, the Attorney’s Office for the Northern District of California announced a US indictment against Thomson on charges related to cyberattacks conducted under the TeamPCP moniker.
The office said Thomson had allegedly “conspired with others” to exploit trusted software supply chain security tools and inject malicious code into them.
“The exploitation of the computer systems of these companies then cascaded, affecting the companies’ downstream customers that utilised these tools,” wrote the California office.
This malicious code would scan downstream customers’ systems for sensitive data, then attempt to exfiltrate it to infrastructure allegedly controlled by Thomson and his co-conspirators.
With stolen data and access to the infected systems at hand, Thomson and his colleagues allegedly extorted ransom payments in exchange for guarantees to not leak stolen data.
The FBI, AFP and WA Police announced the arrests. Photo: AFP
“Cybercrime knows no borders and is a growing threat globally,” said AFP commander Graeme Marshall.
“Cybercrime syndicates are becoming increasingly organised and often operate like professional businesses.
“But our investigators are relentless in tracking down criminals who attempt to exploit digital anonymity to attack our community.”
A ‘rare occurrence’ in Australia
Following their property searches, police charged the young men with a combined total of 14 offences.
Though AFP did not explicitly name either of the young Australians, a press release revealed a 21-year-old and a 23-year-old had received most of their charges in relation to unauthorised modification of data and other computer-related offences.
The 21-year-old was additionally charged in relation to dealing with proceeds of crime, money, or property, and refusing to hand over private encryption keys, PINs, or passwords.
“Unfortunately, we do see a lot of very young offenders involved in cybercrime,” said Marshall.
“It’s probably a mixture of the fact that they’ve grown up native with technology, and some of them are exceptionally smart.
“These two, we will allege, are internationally significant cyber threat actors.
“That is a rare occurrence – in Australia – to have them in our jurisdiction.”
AFP did not specifically name those targeted by Thomson, Gaebler, and TeamPCP, though Marshall said the “significant amounts of data” yielded during search warrants would likely lead to the identification of further victims.
“When that occurs, we will reach out domestically here in Australia to any victims [and] through our counterparts internationally to notify offshore victims as they’re identified,” said Marshall.
“Further arrests and charges have not been ruled out.”
Click Here For The Original Source.
