An Australian team of cyber tech experts gave authorities a tip-off that helped the FBI and Australian Federal Police locate an alleged global hacker group in Perth.
Cyber experts allege TeamPCP had been operating since last year and had established a “scary” reputation when its alleged mastermind was arrested in Perth this year.
Experts allege the group struck technology infrastructure and supply chains and then sold the credentials it obtained.
A warning from the US FBI about the group in July alleged TeamPCP also engaged in extortion and collaboration with other threat actor groups, including publishing victim names on a public leak site and threatening disclosure of stolen data.
“Organisations impacted by this campaign should treat exfiltrated data and credentials as a persistent risk, as affiliated threat actors are likely to weaponise them long after the initial compromise,” the warning read.
International cyber threat intelligence organisation KELA said on its website that TeamPCP was first noticed in Telegram activity in mid-2025, then became more visible later that year.
McGrath Nicol head of cyber investigations Darren Hopkins was made aware about concerns an alleged hacker group was operating from Australia.
Australian authorities were notified about analysis that linked a young man in the affluent seaside suburb of Cottesloe, in Perth’s western suburbs, to TeamPCP.
Law enforcement groups started a formal investigation, which connected to other countries and involved the FBI.
Two men charged after probe
In August, two young WA men were arrested over the theft of sensitive data and user information from more than 1000 businesses and government agencies across the globe.
Ruben Ian Thomson, 21, from Cottesloe and Louis Michael Gaebler, 23, from Mandurah were taken into custody following a joint investigation with AFP and the FBI.
Police accused the men of receiving cryptocurrency payments for their roles in alleged criminal activity.
Mr Thomson was charged with possession of data with intent to commit a computer offence, four counts of unauthorised modification of data to commit a serious offence, supplying data with intent to commission a serious offence and dealing with the proceeds of crime worth more than $100,000.
His co-accused was charged with possessing data with intent to commit a computer offence, four counts of unauthorised modification of data with intent to commit a serious offence and supplying data with intent to commit a computer offence.
Both men have been remanded in custody since their arrest and the matter is before the Perth Magistrates Court, where it will be heard again on October 30.
FBI agent David Andish told media in August the bureau carried out a parallel investigation with Australian police that resulted in the arrest of Mr Thomson, the alleged leader of the cyber criminal group TeamPCP.
“The investigation follows a large scale software attack launched by TeamPCP in March this year,” he said.
“The group tampered with software updates for widely used development tools hiding malicious code in routine downloads.
“Those updates installed malware that gave them access to development environments and other systems.”
US Attorney Craig Missakian and FBI Special Agent In Charge Scott Schelble said in a joint statement that Mr Thomson was an Australian and South African national.
The US authorities alleged Mr Thomson conspired with others to exploit trusted software supply chain security tools, and inject malicious software code into companies’ tools.
“The malicious code would scan downstream customers’ computer environments for sensitive data to steal,” they said.
“If sensitive data was identified, the malicious code attempted to exfiltrate that data to other infrastructure controlled by Thomson and/or his co-conspirators.
“The malicious code also enabled them to maintain persistent access in the company’s computer environment.
“Following the exfiltration of data from the computer systems of the company, Thomson and/or his conspirators extorted ransom payments in exchange for a promise to not publicly release the data exfiltrated from the company.”
AFP Commander Graham Marshall alleged the men belonged to a sophisticated cybercrime network involved in large-scale offences including data intrusion, identity crime and cryptocurrency money laundering.
“They could impersonate legitimate users and services, bypass security controls and gain unauthorised access to networks and cloud environments,” he said.
“Police allege the syndicated gained significant financial benefit and facilitate further cybercrime intrusions.
“It is estimated the malicious code potentially compromised more than 1000 organisations globally.
“It is believed they stole more than 500,000 credentials.
“The impact is extensive and is estimated to be in the hundreds of millions of dollars.
“Further arrests and charges have not been ruled out.”
Mr Hopkins said Australians tended to be complacent about the issue because threat actor groups and hackers were usually from other countries.
“We hear about Russian threat actor groups, and we hear about countries being responsible, and it always feels so far away,” he said.
“We tend to think that we’re just victims … (but) anyone in any part of the world can do this and it really comes back to motivation as opposed to geolocation.
“You don’t know who’s next door.”
Mr Hopkins said hackers were usually a combination of talented technology professionals with an element of organised crime because of the services they offered.
“It’s far beyond just the technical piece, some of these groups offer money laundering services,” he said.
“They provide an ecosystem of support, they do software development, they do all of these things so it’s just another business.
“It’s just a very, very different business model to what we’re all familiar with.”
Click Here For The Original Source.
