Australian authorities have arrested two men accused of taking part in cybercrimes for TeamPCP, a prolific hacking group linked to a nine-month campaign of supply-chain attacks that infected more than 1,000 organizations worldwide. The arrests, announced Wednesday by the Australian Federal Police, mark a significant development in the pursuit of a group that has troubled security teams across the globe since it first surfaced in December.
According to the police statement, the two men were charged with 14 offenses and identified as members of TeamPCP. Authorities did not release their names, noting only that they lived in the Western Australian towns of Cottesloe and Mandurah. If convicted, one man faces more than 20 years in prison, while the other faces more than 10.
How the Shai-Hulud worm spread
TeamPCP is best known for a sustained series of supply-chain attacks that laced open source software with malware capable of spreading from one package to another. The infections targeted organizations’ CI/CD pipelines, the platforms used to rapidly develop, update, and deploy software.
Once a package or tool was compromised, the worm—dubbed Shai-Hulud—attached itself to future package updates. When developers downloaded the affected packages and ran them through their own CI/CD systems, their software was compromised as well. A separate component collected credentials for other packages stored in the memory of infected hardware. Members then used those stolen credentials to infect additional packages, allowing the campaign to keep expanding.
To keep its credential-collection channel resistant to takedowns, Shai-Hulud used a form of smart contract known as an Internet Computer Protocol-based canister. The mechanism let the worm locate control servers through URLs that could be changed at any time, with infected machines reporting back once every 50 minutes.
A cascade of compromised tools
In one notable incident, the group infected the Trivy vulnerability scanner. That compromise spread to downstream packages, including KICS, the Telnyx Python SDK, and LiteLLM. Each was infected after its developers ran either a tainted version of Trivy or another package that had already been affected. The initial Trivy compromise led to the theft of terabytes of credentials and other private data.
Despite the sophistication of the campaign, security researchers noted that the group did not display the operational discipline typically associated with hackers operating at such a high level. Historically, attackers pulling off campaigns of this scale have had to invest substantial time researching techniques, tailoring and troubleshooting code, and building supporting infrastructure. Aikido Security researcher Charlie Eriksen said large language models have narrowed that barrier considerably, telling investigators that LLMs have “compressed that gap significantly.”
The campaign has vexed law enforcement and security personnel since it emerged, with attacks continuing across a nine-month span. Australian authorities say the two arrested men face a combined possible sentence exceeding 30 years across the 14 charges filed against them.
Source
Image: arstechnica.com
