Affected Systems

Global software supply chain: hundreds of open-source packages on GitHub, NPM, and other repositories compromised since late 2023. Victims include 2,500+ organizations using LiteLLM AI gateway, 3,800+ GitHub repositories, and developers across major technology companies. No specific CVE assigned; attacks involve credential theft and malicious code injection into legitimate open-source tools.

Exploitation Status

Active exploitation confirmed. TeamPCP conducted ongoing supply chain attacks from late 2023 through 2025, using self-propagating Shai-Hulud worm. Source code for third iteration publicly released in May 2025. Group launched $1,000 contest incentivizing participants to conduct supply chain attacks, effectively crowdsourcing exploitation. Arrests may disrupt but not eliminate threat given decentralized nature and public tooling.

Business Impact

Organizations using compromised open-source packages face credential theft, cloud environment compromise, and data exfiltration. TeamPCP's cyclical attack model targets developer credentials to publish malicious versions of widely-used development tools, creating cascading supply chain risk. CloudSEK analysis confirms 2,500+ organizations had cloud service keys and secrets harvested via LiteLLM compromise alone. Threat extends beyond initial victims as stolen credentials enable further repository compromises. Arrests of two members unlikely to eliminate risk given group's decentralized structure and recruitment efforts.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Audit all open-source dependencies installed since Q4 2023, prioritizing packages from GitHub and NPM repositories; cross-reference against known TeamPCP indicators of compromise from CloudSEK and Dataminr reports
  • Rotate all cloud service credentials, API keys, and secrets for developers who may have used compromised packages, especially those working with AI/LLM tools like LiteLLM
  • Implement mandatory multi-factor authentication for all code repository accounts (GitHub, NPM, GitLab) and enable commit signing to prevent unauthorized package updates
  • Monitor for unauthorized modifications to internal code repositories and establish baseline integrity checks for critical open-source dependencies using software composition analysis tools
  • Review access logs for GitHub, NPM, and cloud environments (AWS, Azure, GCP) for anomalous credential usage between late 2023 and present, focusing on developer accounts with publishing privileges

---

# Threat Actor Context

Actor Profile

TeamPCP is a prolific cybercrime and data extortion collective responsible for the longest-running software supply chain attack campaign on record. Rather than a structured hierarchical organization, TeamPCP operates as a peer community of individually-skilled actors from multiple cybercrime gangs, coordinating through a Matrix chat server called "Cybercats" administered by George Prepakis (@kernelstub). The group's primary motivation is financial extortion, targeting software developers and technology companies globally. TeamPCP emerged in late 2025 and rapidly scaled operations through cyclical exploitation and recruitment tactics. The Australian Federal Police arrested two Western Australia-based suspects (aged 21 and 23) in connection with the group's activities, which allegedly involved creating malicious open-source software to extort thousands of global businesses.

TTPs (Tactics, Techniques, Procedures)

TeamPCP employs a sophisticated cyclical supply chain attack methodology: they compromise developer networks and inject malicious code into open-source tools hosted on repositories like GitHub and NPM (T1195.002 - Compromise Software Supply Chain). Initial access is achieved through credential phishing and theft targeting developers (T1566 - Phishing, T1078 - Valid Accounts). The group deploys a self-propagating worm called Shai-Hulud that spreads through compromised development tools, enabling lateral movement across developer ecosystems (T1080 - Taint Shared Content). Stolen credentials allow publication of malicious package versions, perpetuating the infection cycle. TeamPCP harvests cloud service keys, API tokens, and secrets from compromised environments (T1552.001 - Credentials In Files, T1552.004 - Private Keys). The group conducts data exfiltration (T1567 - Exfiltration Over Web Service) followed by extortion operations. Notable attacks include compromising LiteLLM AI gateway infrastructure and at least 3,800 GitHub repositories through a compromised code extension.

Targets & Patterns

TeamPCP primarily targets the software development and technology sectors, focusing on organizations that maintain or consume open-source software components. Victims include developers at public code repositories (GitHub, NPM), AI infrastructure providers (LiteLLM compromise affected 2,500+ organizations including major tech companies), and automotive manufacturers (BMW Group, Audi, Honda, Mercedes-Benz, Volvo, Toyota). The group strategically targets high-value, widely-used code libraries to maximize downstream impact—their recruitment contest explicitly scored participants based on weekly/monthly download counts of compromised packages. This targeting pattern reflects a calculated approach to scale: by compromising popular development tools, TeamPCP creates force-multiplier effects where a single compromise cascades across thousands of dependent organizations. The cyclical nature of their attacks means software developers are both victims and unwitting distribution vectors, enabling exponential growth of compromised networks. Geographic focus includes Australia (arrest location) with global victim distribution across technology sectors.

Historical Context

TeamPCP emerged onto the cybercrime scene in late 2025 and rapidly escalated operations throughout early 2025. Key milestones include: March 2025 supply chain attack on LiteLLM AI gateway (harvesting credentials from 2,500+ organizations); May 2025 compromise of 3,800+ GitHub repositories after infecting a GitHub developer's code extension; May 2025 release of Shai-Hulud worm version 3 source code and launch of a $1,000 XMR recruitment contest to crowdsource supply chain attacks. The group represents an evolution in supply chain attack methodology—moving from isolated incidents to sustained, automated campaigns. TeamPCP's collaboration model through the "Cybercats" Matrix server connects them to other cybercrime entities including Fulcrumsec (SeesawSec) and data breach broker Boxturtle (@xpl0itrsturtle), who has sold data from automotive and technology breaches. This represents a shift toward decentralized, collaborative cybercrime operations rather than traditional hierarchical APT structures. The arrests in Australia mark the first known law enforcement action against TeamPCP members.

Defensive Recommendations

  • Implement software composition analysis (SCA) and dependency scanning to detect malicious code in open-source packages before deployment; monitor for unexpected changes in package maintainers or sudden version updates
  • Enforce multi-factor authentication (MFA) with hardware tokens for all developer accounts accessing code repositories (GitHub, NPM, PyPI) to mitigate credential theft via phishing (T1566)
  • Deploy runtime application self-protection (RASP) and secrets management solutions to prevent hardcoded credentials in code; monitor for unauthorized access to cloud service keys and API tokens (T1552.001, T1552.004)
  • Establish code signing and verification processes for all published packages; implement repository security policies requiring signed commits and protected branches to detect supply chain tampering (T1195.002)
  • Monitor network traffic for connections to known malicious package repositories and C2 infrastructure; detect anomalous outbound data transfers from development environments (T1567)

---

# Geopolitical Context

Geopolitical Context

The arrests by Australian Federal Police represent a significant law enforcement action against a transnational cybercrime network that exploited open-source software ecosystems to compromise thousands of organizations globally. TeamPCP's operations—characterized by self-propagating malware (Shai-Hulud) targeting developer credentials and code repositories—illustrate the strategic vulnerability of software supply chains that underpin critical infrastructure and commercial systems worldwide. The group's cyclical exploitation model, which weaponized compromised developer tools to breach additional networks, demonstrates an evolution in cybercrime tradecraft that blurs the line between opportunistic fraud and systematic infrastructure compromise. The case highlights Australia's growing role in international cyber law enforcement and the challenges of policing decentralized, pseudonymous threat actor communities that operate across jurisdictions. The public identification of suspects and their communication infrastructure (the "Cybercats" Matrix server) suggests extensive intelligence collection and potential coordination with international partners, though the statement does not reference Five Eyes or other multilateral frameworks.

State Actor Alignment

Available information indicates TeamPCP operates as a financially motivated cybercrime syndicate without apparent state sponsorship. The group's modus operandi—extortion of commercial entities, recruitment via cryptocurrency-incentivized competitions, and sale of stolen data on underground forums—is consistent with profit-driven criminal activity rather than state-directed espionage or sabotage. However, the scale and sophistication of their supply chain attacks, particularly the compromise of AI infrastructure (LiteLLM) and major code repositories at GitHub, resulted in the harvesting of credentials and secrets from over 2,500 organizations, including leading technology firms. Such access could theoretically be of interest to state-sponsored actors seeking to acquire capabilities or intelligence, though no evidence of such transfer has been publicly disclosed. The arrests in Australia and the group's Western operational base suggest they were not operating under the protection of jurisdictions that typically harbor state-aligned cybercrime groups. The case underscores the challenge of distinguishing between purely criminal activity and operations that may inadvertently serve strategic intelligence collection functions.

Business Impacty pro region

The TeamPCP operation had global reach, with victims spanning multiple continents and sectors. The compromise of open-source software tools—widely used by developers in North America, Europe, and Asia—created systemic risk across the technology supply chain. Major automotive manufacturers in Europe (BMW, Audi, Mercedes-Benz, Volvo) and Asia (Honda, Toyota) were reportedly affected through associated threat actors in the Cybercats network, suggesting cascading impacts beyond the initial software development targets. For Europe, the incident reinforces concerns about supply chain integrity under the EU Cyber Resilience Act and NIS2 Directive frameworks, which mandate heightened security standards for software products and digital supply chains. The targeting of AI infrastructure (LiteLLM) and cloud service credentials has particular implications for the transatlantic technology sector, where reliance on open-source components is pervasive. Australia's successful arrests may encourage closer operational cooperation among Western law enforcement agencies, particularly within Five Eyes, to address transnational cybercrime networks that exploit the borderless nature of software development ecosystems. The case also highlights vulnerabilities in platforms like GitHub and NPM, which are critical infrastructure for global software development but remain attractive targets for credential theft and malicious code injection.

Forecast

If Australian authorities proceed with prosecution and secure convictions, the case may serve as a deterrent to other actors considering large-scale supply chain attacks, particularly if sentencing reflects the systemic nature of the harm caused. However, the decentralized structure of TeamPCP—described as a peer community rather than a hierarchical organization—suggests that the arrests of two members may not fully dismantle the network's operational capacity. If other members of the Cybercats ecosystem remain at large and continue operations, further supply chain compromises targeting open-source repositories are likely in the near term. The public disclosure of the group's recruitment tactics and communication infrastructure may prompt operational security improvements among remaining actors, making future attribution and interdiction more challenging. If international law enforcement agencies leverage intelligence from the arrests to pursue additional suspects in other jurisdictions, a broader coordinated takedown could materialize within the next six to twelve months. The incident is likely to accelerate industry and regulatory efforts to enhance security controls for code repositories, developer credential management, and open-source software vetting, particularly in sectors deemed critical infrastructure. If the contest model used by TeamPCP to recruit participants gains traction among other cybercrime groups, the threat landscape for supply chain attacks may become more diffuse and harder to counter through traditional law enforcement measures alone.