Affected Systems

Open-source tools Trivy (security scanner), Checkmarx KICS (security scanner), and LiteLLM (AI gateway) compromised in March 2026. Attack spanned GitHub Actions, Docker Hub, npm, PyPI, and OpenVSX ecosystems. Over 1,000 organizations potentially affected, with 500,000+ credentials stolen and 300GB+ data exfiltrated. GitLab (1,064 orgs), GitHub Actions (618 orgs), Azure DevOps (233 orgs), Jenkins (105 orgs), Bitbucket Pipelines (94 orgs), and CircleCI (15 orgs) platforms impacted.

Exploitation Status

Active exploitation occurred in March 2026. Two alleged TeamPCP operators arrested August 2026 by Australian Federal Police. Worm framework open-sourced by attackers in May 2026, with fresh npm attacks using same toolkit in August 2026 (keyv and cacheable packages). FBI warns exfiltrated credentials remain persistent threat for long-term weaponization. Malicious LiteLLM packages still accessible via PyPI CDN as of August 2026 despite index removal.

Business Impact

Credential theft from CI/CD pipelines creates persistent access risk across affected organizations. Stolen publishing tokens enabled attackers to push backdoored releases through legitimate distribution channels. LiteLLM compromise particularly severe as it consolidates LLM provider API keys. Organizations that installed affected versions during March 2026 exposure window must assume credential compromise. Attackers demonstrated capability to chain compromises: Trivy credentials used against KICS, which then compromised LiteLLM. TeamPCP infrastructure traced to 2020, indicating mature threat actor. 16 organizations confirmed published on TeamPCP leak site as of late March 2026.

Urgency

đź”´ Immediate

Recommended Actions

  • Immediately rotate all CI/CD secrets, publishing tokens, and cloud credentials for systems that used Trivy, Checkmarx KICS, or LiteLLM during March 2026 exposure window
  • Search GitHub repositories for 'tpcp-docs' and 'docs-tpcp' repository names created by TeamPCP worm using stolen credentials
  • Pin all GitHub Actions workflows to verified commit SHA hashes instead of floating version tags to prevent similar supply chain attacks
  • Audit PyPI, npm, Docker Hub, and OpenVSX package installations from March-August 2026 for Trivy, KICS, LiteLLM, keyv, and cacheable packages; verify against known-good checksums
  • Review CI/CD pipeline logs from March 2026 onward for unauthorized credential access, unexpected package installations without version pinning, or data exfiltration to unknown destinations
  • For LiteLLM users: rotate all LLM provider API keys (OpenAI, Anthropic, etc.) that were accessible to compromised instances

---

# Threat Actor Context

Actor Profile

TeamPCP is a cybercrime syndicate attributed to sophisticated supply chain attacks targeting open-source software ecosystems. In August 2026, the Australian Federal Police charged two Western Australian men—Louis Michael Gaebler (23, Mandurah) and Ruben Ian Thomson (21, Cottesloe)—with 14 combined offenses related to their alleged roles as principal participants in the group. The actors are motivated by financial gain, having received cryptocurrency payments of undetermined value. TeamPCP operated by stealing publishing credentials from trusted open-source projects and pushing backdoored versions through legitimate release channels, enabling credential harvesting and data exfiltration at scale. The FBI assessed that the group's malicious code potentially compromised over 1,000 organizations worldwide.

TTPs (Tactics, Techniques, Procedures)

TeamPCP employed a cascading supply chain compromise methodology across five distribution ecosystems (GitHub Actions, Docker Hub, npm, PyPI, OpenVSX). The group stole publishing credentials from one trusted open-source project and used those credentials to compromise subsequent targets. Key techniques include: credential theft from CI/CD pipelines (credentials from Trivy scanner compromise were reused against Checkmarx KICS); malicious code injection into open-source security tools (Trivy, Checkmarx KICS) and AI gateway software (LiteLLM); exploitation of unpinned dependencies in build pipelines (LiteLLM installed Trivy without version pinning); and deployment of self-propagating worm frameworks (Mini Shai-Hulud campaign, open-sourced May 2026). The actor created repositories named 'tpcp-docs' and 'docs-tpcp' using stolen credentials. Estimated impact includes theft of 500,000+ credentials and exfiltration of at least 300GB of data across 2,500+ organizations and 434,000 CI/CD pipelines.

Targets & Patterns

TeamPCP targeted the software development supply chain, focusing on widely-adopted open-source security tools and AI/ML infrastructure. Primary victims included security scanning tools (Trivy, Checkmarx KICS) and the LiteLLM AI gateway, which routes requests across large language model providers and consolidates organizational API keys. The targeting strategy exploited the trust relationships inherent in open-source ecosystems and the cascading dependencies between projects. Affected platforms included GitLab (1,064 organizations), GitHub Actions (618), Azure DevOps (233), Jenkins (105), Bitbucket Pipelines (94), and CircleCI (15). The group published 16 confirmed victims on its leak site as of late March 2026. The selection of security tools and AI gateways as initial vectors demonstrates sophisticated understanding of high-value targets where credentials and sensitive data aggregate, enabling lateral movement to downstream victims.

Historical Context

TeamPCP-linked infrastructure has been traced back to 2020, with Oligo Security tying the group to activity previously tracked as TA-NATALSTATUS and IronErn through overlapping domains, malware deployment paths, staging techniques, and backend infrastructure. Whether this continuity reflects a rebrand, shared operator set, or close collaboration cannot be determined with certainty. The group open-sourced its worm framework used in the Mini Shai-Hulud campaign to GitHub on May 12, 2026. A subsequent npm wave using the same toolkit poisoned the keyv and cacheable packages on August 4, 2026, though self-identifying markers linking this sample to TeamPCP were not recovered. The March 2026 campaign represents the group's most significant and publicly documented operation, prompting FBI advisories in July 2026 and culminating in the August 2026 arrests in Western Australia.

Defensive Recommendations

  • Pin all GitHub Actions workflows and dependency versions to verified commit SHA hashes rather than floating version tags to prevent consumption of compromised releases
  • Search organizational repositories for 'tpcp-docs' and 'docs-tpcp' repository names, which the TeamPCP worm creates using stolen credentials
  • Rotate all CI/CD secrets, publishing tokens, and cloud credentials that were accessible during the March 2026 exposure window, treating exfiltrated credentials as persistent long-term risk
  • Implement supply chain security controls including software bill of materials (SBOM) generation, dependency verification, and monitoring for unexpected changes to trusted packages in PyPI, npm, Docker Hub, and GitHub Actions
  • Monitor CI/CD pipeline logs for unauthorized credential access, unexpected repository creation, and anomalous publishing activity to detect credential theft and malicious code injection

---

# Geopolitical Context

Geopolitical Context

The August 2026 charges against two Western Australian nationals represent a significant law enforcement milestone in addressing transnational supply chain attacks targeting open-source software ecosystems. The Australian Federal Police action, conducted with FBI collaboration, demonstrates growing coordination between Five Eyes partners in prosecuting cybercrime that exploits the trust architecture of global software development. The TeamPCP operation—which compromised security tools Trivy and Checkmarx KICS, as well as the AI gateway LiteLLM—illustrates the systemic vulnerability of open-source supply chains that underpin critical infrastructure and enterprise operations worldwide. The group's methodology of credential theft and lateral movement across GitHub Actions, Docker Hub, npm, PyPI, and OpenVSX ecosystems enabled access to over 500,000 credentials and potentially affected more than 1,000 organizations globally. The charges carry penalties up to 20 years imprisonment, signaling Australia's commitment to deterring sophisticated cybercrime operations that leverage its jurisdiction.

State Actor Alignment

The available evidence indicates TeamPCP operated as a financially motivated cybercrime syndicate rather than a state-sponsored threat actor. The AFP alleges the two charged individuals received cryptocurrency payments, and one faces proceeds-of-crime charges exceeding AUD $100,000. The FBI's involvement and joint advisory issuance reflects standard Five Eyes law enforcement cooperation on transnational cybercrime rather than counterintelligence operations typical of state-sponsored activity. Oligo Security's research linking TeamPCP infrastructure to activity dating to 2020 and previously tracked groups TA-NATALSTATUS and IronErn suggests an established criminal enterprise with evolving tactics. The group's open-sourcing of its worm framework on GitHub in May 2026 and subsequent August 2026 npm campaign using the same toolkit indicates a profit-driven model focused on credential monetization rather than strategic intelligence collection. No sanctions designations or state attribution have been publicly announced by Australian, US, or allied governments.

Business Impacty pro region

The TeamPCP prosecution carries significant implications for the global open-source software ecosystem and regional cybersecurity posture. For Europe, the compromise of widely deployed security scanning tools like Trivy and Checkmarx KICS—used extensively in CI/CD pipelines across EU member states—represents a persistent threat to digital sovereignty initiatives and supply chain integrity. The exfiltration of credentials from over 2,500 organizations (per CloudSEK analysis) spanning multiple continents creates ongoing counterintelligence risks as threat actors may weaponize stolen credentials long after initial compromise, as the FBI advisory emphasized. The targeting of LiteLLM, which routes requests across large language model providers and consolidates organizational API keys, highlights emerging attack surfaces in the rapidly expanding AI infrastructure sector—a domain where European regulatory frameworks under the AI Act are still maturing. The successful prosecution in Australia may encourage similar enforcement actions in European jurisdictions where victims were located, potentially strengthening Europol and national cyber units' capabilities to pursue cross-border supply chain attack cases. The incident underscores vulnerabilities in the open-source trust model that European critical infrastructure and defense sectors increasingly rely upon.

Forecast

If the Australian prosecution proceeds successfully and results in convictions with substantial sentences, it may establish a deterrent precedent for financially motivated supply chain attacks originating from or transiting Five Eyes jurisdictions, though the effectiveness will depend on broader international enforcement coordination. Should forensic analysis of seized devices reveal additional compromised projects or victim organizations, a second wave of notifications and remediation efforts is likely in Q4 2026, potentially affecting European enterprises that have not yet rotated credentials from the March exposure window. If TeamPCP-affiliated actors remain at large internationally—as suggested by the group's continued August 2026 npm campaign using the same worm toolkit—organizations should anticipate persistent exploitation attempts using previously exfiltrated credentials through at least mid-2027. European regulatory bodies may accelerate supply chain security requirements under NIS2 and the Cyber Resilience Act in response to demonstrated risks, potentially mandating cryptographic signing and provenance verification for open-source components in critical sectors by 2027. If the Oligo Security assessment linking TeamPCP to 2020-era activity proves accurate, the prosecution may disrupt but not eliminate a mature criminal infrastructure, suggesting affiliated threat actors could rebrand and resume operations using refined techniques within 6-12 months.