Affected Systems

Open-source tools: Trivy scanner, Checkmarx KICS, LiteLLM AI gateway. Attack spanned GitHub Actions, Docker Hub, npm, PyPI, OpenVSX ecosystems. Over 1,000 organizations potentially compromised, 500,000+ credentials stolen, 300GB+ data exfiltrated. GitLab (1,064 orgs), GitHub Actions (618), Azure DevOps (233), Jenkins (105), Bitbucket Pipelines (94), CircleCI (15) affected. Malicious LiteLLM versions still accessible via PyPI CDN as of August 2026.

Exploitation Status

Active exploitation confirmed. Attack occurred March 2026. TeamPCP infrastructure traced to 2020. Fresh npm campaign using same worm toolkit hit keyv and cacheable packages August 4, 2026. Worm framework open-sourced to GitHub May 12, 2026. FBI warns exfiltrated credentials remain persistent threat for long-term weaponization.

Business Impact

Credential theft from CI/CD pipelines creates persistent compromise risk across entire software supply chain. Attackers stole publishing credentials from trusted projects and pushed backdoored versions through legitimate release channels. Organizations that installed affected versions during exposure windows must assume all CI/CD secrets, publishing tokens, and cloud credentials were exfiltrated. LiteLLM compromise particularly severe as it consolidates LLM provider API keys. Stolen credentials likely being weaponized for follow-on attacks months after initial compromise. Two arrests in Australia, but threat infrastructure remains active with fresh campaigns detected August 2026.

Urgency

đź”´ Immediate

Recommended Actions

  • Immediately rotate all CI/CD secrets, publishing tokens, and cloud credentials that were accessible during March 2026 exposure window for Trivy, Checkmarx KICS, and LiteLLM
  • Search GitHub repositories for 'tpcp-docs' and 'docs-tpcp' repository names created by TeamPCP worm using stolen credentials
  • Pin all GitHub Actions workflows to verified commit SHA hashes instead of floating version tags to prevent similar supply chain attacks
  • Audit CI/CD pipeline logs from March 2026 onward for unauthorized access using exfiltrated credentials; treat all data from that period as compromised
  • Remove or verify integrity of Trivy, Checkmarx KICS, and LiteLLM installations from March-April 2026; check PyPI/npm/Docker Hub package hashes against known-good versions
  • Monitor for indicators of compromise tied to TA-NATALSTATUS and IronErn threat groups, which share infrastructure with TeamPCP dating to 2020

---

# Threat Actor Context

Actor Profile

TeamPCP is a cybercrime syndicate responsible for large-scale supply chain attacks targeting open-source software ecosystems. Two Western Australian men, Louis Michael Gaebler (23) and Ruben Ian Thomson (21), were charged by the Australian Federal Police in August 2026 with 14 combined offences related to their alleged roles as principal participants in the group. The actors are motivated by financial gain, having received payments in cryptocurrency. TeamPCP operated by stealing publishing credentials from trusted open-source projects and pushing poisoned versions through legitimate release channels, compromising organizations globally. The group's infrastructure has been traced back to 2020 and linked to activity previously tracked as TA-NATALSTATUS and IronErn.

TTPs (Tactics, Techniques, Procedures)

TeamPCP employed sophisticated supply chain compromise techniques spanning multiple ecosystems (GitHub Actions, Docker Hub, npm, PyPI, OpenVSX). Their primary TTP involved credential theft from CI/CD pipelines to gain publishing access to trusted open-source projects. The group used a cascading attack methodology where credentials stolen from one compromised project (Trivy) were weaponized against subsequent targets (Checkmarx KICS, then LiteLLM). They exploited dependency confusion by injecting malicious code into legitimate software build pipelines, specifically targeting projects that failed to pin dependencies to verified versions. The actors deployed custom worm frameworks (Mini Shai-Hulud) and created repositories named 'tpcp-docs' and 'docs-tpcp' using stolen credentials. Key techniques align with T1195.001 (Supply Chain Compromise: Compromise Software Dependencies and Development Tools), T1078 (Valid Accounts), T1552.001 (Unsecured Credentials: Credentials In Files), and T1567 (Exfiltration Over Web Service).

Targets & Patterns

TeamPCP primarily targeted the software development sector, with specific focus on security tools and AI/ML infrastructure. Victims included organizations using open-source security scanners (Trivy, Checkmarx KICS) and AI gateway solutions (LiteLLM). The March 2026 campaign potentially compromised over 1,000 organizations globally according to AFP, with exposure estimates ranging from 2,500 organizations (CloudSEK) affecting approximately 434,000 CI/CD pipelines. StepSecurity analysis identified GitLab as the most affected platform (1,064 organizations), followed by GitHub Actions (618), Azure DevOps (233), Jenkins (105), Bitbucket Pipelines (94), and CircleCI (15). The group specifically targeted LiteLLM due to its position as a consolidation point for LLM provider keys across organizations. The confirmed victim count stands at 16 organizations published on TeamPCP's leak site as of late March 2026. The targeting pattern demonstrates strategic selection of high-value supply chain nodes with broad downstream impact.

Historical Context

TeamPCP infrastructure has been traced back to 2020, with Oligo Security linking the group to activity previously tracked as TA-NATALSTATUS and IronErn through overlapping domains, malware deployment paths, staging techniques, and backend infrastructure. Whether this represents a rebrand, shared operator set, or close collaboration cannot be determined with certainty. The group open-sourced their worm framework used in the Mini Shai-Hulud campaign to GitHub on May 12, 2026. A subsequent npm wave using the same toolkit poisoned the keyv and cacheable packages on August 4, 2026, though self-identifying markers linking it definitively to TeamPCP were not recovered. The March 2026 supply chain attacks represent the group's most significant and publicly attributed operation to date, resulting in the theft of over 500,000 credentials and exfiltration of at least 300GB of data (per AFP), with some researchers reporting 118,829 CI runner dumps from a 153GB archive.

Defensive Recommendations

  • Pin all GitHub Actions workflows and dependencies to verified commit SHA hashes rather than floating version tags to prevent malicious version substitution (mitigates T1195.001)
  • Search organizational repositories for 'tpcp-docs' and 'docs-tpcp' repository names, which are known indicators of TeamPCP compromise activity
  • Rotate all CI/CD secrets, publishing tokens, and cloud credentials that were accessible during March 2026 exposure windows, treating exfiltrated credentials as persistent long-term risk
  • Implement monitoring for unauthorized modifications to package publishing workflows and alert on unexpected credential access patterns in build pipelines (detects T1552.001)
  • Enforce dependency verification and integrity checks in build systems, particularly for security tools and packages with broad organizational access like LiteLLM

---

# Geopolitical Context

Geopolitical Context

The Australian Federal Police's charges against two Western Australian nationals represent a significant law enforcement response to a transnational supply chain compromise that affected over 1,000 organizations globally. The March 2026 TeamPCP operation targeted critical open-source security infrastructure—Trivy, Checkmarx KICS, and LiteLLM—exploiting the trust model inherent in software supply chains. The campaign's sophistication, spanning five distribution ecosystems (GitHub Actions, Docker Hub, npm, PyPI, OpenVSX) and employing credential-chaining techniques, underscores the strategic vulnerability of open-source ecosystems to organized cybercrime. The FBI's direct involvement and public advisory signals U.S.-Australian law enforcement coordination on cyber threats with global reach. The alleged exfiltration of 500,000 credentials and 300GB of data, with potential exposure extending to 2,500 organizations and 434,000 CI/CD pipelines, positions this as one of the more consequential supply chain operations disclosed in recent years. The group's infrastructure, traced to 2020 and linked to prior activity tracked as TA-NATALSTATUS and IronErn, suggests sustained operational capability predating the March 2026 escalation.

State Actor Alignment

No state actor linkage is indicated in available reporting. The Australian Federal Police characterizes TeamPCP as a cybercrime syndicate motivated by financial gain, with alleged cryptocurrency payments to the charged individuals. The FBI Cyber Division's involvement appears consistent with transnational organized crime cooperation rather than state-sponsored activity. The group's open-sourcing of its worm framework on GitHub in May 2026 and continued operations through August 2026 npm campaigns align with cybercriminal tradecraft rather than intelligence collection or strategic disruption objectives typical of state actors. The absence of geopolitical targeting patterns or espionage indicators supports a criminal enterprise assessment.

Business Impacty pro region

The global scope of the compromise—affecting organizations across multiple continents through widely deployed open-source security tools—creates persistent risk for European, North American, and Asia-Pacific entities relying on affected packages. The FBI's July 2026 advisory warning that exfiltrated credentials represent "a persistent risk" and that "affiliated threat actors are likely to weaponize them long after the initial compromise" suggests secondary exploitation potential extending well beyond the initial March incident window. European organizations using Trivy, KICS, or LiteLLM during the exposure period face ongoing credential rotation and forensic review requirements. The compromise of LiteLLM, which routes requests across large language model providers and consolidates provider keys, carries particular implications for AI/ML development pipelines in technology sectors across advanced economies. The fact that poisoned PyPI packages remain accessible via content delivery network URLs five months post-removal highlights remediation challenges for distributed infrastructure. Five-Eyes intelligence sharing likely facilitated the Australian-U.S. investigative coordination, reinforcing the alliance's cyber cooperation framework.

Forecast

If Australian prosecutors secure convictions with substantial sentences, this case may establish deterrent precedent for supply chain attacks originating from Five-Eyes jurisdictions, though the decentralized nature of open-source ecosystems will continue to present structural vulnerabilities. If forensic analysis of seized devices reveals additional compromised projects or credential caches, a second wave of victim notifications and remediation activity is likely in Q4 2026. The group's demonstrated capability to chain credentials across projects suggests that organizations affected by the initial Trivy compromise should anticipate downstream exposure even if they did not directly consume poisoned packages. If the cryptocurrency payment trails under investigation connect to established money laundering networks or additional co-conspirators, further arrests in Australia or partner jurisdictions may follow. The open-sourcing of the worm framework and August 2026 npm activity using the same toolkit indicates that copycat operations or continued activity by unindicted TeamPCP members remains probable absent broader infrastructure disruption. Organizations that have not yet rotated CI/CD secrets, publishing tokens, and cloud credentials from the March-August 2026 window should treat this as an urgent priority, as secondary exploitation of the stolen credential corpus is likely to persist through 2027.