Google's Undercover Operation Inside a Major Supply-Chain Hacking Group
How Google infiltrated and disrupted TeamPCP's unprecedented malware campaign
1Unprecedented supply-chain attacks
TeamPCP executed one of history's most extensive software supply-chain attacks, compromising hundreds of open-source programs. They infected tools like Trivy security scanner, LiteLLM API, and Mistral AI's platform, creating a cascading effect that ultimately breached GitHub, OpenAI, and European Commission systems. The group automated attacks using a self-spreading worm called Mini Shai-Hulud, named after Dune's sandworms.
2Google's undercover operation
Google's Threat Intelligence Group placed an undercover Mandiant analyst in TeamPCP's inner circle from nearly the group's inception. The operative gained access to CanisterWorm, the hackers' core chat of about 12 members, and monitored their server storing stolen credentials. This allowed Google to track the group's activities while maintaining operational security boundaries.
3Disruption strategy
When Google discovered TeamPCP's plan to extort victim companies using stolen credentials, they prioritized credential revocation over direct victim notifications. The team contacted major cloud providers like AWS and Microsoft to invalidate credentials, sending hundreds of alerts. This approach prevented wider exploitation given the scale of breaches affecting over 1,000 companies.
4AI-developed zero-day exploit
Through their infiltration, Google learned TeamPCP was using AI to create a zero-day exploit targeting login software. The exploit could bypass two-factor authentication. Google obtained the code, verified its effectiveness, and alerted the software developer to patch the vulnerability. This marked a rare confirmed case of AI-assisted exploit development in active cybercrime.
5Internal betrayals
TeamPCP's partnership with ShinyHunters cybercriminals backfired when the latter turned rogue, keeping extortion profits and leaking chat logs to Google. This caused TeamPCP to tighten inner circle access, inadvertently cutting off Google's mole. Despite this, the group's operational security failures left digital trails leading to members' identities.
6Operational security failures
Key mistakes led to TeamPCP members' identification. Ruben Thomson used personal email accounts ([email protected]) for both hacker forum activity and PayPal transactions. The group also backed up stolen data to a Google Drive linked to this email. These lapses provided the digital breadcrumbs that enabled law enforcement tracking.
7Law enforcement collaboration
Google shared intelligence with the FBI and Australian Federal Police, leading to the arrests of Thomson and Louis Gaebler in Australia. The AFP described them as 'principal participants' in TeamPCP. The arrests followed a joint investigation supported by Google's undercover operation and digital forensic work.
8Limited financial success
Despite compromising over 500,000 credentials, TeamPCP reportedly earned only tens of thousands in extortion payments—far less than comparable groups. Their attempt to monetize through partnerships with other cybercriminals failed when collaborators like ShinyHunters betrayed them, keeping profits from the stolen data.
9Google's proactive shift
This operation coincided with Google's creation of its Cyber Disruption Unit, marking a strategic shift from passive threat reporting to active intervention. The company now emphasizes disrupting cybercriminal operations in progress, rather than solely documenting them post-attack.
10New era of cyber defense
The TeamPCP case demonstrates how tech companies are adopting more aggressive counter-hacking measures. Google's successful infiltration and disruption of an active cybercrime campaign sets a precedent for private-sector involvement in combating sophisticated threat actors through unconventional means.
Original article: Wired — Google's Undercover Operation Inside a Major Supply-Chain Hacking Group