TeamPCP Arrests: Two Charged in Australia Over the Supply Chain Campaign That Hit 1,000+ Organizations

On 26 August 2026, the Australian Federal Police charged two West Australian men over their alleged roles in a cybercrime syndicate that inserted malicious code into open-source software used by thousands of organizations worldwide. Both men appeared in Perth Magistrates Court the following day.

The investigation ran in parallel with the FBI and the Western Australia Police Force and began in April 2026, the month after the Trivy and LiteLLM supply chain compromises. The FBI’s statement connects the arrests explicitly to TeamPCP, the actor behind that campaign.

Key Takeaways

• Two West Australian men have been charged with a combined 14 offences following a joint AFP, Western Australia Police Force, and FBI investigation into a cybercrime syndicate that allegedly poisoned open-source software.
• The FBI named the group directly: Cyber Division Assistant Director Brett Leatherman identified the men as alleged members of TeamPCP, the actor behind the Trivy and LiteLLM supply chain compromises. SOCRadar tracks the same group as UNC6780, PCPcat, ShellForce, and DeadCatx3.
• Law enforcement figures: more than 1,000 organizations potentially compromised, over 500,000 credentials stolen, and at least 300 GB of data exfiltrated. Global remediation costs are estimated in the hundreds of millions of dollars.
• The two men, aged 21 and 23, are alleged principal participants who were paid in cryptocurrency. Charges include unauthorised modification of data, supplying data to commit a computer offence, and dealing with proceeds of crime.
• Arrests do not close the exposure: Credentials harvested in March 2026 were being brokered on Telegram within weeks and tied to a ransomware affiliate program. A copied secret stays usable until it is rotated.
• Further arrests have not been ruled out, and a large volume of seized data is still under forensic examination.
• If you have not completed credential rotation for the March 2026 exposure windows, that work is still outstanding regardless of these charges.

What the AFP Alleges

Police allege the two men were part of an organized syndicate involved in data intrusion, identity crime, and cryptocurrency-based money laundering. According to the AFP, the syndicate inserted malicious code into software hosted on an open-source repository, which other developers then used without knowing it was compromised.

Police allege that infected software was then distributed into systems across government, academia, and the private sector, giving the syndicate a path to harvest sensitive data including user credentials and authentication materials. The AFP estimates the malicious code potentially compromised more than 1,000 organizations globally, enabling the theft of more than 500,000 credentials and the exfiltration of at least 300 GB of data.

Search warrants were executed on 26 August at properties in Cottesloe, Hamilton Hill, and Mandurah. Electronic devices and other items were seized for forensic analysis. Police allege both men were principal participants and received cryptocurrency payments for their roles, with the value still under investigation.

Charges at a glance

The 3LA charge is worth noting. It relates to failing to comply with an order to assist in accessing data, and it carries a 10-year maximum, higher than any of the computer offences charged.

How This Connects to Trivy and LiteLLM

The AFP release does not name specific software products. It refers to the compromise of a small number of trusted software components. The link to the campaign SOCRadar has been tracking comes from the FBI, which stated that the men are allegedly members of the cybercriminal group TeamPCP and that their malicious code potentially compromised more than a thousand organizations worldwide.

TeamPCP is a financially motivated group that specializes in compromising open-source security tooling and AI middleware. Documented waves through 2026 span Trivy, Checkmarx KICS, LiteLLM, the Telnyx Python SDK, Bitwarden CLI, TanStack, and Mistral AI.

The chain that reached the widest set of victims ran through Trivy into LiteLLM. A privileged token taken from Trivy’s GitHub Actions workflows survived an incomplete rotation, and TeamPCP later used what remained to publish poisoned Trivy releases.

Those releases flowed into LiteLLM’s build pipeline, which produced two malicious PyPI packages that harvested cloud keys, SSH keys, Kubernetes tokens, database passwords, and AI provider credentials.

The ecosystem flaw is tracked as CVE-2026-33634 and was added to CISA’s Known Exploited Vulnerabilities catalog on 26 March 2026. Full technical detail is in SOCRadar’s LiteLLM supply chain attack analysis and the TeamPCP Dark Web Profile.

What the Arrests Do Not Change

Charges against two alleged participants do not retire the exposure. Three points stand.

• The credentials are already in circulation: SOCRadar’s Dark Web Monitoring observed a broker offering the campaign’s output on Telegram, bundling LiteLLM, Trivy, and CanisterWorm data at over 150 GB compressed. That collection does not disappear when a seller’s supplier is arrested.
• A ransomware affiliate program is attached: The campaign’s harvested credentials were tied to the Vect ransomware operation, with affiliate access distributed through BreachForums in April 2026. Buyers with panel access have their own incentive to use what they bought.
• The syndicate is larger than two people: The AFP has stated that a large volume of seized data remains under forensic examination and that further arrests and charges have not been ruled out.

The practical implication is unchanged from March. If any host or CI runner in your estate installed the affected packages during the exposure windows, every secret that process could reach should be treated as exposed until it has been rotated and validated.

What to Do Now

If you have already completed rotation for the March 2026 windows, no new action follows from these arrests. If you have not, or if you are unsure, work through the following.

• Confirm scope, including transitive installs: The affected package could arrive through frameworks such as DSPy, MLflow, CrewAI, OpenHands, and Arize Phoenix, so absence from a dependency list is not clearance. Read lockfiles and CI job logs from the exposure window.
• Rotate broadly: Any credential readable by an affected process should be rotated, including cloud, source-control, registry, Kubernetes, SaaS, database, and AI provider keys, plus anything reachable through the instance metadata service.
• Hunt for persistence: Search source control for repositories named tpcp-docs or docs-tpcp, and check hosts for the sysmon backdoor and its systemd unit.
• Close second-generation risk: If any package-publishing credential sat on an affected runner, treat your own downstream artifacts as suspect. Converting victims into vectors was the point of this campaign.
• Check for exposed credentials on the Dark Web: Version checks confirm what ran. They do not tell you what is already for sale.

The AFP also used the announcement to reinforce a point about reporting. Commander Graeme Marshall noted that information provided by threat assessment companies was crucial to investigators, and both the AFP and WAPF encouraged organizations to report cybercrime regardless of size. That intelligence flow is what turned a March software incident into August charges.

Conclusion

Charges against two alleged participants are a real result for the agencies involved, and they do not change the exposure position for any organization that ran the affected packages. The AFP has said the syndicate is larger than the two men charged, the harvested credentials are already circulating, and a ransomware affiliate program sits at the end of that chain. Credential rotation remains the work.

This campaign exploited two gaps that conventional tooling does not cover: what your suppliers and open-source dependencies are doing, and what has already left your estate.

• Supply Chain Intelligence: Monitor vendors, open-source dependencies, and technology providers for compromise, with alerting when a supplier in your ecosystem appears in a breach or extortion claim before the impact reaches your pipelines.
• Dark Web Monitoring: Detect leaked credentials, tokens, source code, and CI/CD artifacts tied to your organization and its suppliers, which is where harvested secrets from campaigns like this one surface for resale.

References

• Australian Federal Police, “Two WA men charged following AFP-FBI-WAPF disruption of alleged global cybercrime syndicate,” 27 August 2026.
• SOCRadar, “LiteLLM Supply Chain Attack: Inside the AI Breach That Exposed 2,500+ Companies.”
• SOCRadar, “Dark Web Profile: TeamPCP.”
• FBI, “Cyber Criminal Group TeamPCP,” FLASH-20260702-01, 2 July 2026.
• NVD, “CVE-2026-33634,” added to CISA KEV 26 March 2026.