The Australian Federal Police (AFP) have charged two men from Western Australia in connection with a supply chain attack campaign led by the hacking syndicate known as TeamPCP. Authorities allege the pair played central roles in a 2026 campaign that compromised Trivy, Checkmarx KICS, and LiteLLM. The charges were presented today, August 27, 2026, at the Perth Magistrates Court.
Who is accused and what they allegedly did
The suspects, a 21-year-old and a 23-year-old, were arrested after police conducted coordinated operations on August 26, executing search warrants in Cottesloe, Hamilton Hill, and Mandurah. The AFP, together with Western Australia Police, seized devices for forensic examination.
Officials say the younger suspect faces seven charges, including possession of data with intent to commit a computer offence, multiple counts of unauthorised and malicious data modification, supplying data with criminal intent, failing to comply with a compliance order, and handling proceeds of crime exceeding AU$100,000. The older individual has been charged with one count of possessing data with criminal intent, four counts of unauthorised data modification, and one count of supplying data with criminal intent.
Some of the crimes carry severe penalties, with sections of the Australian Criminal Code exposing the accused to up to 10 years in prison for non-compliance offences and up to 20 years for dealing in proceeds of crime.
Scope and methods of the attacks
The investigation links these attacks to a series of compromises beginning in late February 2026 and peaking in mid- to late-March. The campaign started with a malicious release of the open-source Trivy tool, where an unauthorized party used stolen credentials to inject malware into new versions of Trivy’s scanner and setup actions. Malicious images related to Trivy were also uploaded to Docker Hub.
Within weeks, the campaign expanded. Checkmarx KICS components were manipulated by force-pushing tags and injecting malicious versions; then LiteLLM’s build pipeline was exploited. Because the LiteLLM builds did not strictly pin tools like Trivy to specific versions, the attackers were able to introduce backdoored releases. One such version included a startup hook causing the payload to run during Python interpreter startup, even if LiteLLM was not imported.
Organizations suffered substantial fallout. Quantities in question include more than 1,000 global entities, over 300 gigabytes of exfiltrated data, and upwards of half a million stolen credentials. One dataset analysis reconstructed exposure of more than 2,500 organizations, almost 434,000 CI/CD pipelines, and over 150 gigabytes of attacker-collected data — though the number of actual confirmed victims remains in the dozens. Platforms impacted included GitLab, GitHub Actions, Azure DevOps, Jenkins, Bitbucket Pipelines, and CircleCI.
Implications and defenses
The campaign exploited gaps in software supply chain security, especially floating version tags and insecure credentials. Experts warn that even after initial fixes, residual risk lingered because of credential exposure windows that weren’t fully addressed. Governments and security firms classify this attack among the more significant recent supply chain exploits.
Guidance from law enforcement and cybersecurity agencies includes rotating exposed credentials, enforcing strict version control or pinned commit SHAs over floating tags, and searching for certain repository signatures tied to TeamPCP’s tools.
This case implicates actors in acts of global scale, highlighting how open-source dependencies can become vectors for widespread compromise. The two accused, Louis Michael Gaebler (23) and Ruben Ian Thomson (21), stand charged with actions central to the TeamPCP operations, though none of the 14 charges name a specific project.
What this means: Supply chain attacks are no longer rare high-profile events. The techniques used — from credential theft to version tag manipulation — are weapons in the modern cybercriminal toolkit, and the scale here demonstrates how deeply integrated CI/CD pipelines and open-source ecosystems are in global infrastructure. Moving forward, defenders must assume every dependency is a potential threat, enforce strict version control, rotate secrets habitually, and monitor for any signs of backdoor or anomaly. What comes next will be a reckoning for supply chain assurance — not just patching flaws, but redesigning trust models and accountability.
