Overview
- Police arrested and charged Louis Michael Gaebler, 23, and Ruben Ian Thomson, 21, with a combined 14 offences after raids on Wednesday that led to their Perth court appearances.
- Officers executed search warrants at properties in Cottesloe, Hamilton Hill and Mandurah and seized electronic devices that are now being forensically examined for evidence.
- Investigators allege the defendants stole publishing and CI/CD credentials and used them to push backdoored releases through legitimate projects and automation pipelines such as GitHub Actions, npm, PyPI and Docker Hub.
- Authorities and security firms say the campaign potentially hit more than 1,000 organisations, exfiltrated at least 300GB of data, and enabled theft of over 500,000 credentials with global remediation costs in the hundreds of millions.
- Police say the suspects received cryptocurrency payments and that further arrests or charges are possible as forensics quantifies proceeds and the FBI has urged victims to rotate CI/CD secrets and pin workflows to verified commits.