Overview
- Police arrested and charged Louis Michael Gaebler and Ruben Ian Thomson after raids in Perth on Wednesday, and they appeared in Perth Magistrates Court on Thursday facing a combined 14 offences.
- Authorities say the pair are alleged principal participants in TeamPCP, a group that inserted malicious code into trusted open‑source tools to reach downstream developer pipelines.
- Investigators allege the campaign stole more than 500,000 credentials, exfiltrated at least 300 gigabytes of data from over 1,000 organisations, and has produced remediation costs in the hundreds of millions of dollars.
- The attackers reportedly stole publishing and CI credentials, pushed poisoned releases to registries and used self‑replicating worms (including Mini Shai‑Hulud variants) to harvest and move secrets automatically.
- Law enforcement has seized devices and large data sets for forensic analysis, is tracing cryptocurrency payments, and says further arrests or international legal action remain possible as the probe continues.