Two Alleged ‘TeamPCP’ Hackers Arrested in Australia
Two Alleged 'TeamPCP' Hackers Arrested in Australia. In a statement released today, the Australian Federal Police (AFP) said two unnamed suspects from Western Australia, aged 21 and 23, were arrested in connection with a "sophisticated cybercrime syndicat.
What happened
The Australian Federal Police (AFP) has charged two Western Australian men with a combined total of 14 offences over their alleged role in TeamPCP, the cybercrime group behind the March 2026 compromise of the open-source security scanners Trivy and Checkmarx KICS and the AI gateway LiteLLM. Two Alleged 'TeamPCP' Hackers Arrested in Australia. In a statement released today, the Australian Federal Police (AFP) said two unnamed suspects from Western Australia, aged 21 and 23, were arrested in connection with a "sophisticated cybercrime syndicat.
Authorities in Australia have arrested two men believed to be members of TeamPCP, a prolific cybercrime and data extortion group blamed for perpetrating the longest running spree of software supply chain attacks ever. Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks. Louis Michael Gaebler, 23, and Ruben Ian Thomson, 21, appeared in Perth Magistrates Court on August 27,.
Editorial note: this News Brief follows the available evidence and adds length only when additional facts or useful context are available. Where public reporting does not establish a specific victim sequence, CyberDeltaForce does not present one as fact.
What the reporting and advisory establish
Authorities in Australia have arrested two men believed to be members of TeamPCP, a prolific cybercrime and data extortion group blamed for perpetrating the longest running spree of software supply chain attacks ever.
The Australian Federal Police (AFP) has charged two Western Australian men with a combined total of 14 offences over their alleged role in TeamPCP, the cybercrime group behind the March 2026 compromise of the open-source security scanners Trivy and Checkmarx KICS and the AI gateway LiteLLM.
Louis Michael Gaebler, 23, and Ruben Ian Thomson, 21, appeared in Perth Magistrates Court on August 27,
Two Alleged ‘TeamPCP’ Hackers Arrested in Australia
Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks
What this means for your environment
Move from the published facts to the technical path, exposure conditions and defensive decisions that matter in a real environment.
Attack & Exploitation Path
The sequence below reconstructs the intrusion from the stages supported by public reporting. Undisclosed transitions remain explicitly marked rather than inferred.
a software, supplier, dependency or update relationship is part of the access path.
ransomware, encryption or extortion is part of the incident.
Why this matters to you
This is relevant beyond the organizations named in the headline because a compromised software supply chain can transfer risk to every downstream team that trusted the affected component. The key question is whether Trivy, Checkmarx KICS, LiteLLM entered your build, scanning or deployment path and what privileges it could reach there.
Does this deserve attention in my environment?
Check the conditions below against your use of Trivy, Checkmarx KICS, LiteLLM.
Select the conditions that are true in your environment. Leaving a condition unselected does not mean you are safe — it only means you have not marked it as applicable.
- Identify where Trivy, Checkmarx KICS, LiteLLM appears in developer workstations, CI/CD pipelines, containers and automation.
- Verify package, image and release provenance against trusted vendor or project guidance; do not rely only on a package name or latest tag.
- Review CI/CD, registry, source-control and cloud logs for unusual access or secret use associated with affected build paths.
- Rotate exposed build or deployment credentials if your investigation finds a compromised artifact or unauthorized use.
Sources & References
Original reporting and technical references are kept here for readers who want to verify the facts. Publisher names stay out of the reading flow above.