Australian police arrest two men accused of widespread open-source software hacking

Australian police announced charges on Thursday ​against two men accused of participating ​in a cybercrime syndicate that targeted ‌widely ​used open-source software to compromise thousands of global businesses. The Australian men face a combined 14 charges for their alleged roles in ‌TeamPCP, a hacking collective that inserted malicious code into popular tools to compromise businesses, according to a statement from the Australian Federal Police. Some of the businesses were later extorted, according ‌to a July FBI advisory. The police did not name the men, but the Australian ‌Broadcasting Corporation identified them as Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23.

Nick Scerri, a lawyer for Thomson, did not immediately respond to a request for comment outside of normal business hours. Reuters could not immediately ⁠find an ​attorney for Gaebler. The malicious ⁠code potentially compromised more than 1,000 organizations globally, enabling the theft of more than 500,000 credentials and more than ⁠300 gigabytes of data, according to police.

The police said they conducted a parallel investigation into the men ​with the FBI starting in April after receiving information from multiple unnamed cybersecurity ⁠threat assessment companies. “We are proud to work with the Australian Federal Police and the Western Australia Police Force to ⁠impose ​cost on criminal actors and combat the growing threat of software supply-chain attacks,” FBI Cyber Division Assistant Director Brett Leatherman said in the police statement.

The FBI declined further comment. Austin ⁠Larsen, a principal threat analyst with Google Threat Intelligence Group, called TeamPCP “one of the most ⁠impactful threat actors of ⁠2026” in a message posted to LinkedIn. Larsen described TeamPCP as a “peer community of individually skilled actors with one clear center of gravity,” ‌rather than ‌a single, unified group.