Australian police arrest two men accused of widespread open-source software hacking

Australian police ‌announced ​charges on Thursday against two men accused of participating in a cybercrime syndicate that targeted widely used open-source software to compromise thousands of global businesses. The Australian ‌men face a combined 14 charges for their alleged roles in TeamPCP, a hacking collective that inserted malicious code into popular tools to compromise businesses, according to a statement from the Australian Federal Police. Some of the businesses ‌were later extorted, according to a July FBI advisory. The police did not name the men, but the ‌Australian Broadcasting Corporation identified them as Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23. Nick Scerri, a lawyer for Thomson, referred questions to another attorney, Paul Homes, who declined to comment. James Gatti, an attorney for Gaebler, declined to comment. The malicious code potentially ⁠compromised more ​than 1,000 organizations globally, enabling ⁠the theft of more than 500,000 credentials and more than 300 gigabytes of data, according to police.

The police said they conducted a ⁠parallel investigation into the men with the FBI starting in April after receiving information from multiple unnamed cybersecurity threat assessment companies. “We ​are proud to work with the Australian Federal Police and the Western Australia Police Force to ⁠impose cost on criminal actors and combat the growing threat of software supply-chain attacks,” FBI Cyber Division Assistant Director Brett Leatherman said in the ⁠police ​statement. The FBI declined further comment. Late Thursday, the U.S. Attorney's Office for the Northern District of California, announced a U.S. indictment against Thomson on charges of conspiracy to commit Computer Fraud and Abuse Act ⁠violations and obtaining information from a protected computer. Austin Larsen, a principal threat analyst with Google Threat Intelligence Group, called ⁠TeamPCP “one of the most ⁠impactful threat actors of 2026” in a message posted to LinkedIn. Larsen described TeamPCP as a “peer community of individually skilled actors with one clear center of gravity,” rather ‌than a ‌single, unified group.