Google Infiltrated TeamPCP Hacking Group During Supply Chain Attacks

TeamPCP's Hacking Spree

The hacker group TeamPCP conducted a hacking spree, tainting hundreds of open-source programs with malware and stealing developer accounts. The group also released a Dune-themed self-spreading worm, ultimately breaching over a thousand companies. Two alleged members of TeamPCP were arrested and charged in Australia last month.

Google's Undercover Operation

Google's threat intelligence group revealed that an undercover researcher infiltrated TeamPCP during its operations. This infiltration allowed Google to monitor the group's activities from the inside, warn potential breach targets, and disrupt exploitation attempts. The details of this operation were presented by Google Threat Intelligence Group researcher Austin Larsen at SentinelOne’s LABScon research conference.

Infiltration Details and Collaboration

According to Larsen, a Mandiant analyst, a Google security subsidiary, had been working for months to build trust and was added to TeamPCP's inner circle almost from the beginning. Google also followed operational security mistakes made by one of the alleged Australian members, passing identifying details to law enforcement. Additionally, Google received intelligence from ShinyHunters, another cybercriminal group that initially partnered with TeamPCP but later turned against them.