Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks

Two alleged members of the cybercrime group TeamPCP have been charged in Australia following a major law enforcement operation. The group is responsible for the March 2026 supply chain compromise of the open-source security scanners Trivy and Checkmarx KICS, as well as the AI gateway LiteLLM.

Technical Breakdown:

• TTPs: Supply chain compromise via malicious commits to open-source repositories. This is a classic Supply Chain Compromise (T1195) play, specifically targeting security tooling to gain trust and distribution.
• IOCs: None publicly disclosed at this time. Expect the AFP to release technical details post-trial.
• Affected Software: Trivy, Checkmarx KICS, LiteLLM.
• Charges: Louis Michael Gaebler (23) and Ruben Ian Thomson (21) face a combined 14 charges.

Defense: This is a stark reminder to verify the integrity of your CI/CD pipeline dependencies. Pin versions, use signed commits, and monitor for anomalous changes in upstream repositories. If you pulled these tools during the compromise window, you need to audit your build artifacts for backdoors.

Source: https://thehackernews.com/2026/08/alleged-teampcp-hackers-charged-in.html