Full Report
Alleged crew behind the Shai-Hulud worm and other supply chain attacks nabbed with help from the FBI
Analysis Summary
# Incident Report: Operations Against TeamPCP (Shai-Hulud Worm)
## Executive Summary
The Australian Federal Police (AFP), in collaboration with the FBI, dismantled the leadership of "TeamPCP," a cybercrime syndicate responsible for large-scale supply chain attacks. The group utilized malicious code injection into open-source repositories, most notably via the "Shai-Hulud" worm, to compromise over 1,000 organizations. The operation resulted in the arrest of two primary suspects in Perth, Australia, following a multi-month international investigation.
## Incident Details
- **Discovery Date:** April 2026 (Investigation formalization)
- **Incident Date:** Active through August 2026 (Earliest specific activity noted March 2026)
- **Affected Organization:** 1,000+ organizations globally; Open-source repositories (npm, Trivy)
- **Sector:** Technology / Software Development (Supply Chain)
- **Geography:** Global impact; Suspects based in Perth, Western Australia
## Timeline of Events
### Initial Access
- **Date/Time:** March 2026 (Earliest detected activity)
- **Vector:** Supply Chain Compromise / Open-source Repository Poisoning
- **Details:** Attackers inserted malicious code into software available on open-source repositories, including the Trivy scanner and various npm packages.
### Lateral Movement
- The **Shai-Hulud worm** was designed to replicate across environments. Upon successful execution within a developer's environment or CI/CD pipeline, it sought further credentials to spread or deepen access.
### Data Exfiltration/Impact
- **Credential Theft:** 500,000+ credentials stolen.
- **Data Theft:** At least 300 gigabytes of data exfiltrated.
- **Destructive Action:** The worm was programmed to wipe environments if specific conditions were met (spite-driven destruction).
### Detection & Response
- **Detection:** Cyber threat assessment companies flagged malicious code in open-source repositories.
- **Investigation:** Launched in April 2026 by AFP and FBI.
- **Response Actions:** Law enforcement coordinated raids on August 26, 2026, arresting Ruben Thomson and Louis Michael Gaebler. Electronic devices were seized for forensic analysis.
## Attack Methodology
- **Initial Access:** Poisoning open-source packages (npm) and tools (Trivy).
- **Persistence:** Worm-based replication within infected cloud environments.
- **Privilege Escalation:** Not explicitly detailed, but targeted high-value credentials.
- **Defense Evasion:** Use of legitimate open-source distribution channels to bypass perimeter security.
- **Credential Access:** Targeting credentials for major public clouds and GitHub.
- **Discovery:** Automated scanning for cloud environment configurations.
- **Lateral Movement:** Worm-like propagation across connected services and repositories.
- **Collection:** Gathering sensitive environment data and identity tokens.
- **Exfiltration:** Transfer of data to attacker-controlled infrastructure.
- **Impact:** Mass data theft and environmental "wiping" (destruction).
## Impact Assessment
- **Financial:** Global remediation costs estimated in the hundreds of millions of dollars.
- **Data Breach:** 300GB of data; 500,000+ credentials.
- **Operational:** Potential total loss of data for environments hit by the "wipe" function.
- **Reputational:** Significant erosion of trust in widely used open-source libraries.
## Indicators of Compromise
- **Network indicators:** Connections to unauthorized cryptocurrency payment endpoints (used for syndicate payouts).
- **File indicators:** Malicious code injections within `npm` packages and `Trivy` scanner binaries.
- **Behavioral indicators:** Automated attempts to access cloud metadata services or GitHub tokens from development environments; unexpected "wipe" commands or mass file deletions.
## Response Actions
- **Containment:** Removal of malicious packages from public repositories (npm/GitHub).
- **Eradication:** Law enforcement seizure of infrastructure and arrest of core syndicate members.
- **Recovery:** Ongoing forensic examination of seized data to identify all victims and facilitate remediation.
## Lessons Learned
- **Supply Chain Vulnerability:** The reliance on unvetted open-source components remains a critical failure point for global software security.
- **Worm Capabilities:** Modern worms targeting cloud credentials can scale far faster than traditional manual intrusions.
- **Global Cooperation:** The speed of the arrest highlights the necessity of international FBI/AFP cooperation in tracking cryptocurrency-funded actors.
## Recommendations
- **Software Composition Analysis (SCA):** Implement strict SCA tools to scan dependencies for known malicious patterns or unauthorized changes.
- **Pinning Dependencies:** Use lockfiles and hash verification for all third-party libraries to prevent automatic updates to "poisoned" versions.
- **Least Privilege:** Limit the scope of API keys and GitHub tokens stored in development and CI/CD environments to prevent worm propagation.
- **Air-gapped Builds:** Where possible, use isolated environments for software builds to prevent data exfiltration during the compilation process.