Australian authorities arrest two alleged TeamPCP hackers behind supply chain attacks

The Register and Krebs on Security report that Australian Federal Police have arrested two men, aged 21 and 23, believed to be members of TeamPCP, a cybercrime group responsible for one of the longest-running software supply chain attack campaigns on record. The group is alleged to have created malicious open-source software packages and libraries that were downloaded by thousands of organisations globally, allowing the attackers to steal credentials, exfiltrate data and maintain persistent access to victim networks. The arrests followed a joint investigation with the FBI and other international law enforcement agencies. TeamPCP's activity represents a significant supply chain threat because the group embedded malicious code in legitimate-looking software components that developers unknowingly incorporated into their applications.

Why this matters for UK organisations

Software supply chain attacks are difficult to detect and can affect organisations that have otherwise strong security controls. When developers download open-source libraries or dependencies from public repositories, they are often trusting that the code is safe. Groups like TeamPCP exploit this trust by publishing packages with names similar to legitimate libraries, by compromising existing packages, or by contributing malicious code to legitimate projects. Once the malicious code is included in an application, it can run with the same privileges as the application itself, often providing attackers with access to internal systems, databases and credentials. The operational challenge is that many organisations do not have visibility of the open-source components used in their software, making it difficult to identify and remove compromised dependencies. Supply chain attacks can persist for months or years before being detected, and remediation often requires identifying every application that uses the compromised component and rebuilding or patching it.

What to review

Organisations should review their software supply chain security practices, including how developers vet open-source libraries before incorporating them into applications. Consider whether you maintain a software bill of materials that documents all open-source components used in your software, and whether you have processes in place to respond when a compromised package is identified. Review whether your development teams are aware of supply chain risks and whether they follow secure coding practices, such as verifying package integrity, using trusted repositories, and avoiding packages with suspicious names or limited community support. Consider implementing tools to scan for known malicious packages and to monitor for new vulnerabilities in open-source dependencies. This is also a useful moment to review whether your incident response plan includes steps for handling supply chain compromises, including identifying affected applications, assessing the scope of the breach, and coordinating remediation across development and operations teams.

Source: The Register