Google's threat intelligence team has disclosed that one of its undercover analysts spent months inside TeamPCP, the hacker group behind a sprawling software supply-chain campaign, watching the operation from within and helping to disrupt it.

Speaking at SentinelOne's LABScon conference, Google Threat Intelligence Group researcher Austin Larsen said a Mandiant persona built trust with an actor invited into TeamPCP and was added to the group almost from the start, gaining access to an inner chat the group called CanisterWorm.

TeamPCP compromised open-source tools including Trivy, LiteLLM, TanStack and infrastructure at Checkmarx and Mistral AI, then used stolen developer credentials to breach GitHub, Mercor, OpenAI employee devices and the European Commission. It deployed a Dune-themed worm, Mini Shai-Hulud, to automate the attacks.

From inside, Google saw a server holding stolen credentials and moved to warn providers such as Amazon Web Services and Microsoft so the credentials could be revoked, sending hundreds of notifications. The analyst was later removed from the chat after TeamPCP grew suspicious amid a falling-out with partner group ShinyHunters.

Larsen said separate detective work, including a Gmail address linked to a chat handle and a Google Drive backup, led Google to pass identifying details to the FBI. Australian police later arrested two men, Ruben Ian Thomson and Louis Michael Gaebler, described by the Australian Federal Police as principal participants in TeamPCP.

Larsen said the undercover analyst never took part in hacking or encouraged breaches, and described the operation as part of Google's push toward disrupting cybercrime rather than only reporting on it.

Source: Wired