An Undercover Google Analyst Infiltrated a Notorious Supply-Chain Hacking Gang

The revelation, detailed by Google Threat Intelligence researcher Austin Larsen at the SentinelOne LABScon conference, marks a paradigm shift in how major tech conglomerates handle cyber-adversaries. Rather than merely documenting threats, Google’s Mandiant division opted for a proactive, intelligence-led disruption strategy, embedding an undercover analyst within the inner circle of the group almost from its inception.

The Rise and Reach of TeamPCP

TeamPCP emerged in late 2025 as a highly sophisticated threat actor focused on the software supply chain—a vulnerability-prone ecosystem where developers share open-source code. By compromising widely used tools, the group achieved a "cascading" effect: infecting a single repository allowed them to harvest credentials from developers, which in turn granted them access to more secure, enterprise-level infrastructure.

Their target list included critical industry staples such as the security scanner Trivy, the AI application tool LiteLLM, the web application library TanStack, and the infrastructure of Checkmarx. By spring 2026, the group had scaled its operations significantly, infiltrating the code repositories of GitHub and gaining a foothold in the systems of high-profile entities, including OpenAI and the European Commission. The deployment of the "Mini Shai-Hulud" worm—an automated piece of malware designed to exploit software vulnerabilities at scale—demonstrated a level of ambition rarely seen in independent cybercriminal collectives.

A Masterclass in Infiltration: The CanisterWorm Operation

The success of Google’s intervention rested on a single, high-stakes gambit: placing an undercover analyst inside the hackers’ inner sanctum. In March 2026, just as the group’s activity was peaking, a Google-controlled persona successfully built trust with a TeamPCP member. This led to an invitation into "CanisterWorm," a restricted chat server housing approximately 12 core members.

For the duration of the campaign, the analyst functioned as a "fly on the wall," observing the hackers’ decision-making processes, their software development cycles, and their exploitation strategies. This proximity provided Google with real-time visibility into the hackers’ stolen credential database, which contained sensitive information on over half a million users.

According to Michael Fletcher, a former Australian Federal Police (AFP) analyst who collaborated with Larsen, the depth of the infiltration was staggering. "I thought, damn, you all have been inside this early," Fletcher noted, recalling the caution Larsen urged when discussing the group’s activities. The ability to monitor the hackers meant that instead of waiting for a public breach, Google could proactively notify service providers like Microsoft and Amazon Web Services to revoke stolen tokens, effectively neutralizing the group’s leverage before it could be monetized.

The Turning Point: Betrayals and Sloppy Security

While the infiltration provided a strategic advantage, the eventual downfall of TeamPCP was accelerated by infighting and poor operational security (OpSec). The group struggled to turn their massive cache of data into significant profit, reportedly earning only tens of thousands of dollars despite their vast reach. This financial desperation led them to partner with other criminal entities, most notably the prolific hacker group ShinyHunters.

The partnership proved fatal. ShinyHunters, notorious for the massive 2026 breach of the education platform Canvas, soon turned on their associates. In April 2026, ShinyHunters began using TeamPCP’s stolen credentials for their own extortion campaigns without sharing the proceeds. In a bizarre turn of events, ShinyHunters even forwarded their own logs of the TeamPCP chats to Google, unaware that the tech giant was already monitoring the server from the inside.

This betrayal caused panic within TeamPCP. The group attempted to purge their ranks, moving data to new servers and exiling members—including the Google mole. However, the damage was already done. The hackers had left a long trail of breadcrumbs, most notably through the use of personal identifiers in their registrations. Austin Larsen identified that a lead hacker, utilizing the handle "sheepstealing," had tied his activities to a Gmail account used in a 2019 dispute over pirated software. The most egregious error, however, was the group’s decision to back up their stolen data to a Google Drive account linked to the same identity.

Law Enforcement and the Arrest of the "Principals"

The culmination of this intelligence-gathering occurred in August 2026. Armed with a warrant and the detailed evidence provided by Google’s investigation, the Australian Federal Police, working in conjunction with the FBI, executed a coordinated raid. Ruben Ian Thomson and Louis Michael Gaebler, both in their early twenties, were arrested in suburban Australia and charged with multiple counts of unauthorized access and data theft.

The public release of a video showing the arrest of one suspect, dressed in a North Face hoodie, underscored the stark reality of modern cybercrime: the most disruptive attacks are often carried out by individuals working from domestic environments, far removed from the stereotypical imagery of state-sponsored data centers.

Broader Implications for Cybersecurity

The TeamPCP case serves as a landmark study for the "Cyber Disruption Unit" at Google. It signals a departure from the reactive "defend and report" model toward an aggressive posture where tech companies act as active gatekeepers in the digital landscape. By integrating threat intelligence with real-world disruption, Google was able to prevent further exploitation of zero-day vulnerabilities—including an AI-generated exploit targeting login software—that might have otherwise gone unnoticed.

The incident also highlights the risks inherent in the open-source supply chain. The fact that a small, ragtag group could compromise the foundations of several major enterprises demonstrates that current security protocols for software repositories are insufficient. The reliance on stolen tokens and the ability of attackers to automate their movements through the network illustrate that the "perimeter" of a company is no longer a fixed line but a fluid, vulnerable ecosystem.

As law enforcement continues its investigations, the TeamPCP case is likely to set a precedent for how future cyber-adversaries are countered. The effectiveness of the "mole" strategy, coupled with the reliance on the criminals’ own operational failures, provides a roadmap for future operations. For the tech industry, however, the message is clear: while infiltration is a powerful tool, the underlying vulnerabilities in software development remain the primary battleground.

Chronology of the TeamPCP Campaign

• Late 2025: TeamPCP appears online, initiating a series of supply-chain attacks.
• March 2026: Google’s undercover analyst gains access to the "CanisterWorm" chat server.
• April 2026: ShinyHunters partners with TeamPCP, then betrays them by stealing credentials and leaking chat logs to Google.
• May 2026: Google publishes a case study regarding an AI-generated zero-day exploit, later revealed to be linked to the TeamPCP investigation.
• August 2026: Google presents findings to the FBI and AFP; the latter executes search warrants and arrests two primary suspects in Australia.
• September 2026: Details of the infiltration are presented at the LABScon research conference, marking the official close of the operation.

This event has underscored the necessity for deeper collaboration between private technology firms and government law enforcement. As threats grow more automated and harder to detect, the ability to "watch from the inside" may become the only reliable defense against the next generation of sophisticated digital adversaries. The dissolution of TeamPCP is not just a victory for law enforcement; it is a clear warning to those who believe that the anonymity of the web offers total protection from the consequences of their actions.