Australian authorities arrested two alleged TeamPCP principals on August 27 and seized devices for forensic analysis, moving the probe past disruption and attribution into a prosecution track. The AFP says the men, aged 21 and 23, were principal participants in the syndicate tied to supply-chain attacks that may have affected more than 1,000 organizations worldwide.
The shift matters because seized phones, laptops, and payment records can show who paid whom, which packages were altered, and whether other compromises were hidden behind the public Trivy and npm cases already linked to the group. That kind of evidence can also surface new indicators and victims that were not visible from the malware itself.
For defenders watching TeamPCP, the exposure is no longer only what the group pushed into open-source software; it is also what investigators may now recover from the people and infrastructure behind it. If your telemetry already covered the known incidents, the next findings may come from sealed evidence, not fresh internet noise.
Shai-Hulud hackers: two men charged over TeamPCP's global supply chain crime spree that hit OpenAI, and thousands more
Police have charged two men from Western Australia over their alleged involvement in TeamPCP, a cybercriminal gang that has been blamed for a massive software supply-chain hacking campaign.