Australian police arrest two over TeamPCP hacks targeting Mercor, OpenAI, and others

Australian constabulary person arrested 2 radical successful Perth accused of being members of TeamPCP, a prolific hacking radical blamed for high-profile hacks against large tech giants successful caller months. The 2 person been charged with much than a twelve hacking, wealth laundering, and different cybercrime offenses and are expected successful tribunal aboriginal connected Thursday.

According to a statement by the Australian Federal Police, the 2 men are accused of wide breaches involving the compromise and tampering of fashionable open-source projects. The hackers aimed to infect a ample fig of computers to bargain credentials and data, past extort victims into paying a ransom.

The FBI’s cyber part main Brett Leatherman was quoted arsenic saying that the 2 alleged members of TeamPCP are accused of hacking into much than a 1000 organizations arsenic portion of their attacks.

It’s unclear whether the Justice Department plans to question extradition, and a spokesperson for the FBI did not instantly remark erstwhile contacted by TechCrunch.

TeamPCP is simply a prolific cybercriminal pack known for respective wide hacking campaigns targeting the bundle proviso chain, successful which the hackers would interruption successful and maliciously modify a fashionable open-source bundle instrumentality utilized by perchance thousands of companies.

Once installed connected a company’s oregon developer’s systems, the malicious codification steals their backstage keys and different delicate credentials utilized to entree unreality retention systems and, oftentimes, lawsuit data. The authorities said the hackers stole much than fractional a cardinal credentials to further their attacks into different companies.

The hackers were blamed for a cyberattack connected the popular vulnerability scanner instrumentality Trivy, which affected immoderate institution that relied connected it, including LiteLLM, AI recruiting startup Mercor, and others. The hackers are besides suspected of breaching the European Commission’s unreality infrastructure, arsenic good arsenic targeting different unfastened root projects and developer apps that allowed entree to tech giants similar GitHub and OpenAI.

Image Credits:Australian Federal Police

The Australian officials said their investigations began successful April 2026 aft receiving accusation from aggregate cybersecurity companies.

Police person not named the men who were arrested, but autarkic cybersecurity writer Brian Krebs exclusively reported that 1 of the now-arrested alleged hackers is Ruben Thomson, who goes by the hacker grip Ellis. Krebs reported Thursday that helium was successful interaction with Ellis implicit the past respective months, and the hacker told Krebs that helium was the person of TeamPCP until March 2026.

Krebs said Ellis made mistakes that allowed the writer to larn the alleged hacker’s existent identity.

During a property league connected Wednesday announcing the arrests, Australian officials said they had besides seized a ample quantity of allegedly stolen data, arsenic good arsenic devices and different electronics from the hackers. The officials said they planned to notify victims of the attacks.