Australian authorities have arrested two young men accused of participating in TeamPCP, a cybercrime collective linked to attacks that potentially compromised more than 1,000 organizations worldwide.
Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23, were arrested in Perth following an investigation involving the Australian Federal Police (AFP), Western Australia Police, and the FBI. Authorities have filed a combined 14 charges against the pair.
Investigators allege that the suspects were involved in distributing malicious code capable of compromising systems belonging to businesses, government bodies, and other organizations. The AFP estimates that the activity associated with the malware enabled attackers to obtain more than 500,000 credentials and remove at least 300GB of data from victims.
Both men are suspected of being members of TeamPCP, which authorities describe as a highly organized cybercriminal operation. The group has attracted particular attention because of its alleged involvement in supply chain attacks, where compromising software or services can provide access to numerous downstream organizations.
The FBI had already warned organizations about TeamPCP activity in July. The group has also been associated with the March attack involving LiteLLM, an open-source framework used to connect applications with different artificial intelligence models.
That incident resulted in the theft of a large collection of sensitive information. A 153GB archive was reportedly taken during the attack, with nearly 2,500 organizations appearing among the affected entities. The exposed material included secrets and credentials connected to a wide range of companies and institutions.
Australian media reports have described Thomson and Gaebler as central figures in TeamPCP, with Thomson allegedly occupying a leadership role. These claims remain allegations, and the criminal cases against both defendants have yet to be decided by a court.
The charges against Thomson include possessing hacking tools with the intention of using them, unauthorized modification of computer data, distributing hacking tools, failing to comply with a court order requiring the surrender of devices, and dealing with more than $100,000 believed to represent proceeds of crime.
Gaebler faces allegations involving possession of hacking tools, unauthorized modification of data, and distribution of tools intended for cyberattacks.
The arrests represent the result of cooperation between Australian and US law enforcement as authorities investigate TeamPCP’s international activities. Given the alleged number of compromised organizations and stolen credentials, the investigation extends well beyond the two suspects arrested in Perth.
If convicted, both men could receive substantial prison sentences. Thomson faces the broader set of allegations, with the combined maximum penalties attached to his charges potentially amounting to decades of imprisonment.