Google's undercover analyst sat inside the TeamPCP hacking group
Google says a Mandiant persona joined the inner circle of TeamPCP in March, watching the supply-chain hacking spree from the inside and helping revoke stolen credentials.
Google's threat intelligence group has disclosed that one of its own undercover researchers was inside TeamPCP, the hacker group behind a cascading series of software supply-chain attacks. Researcher Austin Larsen is presenting the details at LABScon, the research conference run by security firm SentinelOne.
According to Larsen, a persona operated by Google's security subsidiary Mandiant spent months building trust with an actor who was later invited into TeamPCP, and was added to the group in March, just as the campaign was accelerating. The analyst was one of roughly 12 people with access to the group's core chat, which TeamPCP called CanisterWorm. Mandiant, Larsen says, was watching behind the scenes almost from day one.
The campaign
The group, which first appeared online in late 2025, tainted hundreds of open-source programs with malware, stole developer accounts to keep the chain going, and released a self-spreading worm called Mini Shai-Hulud, named after the sandworms in Dune, to automate the process. Starting this spring it compromised the open-source scanner Trivy, the AI API tool LiteLLM, infrastructure at Checkmarx, the web app library TanStack, and Mistral AI. The chain reached GitHub, data contracting firm Mercor, and employee devices at OpenAI and the European Commission, with more than a thousand companies breached in total.
Disruption and arrests
The undercover analyst also reached a server where TeamPCP stored usernames, passwords and access tokens taken from victims. Rather than contacting every breached company, Google went first to providers such as Amazon Web Services and Microsoft to get the credentials revoked, sending hundreds of notification emails. Google also received intelligence from ShinyHunters, a criminal group that had partnered with TeamPCP and later turned on it.
Last month Australian police, working with the FBI, arrested Ruben Ian Thomson and Louis Michael Gaebler, both Australians in their early 20s. Full account at Ars Technica.
