骇客组织 TeamPCP 先前发动了史无前例的软体供应链攻击，污染数百个开源软体、窃取开发者凭证并散布蠕虫，入侵超过上千家企业与机构。Google 旗下威胁情报团队与子公司 Mandiant 透露，其卧底研究员成功渗透进该组织核心聊天群组，从内部全程监控其攻击活动，并在第一时间向各大服务商与受害者发出警报以撤销凭证，及时阻断大规模勒索图谋与修补零日漏洞。
由于难以将庞大的遭窃资料变现，TeamPCP 曾尝试与知名犯罪团伙 ShinyHunters 合作拆帐，却反遭对方背叛并私吞赎金。这场黑吃黑引发内部猜忌，迫使 TeamPCP 缩小核心成员范围并转移伺服器，同时也将 Google 的卧底人员踢出群组。尽管失去了内部情报来源，Google 仍持续透过传统数位追查手段追踪组织首脑的蛛丝马迹。
最终，Google 研究团队抓住了主嫌 Ruben Ian Thomson 致命的操作安全失误，发现其用于备份非法外泄资料的 Google 云端硬碟帐号，可串联回包含其真实姓名的 PayPal 历史纪录。Google 迅速将关键身份线索通报给联邦调查局，并促成澳洲联邦警察上个月在雪梨正式逮捕包含 Thomson 在内的两名主要成员，成功瓦解了这个造成广泛破坏的供应链攻击团伙。
The hacker collective TeamPCP executed an unprecedented software supply-chain cyberattack campaign by tampering with numerous open-source repositories, compromising developer credentials, and deploying self-propagating worms to breach over a thousand organizations. Google Threat Intelligence and its subsidiary Mandiant revealed that an undercover researcher infiltrated the group's inner circle, allowing Google to monitor malicious operations in real time, notify major cloud providers to revoke stolen credentials, and neutralize emerging zero-day exploits before widespread harm occurred.
Struggling to monetize over half a million stolen credentials, TeamPCP formed a revenue-sharing alliance with the notorious cybercriminal syndicate ShinyHunters, which subsequently betrayed them by pocketing ransoms and leaking communications. This fallout prompted TeamPCP to purge its core chat rooms and migrate servers, inadvertently expelling Google's covert analyst. Despite losing direct insider visibility, Google investigators relied on digital forensics and historical breach data to piece together the identities behind the criminal enterprise.
The breakthrough emerged from severe operational security blunders committed by alleged leader Ruben Ian Thomson, who backed up stolen corporate data to a Google Drive account linked to a personal Gmail and an old PayPal refund trail containing his real name. Google swiftly provided actionable evidence to the FBI, leading to a coordinated joint operation where Australian Federal Police arrested Thomson and an accomplice, dealing a decisive blow to the destructive hacking network.