Source: https://flare.io/learn/resources/blog/te...in-attacks
TWO ALLEGED TeamPCP MEMBERS ARRESTED IN GLOBAL SOFTWARE SUPPLY-CHAIN CYBERCRIME OPERATION
Australian authorities have charged two Western Australian men, aged 21 and 23, following a joint AFP and Western Australia Police investigation conducted in parallel with the FBI.
The FBI identified the alleged cybercriminal group as TeamPCP.
Authorities allege the syndicate inserted malicious code into software hosted on an open-source repository, which was then unknowingly used by other developers and propagated into government, academic and private-sector environments.
The scale alleged by investigators is significant:
More than 1,000 organizations potentially compromised worldwide
More than 500,000 credentials and authentication materials stolen At least 300 GB of data exfiltrated
Global remediation costs estimated in the hundreds of millions of dollars Data intrusion, identity crime and cryptocurrency-based money laundering allegedly involved
The two suspects allegedly received cryptocurrency payments for their roles 14 criminal charges filed between the two men
Additional arrests and charges have not been ruled out
Search warrants were executed on August 26 at properties in Cottesloe, Hamilton Hill and Mandurah, with electronic devices and other evidence seized for forensic examination.
⚠️ Analyst Note:
The particularly important element here is the supply-chain methodology.
Rather than attacking every victim directly, the alleged operators compromised trusted open-source software components and allowed downstream adoption to distribute the malicious code into potentially more than 1,000 organizations.
The case also highlights the value of private-sector intelligence: AFP says the investigation began after AFP and FBI received information from multiple cyber threat assessment companies.
https://www.afp.gov.au/news-centre/media...ged-global
TWO ALLEGED TeamPCP MEMBERS ARRESTED IN GLOBAL SOFTWARE SUPPLY-CHAIN CYBERCRIME OPERATION
Australian authorities have charged two Western Australian men, aged 21 and 23, following a joint AFP and Western Australia Police investigation conducted in parallel with the FBI.
The FBI identified the alleged cybercriminal group as TeamPCP.
Authorities allege the syndicate inserted malicious code into software hosted on an open-source repository, which was then unknowingly used by other developers and propagated into government, academic and private-sector environments.
The scale alleged by investigators is significant:
More than 1,000 organizations potentially compromised worldwide
More than 500,000 credentials and authentication materials stolen At least 300 GB of data exfiltrated
Global remediation costs estimated in the hundreds of millions of dollars Data intrusion, identity crime and cryptocurrency-based money laundering allegedly involved
The two suspects allegedly received cryptocurrency payments for their roles 14 criminal charges filed between the two men
Additional arrests and charges have not been ruled out
Search warrants were executed on August 26 at properties in Cottesloe, Hamilton Hill and Mandurah, with electronic devices and other evidence seized for forensic examination.
⚠️ Analyst Note:
The particularly important element here is the supply-chain methodology.
Rather than attacking every victim directly, the alleged operators compromised trusted open-source software components and allowed downstream adoption to distribute the malicious code into potentially more than 1,000 organizations.
The case also highlights the value of private-sector intelligence: AFP says the investigation began after AFP and FBI received information from multiple cyber threat assessment companies.
https://www.afp.gov.au/news-centre/media...ged-global
![[Image: Unethical-Signature.gif]](https://i.postimg.cc/d1GPhR9f/Unethical-Signature.gif)
![[Image: Advanced-Investigation-650x200.gif]](https://i.ibb.co/8tq9Jrk/Advanced-Investigation-650x200.gif)