Arrests in Western Australia

Australian Federal Police have arrested two men in Western Australia, aged 21 and 23, believed to be key figures in the notorious cybercrime group TeamPCP. The group is blamed for one of the longest-running software supply chain attack sprees ever recorded.

The arrests happened Wednesday morning. The AFP says the pair face a combined 14 cybercrime offenses and appeared in Perth Magistrates Court today.

While the AFP hasn’t named the defendants, reporting from KrebsOnSecurity has identified them as Ruben Ian Thomson of Cottesloe and Michael Gaebler. Thomson was denied bail; Gaebler’s attorney reportedly didn’t request it. Both remain in custody until September 18.

Who is TeamPCP?

TeamPCP burst onto the scene in late 2025, embedding malicious code in hundreds of open source tools and extorting victims. Their self-propagating worm, dubbed Shai-Hulud, compromised corporate cloud environments by hijacking developer credentials on platforms like GitHub and NPM.

The group’s tactic was cyclical. They’d compromise a developer’s machine, steal credentials, publish malicious versions of dev tools, and repeat. This allowed them to expand their network of breached systems exponentially.

In March, they hit AI infrastructure by compromising LiteLLM, an open source AI gateway. The attack harvested cloud keys from over 2,500 organizations. By May, they claimed responsibility for compromising at least 3,800 GitHub repositories.

The Cybercats Connection

Security experts describe TeamPCP less as a structured gang and more as a loose amalgamation of threat actors. Austin Larsen, a principal threat analyst at Google Threat Intelligence Group, calls it “a peer community of individually-skilled actors, with one clear center of gravity.”

That center was a Matrix chat server called “Cybercats,” created by security researcher George Prepakis, who operates the X profile @kernelstub. The server became a meeting ground for multiple cybercrime entities, including TeamPCP.

Several administrators used their X handles in these chats, often taunting victims publicly before news broke. The handle @pcpcasper, for instance, was linked to Michael Gaebler, who had an extensive message history on Telegram showing active membership in the National Socialist Network, an Australian neo-Nazi group.

How the Leader Was Unmasked

The TeamPCP spokesperson, known by various aliases including EllisD25, BulkDMT, and Express, made critical operational security mistakes that led to his identification.

Investigators traced email addresses and IP addresses across multiple forums. A Gmail account linked to the handle ChristmasSnow on Raidforums led to IP addresses in Perth, Australia. Passive DNS records tied one of those IPs to a family with the last name Thomson.

Further digging connected the dots to Ruben Thomson. His brother’s accounts, his own HackerOne profile (under the username Deadcatx3, an alias flagged by multiple security firms), and even a company he incorporated named “OPSEC Express” — a nod to his Breachforums nickname — all pointed to the same person.

In an interview with KrebsOnSecurity, the TeamPCP leader, who goes by Ellis, was remarkably open. He claimed to have earned only about $20,000 from his activities. “Blackhatting is fun,” he said. “There are actual rewards and incentives to learn and you grow with your team.”

Ellis expressed no remorse, saying, “If I’ve already been found out then it’s out of my control, I’ll make peace with that.” He also acknowledged his struggles with addiction, noting that “someone like me needs a lot of help that prison just can’t provide.”

Implications for Supply Chain Security

Charlie Eriksen, a security researcher at Aikido Security, says TeamPCP represents a new kind of threat actor. “They are not a state actor, not quite organized cybercrime, and not purely ideological,” he told KrebsOnSecurity.

Eriksen argues that large language models have compressed the gap between understanding an attack technique and executing it at scale. This allows less experienced actors to cause significant damage without the operational discipline of professional groups.

“They can be noisy, they can make mistakes,” he said. “They can leave evidence everywhere. They can take risks that a professional criminal group or intelligence service would consider completely unacceptable.”

Paradoxically, TeamPCP may have done the security community a favor. Their success forced GitHub to introduce a three-day “cooldown” mechanism for Dependabot, its auto-update tool. This gives security tools time to identify compromised packages before they spread. Python and various JavaScript platforms have also adopted similar measures.

“They managed to wake up Microsoft to the fact that they had become negligent in terms of security,” Eriksen said. “They humiliated Microsoft into action.”

The arrests of Thomson and Gaebler send a clear message: even the most brazen cybercriminals can be caught. But the underlying vulnerabilities in open source ecosystems remain. The cooldown periods are a start, but the broader community still has work to do.

For more on how to protect your organization from similar threats, check out our guide on open source security best practices. You might also be interested in how to secure your GitHub repositories against credential theft.

A New Emergency for the Nation’s Power Lines

President Trump signed Executive Order 14420 on Wednesday, declaring a national emergency over the security of the US bulk power system. The move zeroes in on a specific fear: foreign-made electrical equipment that arrives with hidden backdoors or other sabotage capabilities baked in.

It’s a pointed shift in how Washington is thinking about grid security. Instead of focusing only on hackers actively breaking into networks, the order targets the upstream supply chain — the transformers, inverters, and control systems that keep the lights on.

Why Now? Data Centers and AI Are Driving the Urgency

The order points to a fast-changing energy landscape. Data centers, artificial intelligence, advanced manufacturing, and defense production are all growing at a breakneck pace. That growth means the grid is being pushed harder than ever, making it more vulnerable to any disruption — whether from a supply chain hiccup or a deliberate attack.

Officials argue that as reliance on grid reliability deepens, the impact of a foreign backdoor in critical equipment becomes far more severe. A single compromised component could be used for remote access, malicious operation, or even supply disruption.

What Equipment Falls Under the Order?

The scope is broad, covering infrastructure that operates bulk-power system transmission lines rated at 69 kilovolts or higher. Local electricity distribution facilities are explicitly excluded.

Targeted technologies include:

• Transformers and inverters
• Energy storage systems
• Industrial control systems (ICS), including remote terminal units (RTUs) and programmable logic controllers (PLCs)
• Safety systems
• Associated firmware, software, and remote access capabilities

The restrictions apply to any acquisition, import, transfer, or installation of foreign-produced bulk-power equipment initiated after August 26, 2026, if the transaction involves designated entities. In plain terms: if the hardware or software is deemed a risk for sabotage, unauthorized access, or supply disruption, it’s off the table.

A Familiar Playbook, But With a Twist

The order doesn’t name any specific country. But its structure is a near mirror of a 2020 Trump-era bulk-power order. That earlier directive led to a Department of Energy prohibition order that explicitly targeted entities associated with China — though it was later revoked after a Biden administration review.

So while no country is named this time, the ghost of that previous action hangs over the new one. The focus on embedded hardware backdoors and supply chain risk suggests a longer-term strategy, not just a reaction to active intrusions.

What Happens to Equipment Already Installed?

For gear that’s already in the ground, the Energy Department can now mandate security controls. After consulting with defense and intelligence leaders, it can require grid operators to identify, isolate, monitor, secure, disconnect, or replace certain components to neutralize operational threats.

The order stresses that service continuity and safety must be maintained. That’s a delicate balance — you can’t just rip out a transformer that’s keeping a hospital online.

Exemptions and Mitigation Agreements

To keep the grid running, energy authorities can also negotiate mitigation agreements with operators. They can publish an official list of pre-qualified equipment and vendors that are exempt from the baseline prohibitions. That gives the industry a clear path forward, provided they source from approved suppliers.

What This Means for the Industry

For utilities and grid operators, this order is a significant compliance shift. Procurement teams will need to vet suppliers more rigorously. Security teams will need to audit existing installations for any signs of foreign-origin components that could be flagged.

The broader trend here is clear: supply chain security is no longer just a buzzword for IT departments. It’s now a national security priority with legal teeth. If you’re in the energy sector, this is the moment to review your vendor lists and understand where your critical components are coming from.

For more on how these threats evolve, check out our coverage of industrial cybersecurity threats and the latest in critical infrastructure protection.

New Malware, Same Old Game

Iran’s cyber espionage machine never sleeps. Group-IB researchers have just published a deep dive into Nimbus Manticore, an Islamic Revolutionary Guard Corps (IRGC)-affiliated hacking group that’s been quietly expanding its toolkit. The findings reveal a previously undocumented backdoor that borrows heavily from TWOSTROKE, plus a custom SSH tunneler designed to keep covert communications flowing.

This isn’t a flashy ransomware operation. It’s patient, methodical espionage — the kind that targets government networks and critical infrastructure, often for years without detection.

Meet the TWOSTROKE-Like Backdoor

Group-IB’s analysis describes the new backdoor as structurally similar to TWOSTROKE, a known malware family linked to Iranian cyber operations. But it’s not a carbon copy. The researchers found distinct modifications in how the malware handles command-and-control (C2) communications and data exfiltration.

The backdoor operates in phases. It first establishes persistence on the infected host, then reaches out to its C2 server using encrypted channels. Once connected, it can execute arbitrary commands, upload and download files, and even manipulate system processes. The TWOSTROKE-like design makes it harder for defenders to spot — it blends in with legitimate network traffic.

Key Capabilities

• Encrypted C2 communications that mimic normal HTTPS traffic
• Modular command execution for post-exploitation tasks
• File exfiltration with built-in compression and chunking
• Persistence mechanisms that survive system reboots

Group-IB says the code quality is high. This isn’t a rushed job. The malware includes error-handling routines and anti-analysis tricks that suggest experienced developers are behind it.

The SSH Tunneler: A Quiet Workhorse

Alongside the backdoor, Nimbus Manticore deployed a custom SSH tunneler. This tool is deceptively simple: it establishes a secure tunnel between the victim’s network and an external server controlled by the attackers. But that simplicity is what makes it dangerous.

Once the tunneler is in place, the attackers can route traffic through the compromised network as if they were sitting inside it. This allows them to reach internal systems that aren’t directly exposed to the internet — databases, admin panels, or other machines on the same LAN. For a group focused on espionage, that’s gold.

Who Exactly Is Nimbus Manticore?

Nimbus Manticore has been on Group-IB’s radar for a while. The researchers describe the group as one of the most active Iranian APT actors in 2026, with a focus on intelligence gathering rather than sabotage. Their targets have included government entities, telecommunications firms, and research institutions across the Middle East and beyond.

The group operates under the banner of the IRGC, Iran’s ideological military force. That affiliation gives them resources and cover, but it also makes their activities a matter of national security concern for countries on the receiving end.

Attribution and Overlaps

Group-IB’s report notes overlaps with other known Iranian threat actors, suggesting the groups share tools or even personnel. The TWOSTROKE-like backdoor, for instance, bears resemblance to code previously attributed to a different IRGC-linked cluster. This kind of tool-sharing is common in state-sponsored ecosystems — it’s cheaper than developing everything from scratch.

What This Means for Defenders

If you’re responsible for securing a network that might be in Nimbus Manticore’s crosshairs, the takeaway is straightforward: expect stealthy, persistent intrusions that prioritize data theft over disruption. The use of SSH tunneler means you can’t just watch the perimeter — you need to monitor internal traffic for anomalies.

Group-IB recommends several defensive measures:

• Deploy endpoint detection and response (EDR) tools that can spot unusual process behavior
• Monitor outbound connections for encrypted tunnels that don’t match known business applications
• Segment networks to limit lateral movement if one machine is compromised
• Patch vulnerabilities promptly — many initial access vectors exploit known flaws

This isn’t just another APT report. It’s a reminder that Iranian cyber operations continue to evolve, and the tools they use are getting more sophisticated. The TWOSTROKE-like backdoor and SSH tunneler are just the latest additions to an arsenal that shows no signs of shrinking.

For more on related threat activity, check out our analysis of Iranian APT groups targeting critical infrastructure and the broader state-sponsored cyber espionage landscape.