Arrests in Western Australia

Australian Federal Police have arrested two men in Western Australia, aged 21 and 23, believed to be key figures in the notorious cybercrime group TeamPCP. The group is blamed for one of the longest-running software supply chain attack sprees ever recorded.

The arrests happened Wednesday morning. The AFP says the pair face a combined 14 cybercrime offenses and appeared in Perth Magistrates Court today.

While the AFP hasn’t named the defendants, reporting from KrebsOnSecurity has identified them as Ruben Ian Thomson of Cottesloe and Michael Gaebler. Thomson was denied bail; Gaebler’s attorney reportedly didn’t request it. Both remain in custody until September 18.

Who is TeamPCP?

TeamPCP burst onto the scene in late 2025, embedding malicious code in hundreds of open source tools and extorting victims. Their self-propagating worm, dubbed Shai-Hulud, compromised corporate cloud environments by hijacking developer credentials on platforms like GitHub and NPM.

The group’s tactic was cyclical. They’d compromise a developer’s machine, steal credentials, publish malicious versions of dev tools, and repeat. This allowed them to expand their network of breached systems exponentially.

In March, they hit AI infrastructure by compromising LiteLLM, an open source AI gateway. The attack harvested cloud keys from over 2,500 organizations. By May, they claimed responsibility for compromising at least 3,800 GitHub repositories.

The Cybercats Connection

Security experts describe TeamPCP less as a structured gang and more as a loose amalgamation of threat actors. Austin Larsen, a principal threat analyst at Google Threat Intelligence Group, calls it “a peer community of individually-skilled actors, with one clear center of gravity.”

That center was a Matrix chat server called “Cybercats,” created by security researcher George Prepakis, who operates the X profile @kernelstub. The server became a meeting ground for multiple cybercrime entities, including TeamPCP.

Several administrators used their X handles in these chats, often taunting victims publicly before news broke. The handle @pcpcasper, for instance, was linked to Michael Gaebler, who had an extensive message history on Telegram showing active membership in the National Socialist Network, an Australian neo-Nazi group.

How the Leader Was Unmasked

The TeamPCP spokesperson, known by various aliases including EllisD25, BulkDMT, and Express, made critical operational security mistakes that led to his identification.

Investigators traced email addresses and IP addresses across multiple forums. A Gmail account linked to the handle ChristmasSnow on Raidforums led to IP addresses in Perth, Australia. Passive DNS records tied one of those IPs to a family with the last name Thomson.

Further digging connected the dots to Ruben Thomson. His brother’s accounts, his own HackerOne profile (under the username Deadcatx3, an alias flagged by multiple security firms), and even a company he incorporated named “OPSEC Express” — a nod to his Breachforums nickname — all pointed to the same person.

In an interview with KrebsOnSecurity, the TeamPCP leader, who goes by Ellis, was remarkably open. He claimed to have earned only about $20,000 from his activities. “Blackhatting is fun,” he said. “There are actual rewards and incentives to learn and you grow with your team.”

Ellis expressed no remorse, saying, “If I’ve already been found out then it’s out of my control, I’ll make peace with that.” He also acknowledged his struggles with addiction, noting that “someone like me needs a lot of help that prison just can’t provide.”

Implications for Supply Chain Security

Charlie Eriksen, a security researcher at Aikido Security, says TeamPCP represents a new kind of threat actor. “They are not a state actor, not quite organized cybercrime, and not purely ideological,” he told KrebsOnSecurity.

Eriksen argues that large language models have compressed the gap between understanding an attack technique and executing it at scale. This allows less experienced actors to cause significant damage without the operational discipline of professional groups.

“They can be noisy, they can make mistakes,” he said. “They can leave evidence everywhere. They can take risks that a professional criminal group or intelligence service would consider completely unacceptable.”

Paradoxically, TeamPCP may have done the security community a favor. Their success forced GitHub to introduce a three-day “cooldown” mechanism for Dependabot, its auto-update tool. This gives security tools time to identify compromised packages before they spread. Python and various JavaScript platforms have also adopted similar measures.

“They managed to wake up Microsoft to the fact that they had become negligent in terms of security,” Eriksen said. “They humiliated Microsoft into action.”

The arrests of Thomson and Gaebler send a clear message: even the most brazen cybercriminals can be caught. But the underlying vulnerabilities in open source ecosystems remain. The cooldown periods are a start, but the broader community still has work to do.

For more on how to protect your organization from similar threats, check out our guide on open source security best practices. You might also be interested in how to secure your GitHub repositories against credential theft.

New Malware, Same Old Game

Iran’s cyber espionage machine never sleeps. Group-IB researchers have just published a deep dive into Nimbus Manticore, an Islamic Revolutionary Guard Corps (IRGC)-affiliated hacking group that’s been quietly expanding its toolkit. The findings reveal a previously undocumented backdoor that borrows heavily from TWOSTROKE, plus a custom SSH tunneler designed to keep covert communications flowing.

This isn’t a flashy ransomware operation. It’s patient, methodical espionage — the kind that targets government networks and critical infrastructure, often for years without detection.

Meet the TWOSTROKE-Like Backdoor

Group-IB’s analysis describes the new backdoor as structurally similar to TWOSTROKE, a known malware family linked to Iranian cyber operations. But it’s not a carbon copy. The researchers found distinct modifications in how the malware handles command-and-control (C2) communications and data exfiltration.

The backdoor operates in phases. It first establishes persistence on the infected host, then reaches out to its C2 server using encrypted channels. Once connected, it can execute arbitrary commands, upload and download files, and even manipulate system processes. The TWOSTROKE-like design makes it harder for defenders to spot — it blends in with legitimate network traffic.

Key Capabilities

• Encrypted C2 communications that mimic normal HTTPS traffic
• Modular command execution for post-exploitation tasks
• File exfiltration with built-in compression and chunking
• Persistence mechanisms that survive system reboots

Group-IB says the code quality is high. This isn’t a rushed job. The malware includes error-handling routines and anti-analysis tricks that suggest experienced developers are behind it.

The SSH Tunneler: A Quiet Workhorse

Alongside the backdoor, Nimbus Manticore deployed a custom SSH tunneler. This tool is deceptively simple: it establishes a secure tunnel between the victim’s network and an external server controlled by the attackers. But that simplicity is what makes it dangerous.

Once the tunneler is in place, the attackers can route traffic through the compromised network as if they were sitting inside it. This allows them to reach internal systems that aren’t directly exposed to the internet — databases, admin panels, or other machines on the same LAN. For a group focused on espionage, that’s gold.

Who Exactly Is Nimbus Manticore?

Nimbus Manticore has been on Group-IB’s radar for a while. The researchers describe the group as one of the most active Iranian APT actors in 2026, with a focus on intelligence gathering rather than sabotage. Their targets have included government entities, telecommunications firms, and research institutions across the Middle East and beyond.

The group operates under the banner of the IRGC, Iran’s ideological military force. That affiliation gives them resources and cover, but it also makes their activities a matter of national security concern for countries on the receiving end.

Attribution and Overlaps

Group-IB’s report notes overlaps with other known Iranian threat actors, suggesting the groups share tools or even personnel. The TWOSTROKE-like backdoor, for instance, bears resemblance to code previously attributed to a different IRGC-linked cluster. This kind of tool-sharing is common in state-sponsored ecosystems — it’s cheaper than developing everything from scratch.

What This Means for Defenders

If you’re responsible for securing a network that might be in Nimbus Manticore’s crosshairs, the takeaway is straightforward: expect stealthy, persistent intrusions that prioritize data theft over disruption. The use of SSH tunneler means you can’t just watch the perimeter — you need to monitor internal traffic for anomalies.

Group-IB recommends several defensive measures:

• Deploy endpoint detection and response (EDR) tools that can spot unusual process behavior
• Monitor outbound connections for encrypted tunnels that don’t match known business applications
• Segment networks to limit lateral movement if one machine is compromised
• Patch vulnerabilities promptly — many initial access vectors exploit known flaws

This isn’t just another APT report. It’s a reminder that Iranian cyber operations continue to evolve, and the tools they use are getting more sophisticated. The TWOSTROKE-like backdoor and SSH tunneler are just the latest additions to an arsenal that shows no signs of shrinking.

For more on related threat activity, check out our analysis of Iranian APT groups targeting critical infrastructure and the broader state-sponsored cyber espionage landscape.

FBI Disrupts China-Linked QTFY Hacking Platforms

The U.S. Department of Justice (DoJ) announced on Wednesday the disruption of two hacking platforms—QScan and QTRouter—operated by Chinese threat actors targeting critical infrastructure and sensitive networks across the United States. The operation marks a significant blow to a state-sponsored group known as QTFY, linked to Nanjing Xinjiuwei Network Technology Company (南京鑫玖维网络科技有限公司).

This isn’t just another takedown. The FBI, alongside international partners, seized domain names and infrastructure tied to the group’s operations, effectively cutting off a pipeline used to exfiltrate data from American organizations.

What Are QScan and QTRouter?

QScan served as a scanning tool, probing networks for vulnerabilities. QTRouter, meanwhile, acted as a relay—routing stolen data back to the attackers. Together, they formed a two-step assault: find the weakness, then exploit it.

Think of it as a burglar casing a house, then bringing a truck to haul away the goods. The DoJ’s action dismantled both the casing tools and the getaway vehicle.

Targeting Critical Infrastructure

The group didn’t go after random victims. Their focus was on critical infrastructure—energy grids, water systems, and healthcare networks. These are the systems that keep the country running, and a breach could have catastrophic consequences.

The FBI’s operation neutralized the threat before it could escalate into a full-blown crisis.

Who Is Behind QTFY?

Attribution points to a Chinese state-sponsored group operating under the name QTFY. The group is allegedly employed by Nanjing Xinjiuwei Network Technology Company, a firm based in China. This isn’t the first time Chinese actors have been accused of cyber espionage, but the scale and precision of this operation stand out.

The DoJ’s announcement didn’t name individual hackers, but the infrastructure takedown sends a clear message: the U.S. is watching, and it will act.

How the Disruption Worked

The FBI used court-authorized seizures to take control of domains and servers used by QScan and QTRouter. By redirecting traffic, they disrupted the group’s ability to communicate with their malware.

It’s a classic move in cyber operations—cut the head, and the body withers. The stolen data, if any, may now be unrecoverable for the attackers.

International Cooperation

While the DoJ didn’t specify all partners, U.S. agencies often work with allies like the UK’s National Cyber Security Centre or Europol. This collaborative approach makes it harder for threat actors to find safe havens.

For organizations worried about similar attacks, the takeaway is clear: patch vulnerabilities, monitor networks, and assume you’re a target.

What This Means for U.S. Organizations

If you’re running a business in the U.S., this disruption is good news. It removes a known threat, but it doesn’t eliminate the risk entirely. Chinese state-sponsored groups will adapt, and new tools will emerge.

The FBI’s action is a reminder that cyber defense is a shared responsibility. Government operations can only do so much; private sector vigilance is equally critical.

For more on protecting your organization, check out our guide on cybersecurity best practices for small businesses and the latest threat intelligence updates.

Looking Ahead

The QTFY disruption is a win, but it’s a battle in a larger war. As long as nation-states engage in cyber espionage, the U.S. will need to stay ahead.

For now, the FBI’s operation sends a strong signal: stealing data from American infrastructure has consequences.