By AJ Vicens
Aug 27 (Reuters) – Australian police announced charges on Thursday against two men accused of participating in a cybercrime syndicate that targeted widely used open-source software to compromise thousands of global businesses.
The Australian men face a combined 14 charges for their alleged roles in TeamPCP, a hacking collective that inserted malicious code into popular tools to compromise businesses, according to a statement from the Australian Federal Police. Some of the businesses were later extorted, according to a July FBI advisory.
The police did not name the men, but the Australian Broadcasting Corporation identified them as Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23.
Nick Scerri, a lawyer for Thomson, did not immediately respond to a request for comment outside of normal business hours. Reuters could not immediately find an attorney for Gaebler.
The malicious code potentially compromised more than 1,000 organizations globally, enabling the theft of more than 500,000 credentials and more than 300 gigabytes of data, according to police.
The police said they conducted a parallel investigation into the men with the FBI starting in April after receiving information from multiple unnamed cybersecurity threat assessment companies.
“We are proud to work with the Australian Federal Police and the Western Australia Police Force to impose cost on criminal actors and combat the growing threat of software supply-chain attacks,” FBI Cyber Division Assistant Director Brett Leatherman said in the police statement.
The FBI declined further comment.
Austin Larsen, a principal threat analyst with Google Threat Intelligence Group, called TeamPCP “one of the most impactful threat actors of 2026” in a message posted to LinkedIn. Larsen described TeamPCP as a “peer community of individually skilled actors with one clear center of gravity,” rather than a single, unified group.
(Reporting by AJ Vicens in DetroitEditing by Rod Nickel)
