Australia Charges Two Men Over Global Open-Source Software Attacks

Australian authorities have formally charged two men in connection with a sophisticated cybercrime operation that targeted widely used open-source software, affecting thousands of businesses across the globe.

The Australian Federal Police (AFP) announced the charges on Thursday, stating that the two individuals face a combined total of 14 charges for their alleged involvement in a hacking collective known as TeamPCP. According to the AFP, the group inserted malicious code into popular open-source tools, which was then used to compromise the systems of unsuspecting businesses.

While the police did not publicly name the suspects, local media has identified them as Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23. The AFP stated that the malicious code potentially compromised more than 1,000 organizations, leading to the theft of over 500,000 credentials and more than 300 gigabytes of sensitive data.

The investigation, which was conducted in parallel with the U.S. Federal Bureau of Investigation (FBI), began in April after authorities received tips from several unnamed cybersecurity firms. The FBI's Assistant Director for the Cyber Division, Brett Leatherman, praised the joint effort, emphasizing the importance of imposing costs on criminal actors and addressing the rising threat of software supply-chain attacks.

Security experts have noted the significant impact of the group. Austin Larsen, a principal threat analyst with Google Threat Intelligence Group, described TeamPCP as one of the most impactful threat actors of the year, characterizing it as a peer community of skilled individuals rather than a single unified organization.

Legal representation for Thomson did not immediately respond to requests for comment, and no attorney could be located for Gaebler at the time of reporting.