Google had undercover analyst inside TeamPCP hacking group

Google's threat intelligence group revealed that an undercover researcher infiltrated the notorious hacking group TeamPCP during its extensive software supply-chain attack campaign, based on information published by Ars Technica.

TeamPCP, known for its widespread malware distribution through open-source software and developer account hijacking, compromised hundreds of programs and breached over a thousand companies. The group even released a self-spreading worm to automate its attacks. Google's undercover analyst, embedded within TeamPCP's inner circle, provided crucial inside information. This allowed Google to warn targeted companies, disrupt the hackers' exploitation attempts by revoking stolen credentials, and even obtain and help patch a zero-day exploit developed using AI.

The group's activities included compromising tools like Trivy and LiteLLM, and impacting entities such as GitHub, Mercor, and OpenAI. The infiltration also aided law enforcement in identifying and arresting two alleged key members of TeamPCP in Australia.

Source: Ars Technica