The Inside Story of Google's Supply Chain Spy

The Hunt for TeamPCP

When I first heard about TeamPCP, it was clear this wasn't your typical cybercriminal group. They had launched what became known as the worst-ever software supply-chain hacking spree in history—tainting hundreds of open-source programs and breaching over a thousand companies.

Their modus operandi was chilling: compromising open-source tools to hide malware, stealing developer credentials, and using self-spreading worms like Mini Shai-Hulud to automate attacks. The group even named their worm after the sandworms from Dune, showing a disturbing blend of technical skill and dark creativity.

But what struck me most was not just the scale of damage, but how Google managed to get inside the gang's inner circle—literally watching from within as the operation unfolded. It's one of the most sophisticated cybersecurity operations I've seen in recent years.

“You guys should understand that we pulled off the biggest supplychain maybe ever recorded in modern history,” one TeamPCP member wrote in a leaked chat.

A Deep Cover Analyst at Work

In March, as TeamPCP was ramping up its campaign, Google's threat intelligence team made a bold move. They planted an undercover analyst inside the group—someone who would gain access to the core CanisterWorm chat and observe everything firsthand.

That insider was part of a larger effort involving Google's security subsidiary Mandiant, which had already established a presence within TeamPCP's ranks from almost day one. This wasn't just surveillance—it was a calculated intelligence operation designed to stop the bleeding early.

The analyst had access to stolen credentials that TeamPCP intended to use for extortion. Google used this knowledge to warn victims and prevent further damage by immediately contacting service providers like AWS and Microsoft to revoke compromised accounts before they could be exploited.

It was a strategic win, but more than that, it revealed how much we still don't know about the inner workings of these cybercriminal organizations—and how quickly they can fall apart when internal trust erodes.

Cybercrime Betrayals

TeamPCP's inability to profit from its massive haul—only tens of thousands of dollars despite having more than half a million user credentials—spurred them to seek partnerships with other cybercriminal groups. They even offered access to stolen data in exchange for a cut of any ransoms collected.

One such partner was ShinyHunters, a well-known and prolific hacker group responsible for millions in extortions, including the breach of educational software platform Canvas that paralyzed thousands of schools across the U.S. But ShinyHunters turned on TeamPCP, carrying out their own extortions with stolen credentials while withholding their share.

ShinyHunters shared a full log of TeamPCP's internal chats—not knowing Google already had access through its mole. This betrayal forced TeamPCP to tighten security and expel members, including Google's insider analyst.

This wasn't just a technical failure; it was a breakdown in operational security that ultimately led to the arrest of two key figures: Ruben Ian Thomson and Louis Michael Gaebler, both Australians in their early twenties. Their arrest marked a significant milestone in countering high-profile cybercriminal operations.

Tracking the Suspects

Without the mole inside TeamPCP, Google's investigators still managed to piece together key identifying details about Thomson. A leak from the BreachForums hacker forum revealed a Gmail address tied to one of the most active members in the CanisterWorm chat.

Further investigation uncovered another email address linked to a 2019 dispute involving a pirated Microsoft Office seller. Google's team followed the digital breadcrumbs and found that Thomson was storing sensitive stolen data on a Google Drive under his personal account—a critical operational mistake that gave them the evidence needed to alert law enforcement.

The FBI responded quickly to this intelligence, leading to Thomson's arrest and the eventual dismantling of the gang's infrastructure. This case underscores how crucial collaboration between tech companies and law enforcement is in fighting cybercrime on a global scale.

Google's New Cyber Disruption Unit

This incident also highlights the evolving nature of cybersecurity strategy at Google. The operation coincided with the launch of Google's new Cyber Disruption Unit, tasked with taking more aggressive action against cyber threats and state-sponsored attacks.

I believe this shift represents a fundamental change in how tech giants approach online security—not just reporting threats but actively disrupting them. It's a proactive stance that recognizes that the old ways of merely documenting attacks are no longer enough when millions of users and businesses are at risk.

While Google's analyst never engaged in illegal activity or encouraged breaches, their presence inside TeamPCP provided unprecedented insight into how these networks operate. That kind of intelligence gathering can be invaluable in preventing future incidents.

What's clear is that supply-chain attacks like those carried out by TeamPCP are becoming more common and dangerous. As software continues to underpin nearly every business process, the potential impact of such breaches grows exponentially. Our job as analysts is not only to identify these risks but also to stay ahead of the evolving tactics used by cybercriminals.

The Human Cost of Cybersecurity

Ultimately, this story isn't just about tech and code—it's about people. Thousands of companies were affected by TeamPCP's attacks, from OpenAI employees to European Commission officials. For those individuals, the consequences of these breaches go beyond data loss; they involve trust in digital systems that are supposed to protect them.

What makes Google's approach particularly effective is its emphasis on protecting users and customers—not just reporting vulnerabilities. It reflects a broader understanding that in today's interconnected world, cybersecurity must prioritize human impact as much as financial returns.

This operation proves that when the right tools, resources, and mindset are applied, even the most complex cyber threats can be neutralized. And it sends a strong message to those who would exploit digital systems for profit: there's always someone watching from the inside.