What is known about the Australian Federal Police’s August 26, 2026 arrests of 21 year old Cottesloe resident Ruben Thomson, also known as “Ellis” and allegedly TeamPCP’s leader until March 2026, and 23 year old Mandurah resident Michael Gaebler—including their search warrant loc

The arrests and charges are confirmed, but many of the more granular claims about leadership, aliases, earnings, operational structure, and bail are not established by the AFP release or the higher-authority material available so far. These are allegations, not findings of guilt.

• Arrests and searches: On 26 August, AFP and Western Australia Police, assisted by the FBI, arrested a 21-year-old Cottesloe man and a 23-year-old Mandurah man after searches at properties in Cottesloe, Hamilton Hill and Mandurah. Police seized electronic devices and other material for forensic examination. 7

• Identities and court status: Public reporting identifies the men as Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23—not “Michael Gaebler” as a standalone name. They were due in Perth Magistrates Court on 27 August. The AFP release does not report the bail decisions; on the evidence reviewed, the bail outcomes are therefore unconfirmed. 7

• Charges and maximum statutory penalties: Thomson faces eight counts: possessing data for a computer offence (maximum three years), four counts of unauthorised data modification intending a serious offence (five years each), supplying data for a computer offence (three years), failure to comply with a section 3LA order (10 years), and dealing with at least $100,000 in alleged proceeds of crime (20 years). Gaebler faces six counts: possessing data, four alleged unauthorised-modification counts, and supplying data, with the corresponding three- and five-year statutory maximums. Maximums are not necessarily cumulative or the sentence either man would receive if convicted. 7

• Alleged campaign scale and method: AFP alleges the syndicate inserted malicious code into open-source repository software, which downstream developers then used unknowingly. It says the code potentially compromised more than 1,000 organisations globally, enabled theft of more than 500,000 credentials and exfiltration of at least 300 GB of data, and has produced remediation costs in the hundreds of millions of dollars. 7

• Named victims/projects: Independent security reporting attributes supply-chain compromises to TeamPCP involving Trivy, Checkmarx KICS and LiteLLM; reporting also describes other alleged targets, including Mercor and GitHub-related infrastructure. 36 CERT-EU separately confirmed that the European Commission reported a significant cloud incident connected to a Trivy supply-chain compromise, so this is stronger than merely a speculative possible impact. 1

• Leadership, “Ellis,” $20,000, and operating model: I found insufficient high-authority evidence to confirm that Thomson used the alias “Ellis,” led TeamPCP until March 2026, personally earned about $20,000, or that the group operated specifically as a peer collective with one central figure rather than a hierarchy. Those claims should be treated as unverified attribution unless supported by charging documents or sworn evidence.

• Shai-Hulud and sophistication: Security research links TeamPCP to a “Mini Shai-Hulud” propagation wave, but the available material does not establish, at a standard suitable for a definite statement, that TeamPCP created the original Shai-Hulud worm. The assertion that the group mainly rapidly repurposed public exploits and malware ideas, despite limited technical sophistication, is also analytical commentary rather than an AFP finding. 3

• What comes next: The AFP says forensic work on seized data is continuing and expressly has not ruled out additional arrests or charges. 7