AnswersPublished14 sources
What the TeamPCP Arrests Reveal About the Alleged Global Supply-Chain Campaign
The AFP charged Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23, with 14 combined offences after searches in Cottesloe, Hamilton Hill and Mandurah on 26 August 2026. Thomson faces eight charges and Gaebler six, but the maximum penalties listed for individual offences are not predictions of the sentences either...
Published byEdited with GPT-5.6 LunaImages generated with GPT Image 1.5
Research answer
Key takeaways
- The AFP charged Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23, with 14 combined offences after searches in Cottesloe, Hamilton Hill and Mandurah on 26 August 2026.
- Thomson faces eight charges and Gaebler six, but the maximum penalties listed for individual offences are not predictions of the sentences either man would receive.
- Claims that Thomson used the alias “Ellis,” led TeamPCP until March 2026, earned about $20,000 or operated as the group’s central figure are not established by the AFP release or the strongest available sources.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What is known about the Australian Federal Police’s August 26, 2026 arrests of 21-year-old Cottesloe resident Ruben Thomson, also known as “. Article summary: The arrests and charges are confirmed, but many of the more granular claims about leadership, aliases, earnings, operational structure, and bail are not established by the AFP release or the higher-authority material ava. Topic tags: general, education, news, general web, government. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, c
The Australian Federal Police says two Western Australian men have been charged over their alleged roles in TeamPCP, a cybercrime group accused of poisoning trusted open-source software with malicious code. The arrests followed a joint operation involving the AFP, Western Australia Police Force and the FBI on 26 August 2026. 7
The case is significant because the alleged attack model targeted software used by other developers: downstream organisations could be exposed simply by using a compromised tool or package. But the public record still does not establish every detail circulating about the suspects or the group. The allegations have not been tested at trial.
Who was arrested?
The AFP says officers arrested a 21-year-old man from Cottesloe and a 23-year-old man from Mandurah after executing search warrants at properties in Cottesloe, Hamilton Hill and Mandurah. Electronic devices and other material were seized for forensic examination. 7
Public reporting identifies the men as Ruben Ian Thomson and Louis Michael Gaebler. The available reporting does not support referring to Gaebler simply as “Michael Gaebler” where his full name is relevant. The pair appeared, or were scheduled to appear, in Perth Magistrates Court on 27 August. 3
7
The AFP’s release says forensic work is continuing and does not rule out further arrests or charges. It does not provide confirmed bail outcomes, so those outcomes should not be stated as fact on the current evidence.
What are the 14 charges?
The men face a combined 14 offences. According to the AFP account:
- Thomson faces eight charges: possessing data for a computer offence; four counts of unauthorised data modification with intent to commit a serious offence; supplying data for a computer offence; failing to comply with a section 3LA order; and dealing with at least $100,000 in alleged proceeds of crime.
- Gaebler faces six charges: possessing data for a computer offence; four counts of unauthorised data modification with intent to commit a serious offence; and supplying data for a computer offence.
7
The maximum penalties cited for Thomson’s offences include three years for possessing or supplying data, five years for each unauthorised-modification count, 10 years for failing to comply with the section 3LA order and 20 years for the alleged proceeds-of-crime offence. The corresponding data-possession, supply and modification charges apply to Gaebler. 7
Those figures are statutory maximums attached to individual offences. They do not mean that either defendant will receive those penalties, that the terms will automatically be added together or that a conviction will follow. The men are presumed innocent unless proven guilty.
What does the AFP allege about TeamPCP’s campaign?
The AFP alleges that the syndicate inserted malicious code into open-source repository software. Developers and organisations then used the affected tools without necessarily knowing they had been altered, allowing the attackers to reach downstream systems and harvest sensitive information. 7
Police say the campaign potentially:
- compromised more than 1,000 organisations worldwide;
- enabled the theft of more than 500,000 credentials;
- resulted in the exfiltration of at least 300 gigabytes of data; and
- generated remediation costs in the hundreds of millions of dollars.
These are investigative estimates and allegations, not a final accounting of confirmed victims or losses. Separate security reporting has linked TeamPCP to compromises involving Trivy, Checkmarx KICS and LiteLLM, while other reporting has described alleged impacts involving organisations such as Mercor and GitHub-related infrastructure. 3
6
Was the European Commission affected?
There is stronger evidence for a connection to the European Commission than for an unverified “possible” impact. CERT-EU said it assessed with high confidence that initial access to the Commission-related cloud environment was obtained through the Trivy supply-chain compromise, which had been publicly attributed to TeamPCP. CERT-EU also reported that a significant volume of data was exfiltrated. 23
That establishes a reported connection between the Trivy compromise and the European Commission cloud incident. It does not, by itself, prove every allegation about the Australian defendants’ personal involvement in that incident.
What remains unverified?
Several specific claims in early reporting or online discussion should be treated cautiously:
- that Thomson used the alias “Ellis”;
- that he led TeamPCP until March 2026;
- that he personally earned approximately $20,000;
- that TeamPCP was a peer community with one central figure rather than a formal hierarchy; and
- that the group created the original Shai-Hulud worm.
Security research has linked TeamPCP to a propagation wave described as “Mini Shai-Hulud.” That is not the same as establishing that TeamPCP created the original Shai-Hulud malware. Likewise, describing the group as technically unsophisticated or primarily dependent on rapidly repurposed public exploits is analysis, not a finding in the AFP charging announcement. 3
Some media reports describe Thomson as a leader or principal participant, but the available high-authority material does not establish all of the more detailed identity, organisational and financial claims. Those details may become clearer through charging documents, court proceedings or further investigative announcements.
What happens next?
The immediate next step is forensic analysis of the devices and other material seized during the searches. The AFP says that work is ongoing and that additional arrests or charges remain possible. 7
For now, the confirmed picture is narrower than the broadest descriptions of the case: two men have been charged with 14 alleged offences in a joint Australian-US investigation into a major software supply-chain campaign. The scale of the alleged impact is substantial, but questions about personal leadership, aliases, money and the group’s exact structure remain unresolved.
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "What the TeamPCP Arrests Reveal About the Alleged Global Supply-Chain Campaign"?
The AFP charged Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23, with 14 combined offences after searches in Cottesloe, Hamilton Hill and Mandurah on 26 August 2026.
What are the key points to validate first?
The AFP charged Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23, with 14 combined offences after searches in Cottesloe, Hamilton Hill and Mandurah on 26 August 2026. Thomson faces eight charges and Gaebler six, but the maximum penalties listed for individual offences are not predictions of the sentences either man would receive.
What should I do next in practice?
Claims that Thomson used the alias “Ellis,” led TeamPCP until March 2026, earned about $20,000 or operated as the group’s central figure are not established by the AFP release or the strongest available sources.
Sources
thehackernews.comAlleged TeamPCP Hackers Charged in Australia Over ...
techcrunch.comAustralian police arrest two over TeamPCP hacks targeting Mercor, OpenAI, and others | TechCrunch
cert.europa.euEuropean Commission cloud breach: a supply-chain compromise