Alleged Operators of the TeamPCP Hacking Group Arrested in Australia

Australian authorities have arrested the alleged operators of the TeamPCP hacking group, including suspected leader Ruben Thomson (aka DeadCatx3). The group is responsible for the Shai-Hulud malware campaigns, which targeted development environments in widespread software supply chain attacks. Discover how security researchers used open-source intelligence (OSINT) to unmask these cybercriminals, and learn key strategies to protect your organization's software development pipeline from ongoing threats.

Australian authorities have arrested two individuals suspected of operating the TeamPCP hacking group. Among those arrested is Ruben Thomson (aka DeadCatx3), who is alleged to be the group's leader.

Over the past year, TeamPCP was linked to a series of significant software supply chain attacks. The group is most notably associated with the Shai-Hulud and Mini Shai-Hulud malware campaigns. These self-propagating programs targeted software development environments by compromising development pipelines and automated security tools. Once inside a network, the malware extracted developer credentials and inserted unauthorized code into widely used software packages.

In May 2026, the group publicly released the source code for the Shai-Hulud framework, enabling other malicious actors to replicate these attacks against organizations worldwide.

The arrests were aided by an investigation from Flare's Emerging Threats Team. Using open-source intelligence (OSINT), researchers analyzed public data to connect the DeadCatx3 alias to a real identity. By linking public activity across platforms like HackerOne, Hugging Face, TikTok, and Steam—and identifying reused emails, passwords and shared profile images—researchers provided law enforcement with the evidence needed to identify the operators.

Key Takeaways

Supply Chain Risks: A compromised development tool can grant attackers broad access to an organization's internal systems. It is critical to secure and monitor the tools used to build and deploy software.
Ongoing Threats: Although the suspected creators of Shai-Hulud have been arrested, their publicly released framework remains accessible. Organizations must continue to prioritize the security of their development environments.
The Value of Threat Intelligence: This case highlights the effectiveness of threat intelligence in tracking cybercriminals. By connecting small digital footprints across the internet, security researchers can successfully uncover the identities behind anonymous aliases.

Sources

Read more about the investigation and the arrests here: