Australia charges TeamPCP hackers: the Australian Federal Police said it charged two Western Australian men on August 26 after an investigation into an alleged open-source software supply-chain operation with claimed victims around the world. The 21-year-old man from Cottesloe and the 23-year-old man from Mandurah were due in Perth Magistrates Court on August 27. Charges are allegations, and the authorities disclosed no plea, bail decision or court outcome.
The AFP investigated alongside the Western Australia Police Force, while the FBI ran a parallel investigation. FBI Cyber Division Assistant Director Brett Leatherman alleged the two men were members of TeamPCP. The AFP alleged both were principal participants in a syndicate involved in data intrusion, identity crime and cryptocurrency-based money laundering, and said their alleged cryptocurrency payments are still being valued.
Police searched properties in Cottesloe, Hamilton Hill and Mandurah, arrested the men, and seized electronic devices and other material for forensic examination, according to the joint AFP, FBI and Western Australia Police Force release.
How did the alleged supply-chain compromise work?
The investigation began in April after cyber-threat assessment companies passed information to the AFP and FBI, the agencies said. Investigators allege the syndicate inserted malicious code into software hosted in an open-source repository. Developers then incorporated that software into their own work without knowing it had been altered.
That is the supply-chain part: compromise a component that others trust, and its users can carry the compromise into their own systems. Police allege the code reached organizations in government, academia and the private sector, where it enabled intrusions and collection of sensitive material, including credentials and authentication data.
The AFP estimates the code potentially affected more than 1,000 organizations globally, enabled the theft of more than 500,000 credentials and the removal of at least 300GB of data. It put worldwide remediation costs in the hundreds of millions of dollars. Those figures are authorities' estimates, not findings tested in court.
What charges do the two men face?
The Cottesloe man faces eight charges: possessing data with intent to commit a computer offence; four counts of unauthorized modification of data with intent to commit a serious offence; supplying data with intent to commit a computer offence; failing to comply with a 3LA order; and dealing with alleged proceeds of crime worth $100,000 or more.
The Mandurah man faces six charges: possessing data with intent to commit a computer offence; four counts of unauthorized modification of data with intent to commit a serious offence; and supplying data with intent to commit a computer offence.
The AFP said statutory maximum penalties for the listed offences range from three to 20 years per count. Those maxima do not establish what penalty, if any, a court would impose.
A large volume of seized information remains under forensic examination, the AFP said, and investigators have not ruled out further arrests or charges. The agency's joint release says the case remains ongoing.
This story draws on original reporting from The Record.
