The Australian Federal Police (AFP) has charged two Western Australian men with a combined total of 14 offences over their alleged role in TeamPCP, the cybercrime group behind the March 2026 compromise of Trivy, Checkmarx KICS, and BerriAI LiteLLM.

Louis Michael Gaebler, 23, and Ruben Ian Thomson, 21, appeared in Perth Magistrates Court on August 27, 2026, a day after the AFP and the Western Australia Police Force (WAPF) executed search warrants at properties in Cottesloe, Hamilton Hill, and Mandurah and seized electronic devices for forensic analysis.

Police allege the two men were principal participants in the syndicate and received payments in cryptocurrency, the value of which is still under investigation. The Federal Bureau of Investigation (FBI) said in a July 2 advisory that organizations impacted by the campaign should treat exfiltrated data and credentials as a persistent risk, and advised rotating all continuous integration and continuous delivery (CI/CD) secrets, publishing tokens, and cloud credentials accessible during the exposure windows.

FBI Cyber Division Assistant Director Brett E. Leatherman said in a joint media release that the two men are allegedly members of TeamPCP, whose malicious code “potentially compromised more than a thousand organizations worldwide.”

The Cottesloe man, 21, was charged with one count of possessing data with intent to commit a computer offence, four counts of unauthorised modification of data with intent to commit a serious offence, one count of supplying data with intent to commit a computer offence, one count of failing to comply with a section 3LA order, and one count of dealing with proceeds of crime worth $100,000 or more.

The Mandurah man, 23, was charged with one count of possessing data with intent, four counts of unauthorised modification of data with intent to commit a serious offence, and one count of supplying data with intent to commit a computer offence. The section 3LA count, brought under the Crimes Act 1914 (Cth), carries a maximum penalty of 10 years’ imprisonment, and the proceeds of crime count carries a maximum of 20 years.

None of the 14 charges names a specific compromised project.

The chain started with the Trivy scanner compromise on March 19, 2026, when a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release.

Aqua Security said in its security advisory that the actor force-pushed 76 of 77 version tags in aquasecurity/trivy-action to credential-stealing malware and replaced all seven tags in aquasecurity/setup-trivy with malicious commits. Malicious Trivy v0.69.5 and v0.69.6 images were published to Docker Hub on March 22.

The intrusion continued a supply chain attack that began in late February 2026, and the credential rotation performed after the March 1 disclosure was not atomic, leaving a valid token usable during a rotation window that lasted a few days.

The Trivy ecosystem compromise is tracked as CVE-2026-33634, which the CNA, GitHub, Inc., rated 9.4 on the CVSS v4.0 scale, and which the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added to its Known Exploited Vulnerabilities catalog on March 26, 2026.

The Checkmarx KICS actions were poisoned next, with all 35 tags of checkmarx/kics-github-action force-pushed and version 2.3.28 of checkmarx/ast-github-action poisoned. Unit 42 said the KICS stage took place on March 21, while Wiz reported the compromise on March 23.

LiteLLM’s own build pipeline installed Trivy without pinning it to a verified version. The poisoned scanner then had read access to the runner environment, including the project’s PyPI publishing token.

The actor leveraged that token to publish the backdoored LiteLLM releases on March 24, 2026.

Version 1.82.8 shipped a Python startup hook named litellm_init.pth. The interpreter processes .pth files at startup, so the payload executed on every Python process on the host regardless of whether LiteLLM was ever imported.

The PyPA advisory

tells anyone who installed and ran the project to assume that any credentials available to the litellm environment may have been exposed, and to revoke and rotate them.

The Hacker News confirmed via PyPI on August 27 that neither 1.82.7 nor 1.82.8 appears in the package’s release history, and that both artifacts still return HTTP 200 from PyPI’s content delivery network at their direct package URLs. The versions do not resolve through the package index, and a standard install will not retrieve them.

The AFP said the malicious code potentially compromised more than 1,000 organizations globally, enabled the theft of more than 500,000 credentials, and led to the exfiltration of at least 300 gigabytes of data. Unit 42 published the same two figures in March, hedged as what the actor “may have exfiltrated,” and sourced them in part to vx-underground.

CloudSEK and Hudson Rock published the August exposure figures for the same campaign, with CloudSEK putting reconstructed exposure at more than 2,500 organizations and roughly 434,000 CI/CD pipelines, and Hudson Rock attributing 118,829 CI runner dumps to 2,488 corporate domains from a 153GB archive of the attackers’ own exfiltrated data.

CloudSEK said credential theft is not proof that a company was successfully compromised, and the confirmed victim count is the 16 organizations TeamPCP published on its leak site as of late March.

StepSecurity said its analysis of the CloudSEK dataset found GitLab led the affected platforms with 1,064 organizations, ahead of GitHub Actions on 618, Azure DevOps on 233, Jenkins on 105, Bitbucket Pipelines on 94, and CircleCI on 15.

TeamPCP-linked infrastructure has been traced back to 2020, Oligo Security said in an August 5 report, tying the group to activity previously tracked as TA-NATALSTATUS and IronErn through overlapping domains, malware deployment paths, staging techniques, and backend infrastructure.

Whether that continuity reflects a rebrand, a shared operator set, or close collaboration between historically related actors “cannot be determined with 100% certainty,” Oligo said.

The group open-sourced the worm framework used in the Mini Shai-Hulud campaign to GitHub on May 12, 2026.

A fresh npm wave using the same toolkit poisoned the keyv and cacheable packages on August 4, 2026. Socket said the self-identifying markers that would tie the sample to a named campaign were not recovered.

The FBI advisory lists tpcp-docs and docs-tpcp as the repository names the worm creates using stolen credentials, and advises defenders to search their organizations for both and to pin all GitHub Actions workflows to verified commit SHA hashes rather than floating version tags.